Skip to main content
  • Regular article
  • Open access
  • Published:

Dark Web Marketplaces and COVID-19: before the vaccine

Abstract

The COVID-19 pandemic has reshaped the demand for goods and services worldwide. The combination of a public health emergency, economic distress, and misinformation-driven panic have pushed customers and vendors towards the shadow economy. In particular, dark web marketplaces (DWMs), commercial websites accessible via free software, have gained significant popularity. Here, we analyse 851,199 listings extracted from 30 DWMs between January 1, 2020 and November 16, 2020. We identify 788 listings directly related to COVID-19 products and monitor the temporal evolution of product categories including Personal Protective Equipment (PPE), medicines (e.g., hydroxyclorochine), and medical frauds. Finally, we compare trends in their temporal evolution with variations in public attention, as measured by Twitter posts and Wikipedia page visits. We reveal how the online shadow economy has evolved during the COVID-19 pandemic and highlight the importance of a continuous monitoring of DWMs, especially now that real vaccines are available and in short supply. We anticipate our analysis will be of interest both to researchers and public agencies focused on the protection of public health.

1 Introduction

COVID-19 gained global attention when China suddenly quarantined the city of Wuhan on January 23, 2020 [1]. Declared a pandemic by the World Health Organization on March 11, 2020, at the moment of writing the virus has infected more than 62,000,000 people and caused over 1,450,000 deaths worldwide [2]. Measures such as social distancing, quarantine, travel restrictions, testing, and contact tracing have proven vital to containing the COVID-19 pandemic [3].

Restrictions have shaken the global economy and reshaped the demand for goods and services worldwide, with an estimated 2.5–3% world GDP loss since the crisis started [4]. Demand for many products has fallen; for example, the price of Brent crude oil decreased from 68.90 USD a barrel on January 1, 2020 to 43.52 USD as of August 2, 2020 [5, 6]. Meanwhile demand for other products, such as toilet paper [7], dramatically increased. As a result of increased demand, some products have been in short supply. Individual protective masks were sold in the United States at 7 USD on February 2, 2020 [8] and the price of alcohol disinfectant doubled on July 1, 2020 in Japan [9]. Additionally, anti-gouging regulations were introduced to control prices, which significantly affected the public attention on products related to COVID-19 [10]. As this trend has continued, further exacerbated by online misinformation, numerous customers have sought to fulfill their needs through illicit online channels [11, 12].

Dark web marketplaces (DWMs) offer access to the shadow economy via specialized browsers, like Tor [13]. DWMs offer a variety of goods including drugs, firearms, credit cards, and fake IDs [14]. The most popular currency on DWMs is Bitcoin [15], but other cryptocurrencies are accepted for payment as well. The first modern DWM was the Silk Road, launched in 2011 [16] and shut down by the FBI [17] in 2013. Since then, dozens more DWMs have sprung up and many have shut down due to police action, hacks, or scams. Today, DWMs form an ecosystem [18] that has proven extremely resilient to law-enforcement. Whenever a DWM is shut down, users swiftly migrate to alternative active DWM and the economic activity recovers within a matter of days [19].

Researchers have studied DWMs since the emergence of Silk Road [16], through a series of case studies [2022], and comparative analyses [2328]. Past efforts have mostly focused on specific goods, such as drugs or digital products [29]. However, these studies experienced technical difficulties in data collection preventing researchers from analysing a large and up-to-date dataset. As a result, several questions remain open, among which are:

  • how do DWMs react to sudden shocks (e.g., shortages) in the traditional economy?

  • how do DWMs respond to trends in public attention?

In this study, we address these questions by analysing a new, large, and up-to-date dataset. We studied 851,199 listings extracted from 30 DWMs between January 1, 2020 and November 16, 2020, right before the first worldwide vaccination campaign started in the United Kingdom [30]. We identify 788 COVID-19 specific listings that range from protective masks [31] to hydroxychloroquine medicine [32]. These listings were observed 9464 times during this period, allowing us to investigate their temporal evolution. We compare this COVID-19 related shadow economy with public attention measured through Twitter posts (tweets) [33] and Wikipedia page visits [34]. Finally, we inspect listings that mentioned delays in shipping or sales because of COVID-19. We significantly extend previous analyses that surveyed 222 COVID-19 specific listings extracted from 20 DWMs on a single day (April 3, 2020) [35] and, to the best of our knowledge, offer the most comprehensive overview of the DWM activity generated by the ongoing pandemic.

