well-known underground market that brokers sales of compromised credentials.

This "underground market" is literally available on clearnet: https://breachforums.is/

Therefore, also indexed by web crawlers:

https://m.stacker.news/13167

(Couldn't use the forum search since it requires an account)