We found that DWMs promptly respond to signals coming from the traditional economy, increasing or decreasing the supply of goods according to their availability on regulated markets. For example, protective masks appeared in DWMs in March, when they were in short supply in the regulated economy, and became more scarce on DWMs later on when masks could be easily bought in shops. We also found that DWMs swiftly react to changes in public attention as measured through Twitter posts and Wikipedia page views. Finally, we registered spikes in the number of listings mentioning COVID-19 in correspondence with lockdown measures in March and October. Our results are of interest to different audiences: the academic community may further explore the behaviour of DWMs in relation to social changes. Policy makers can better understand the effects that new legislation have in the shadow economy. Practitioners may learn that DWMs posit additional threats to public health. A finding especially important due to the production of COVID-19 vaccines.

The manuscript is organized as follows. In the Background Section, we introduce DWMs with a brief overview of their history. In the Data Section, we explain how we obtained our DWMs, Twitter, and Wikipedia datasets. The main outcomes of our work are presented in the Results Section, while in the Discussion Section we compare them with the established technical literature. Finally, in the Conclusion Section, we highlight the contributions of our work that are relevant to different audiences as well as future research developments.

2 Background: dark web marketplaces

The online shadow economy is as old as the Internet. The first reported illegal online deal involved drugs and took place in 1972 [36]. The World Wide Web [37] facilitated the emergence of online illicit marketplaces [38, 39] but the first marketplaces could not guarantee anonymity and therefore permitted the traceability of users by law enforcement [40].

Modern DWMs originated and still operate online, but outside the World Wide Web in an encrypted part of the Internet whose contents are often not indexed by standard web search-engines [41]. Silk Road marketplace, which launched in 2011, was the first modern DWM [16]. It proposed a new way of trading drugs and other illegal products online and anonymously [2325]. There were two key ingredients of Silk Road’s success. First, potential customers could access it using the Tor browser [13], which made their traceability difficult. Second, purchases were made in Bitcoin [15], which provided a degree of privacy to buyers and sellers [29, 42, 43]. After the FBI shut down Silk Road in 2013 [17], new DWMs quickly appeared, offering drugs, firearms, credit cards, and fake IDs [14]. These DWMs also adapted to further increase the level of privacy and security offered to users [20, 21], such as the Invisible Internet Project (I2P) [44] and escrow checkout services [45]. Tor, now available for mobile devices as well, still offers more privacy than many other popular mobile applications [46] and Bitcoin is currently the most popular cryptocurrency in DWMs [4749].

Trade today on DWMs is worth at least several hundreds of millions of USD per year, and involves hundreds of thousands of buyers and vendors [1719, 5052]. As a result, law enforcement agencies have put considerable effort into combating DWMs [17, 51, 52]. Furthermore, DWMs have been targets of cybercriminal actors through use of distributed denial-of-service (DDoS) attacks and hacking attempts, while some DWMs also shut down due to administrators stealing funds from customers directly [53, 54]. However, DWMs have organised into a robust ecosystem which has proven exceptionally resilient to closures and whenever a DWM is closed, the users trading higher volumes of Bitcoins migrate to active DWMs or establish new ones [19].

The resilience and functioning operations of modern DWMs are possible partially because of numerous websites and forums where users can share their experiences. One example is Dread [55], a Reddit-like forum created in 2018 after the closure of the dedicated pages on Reddit [56]. Other ad-hoc platforms exist to monitor whether known DWMs are active or currently unavailable [5760]. Additional mechanisms, like feedback and ratings systems [18], enhance the resilience of these DWMs and build trust towards the DWM and its vendors. In a similar way to regulated online marketplaces, DWM buyers are asked to leave feedback and a rating after a purchase. Additionally, DWM administrators often act as vendor moderators by banning vendors or specific categories of products. Some examples of this are DarkBay, where banned categories include human trafficking, contract killing and weapons [61], and Monopoly marketplace, where COVID-19 fake vaccine listings were recently banned by moderators [62].

DWMs have been used to circumvent laws and regulations. They have been the subject of many case studies [2022] and comparative analyses [2328]. These studies highlighted that illicit online transactions in DWMs are perceived as safer than negotiating in face-to-face drug markets [20]. They are based on the concept of “harm reduction,” where vendors prefer to sell tested and high-quality products [21]. Although DWMs form an online community, they are made unstable by their profit-based mentality of capitalism [22]. Vendors customize their products to match the specialisation of different DWMs thus creating an efficient distribution network [28], which sometimes goes beyond a base retail market [27]. While these characteristics favour the DWM economy against the offline shadow economy, DWMs sell a variety of illicit products [2326], such as, drugs, fake IDs, “how to” manuals (for scams, bombs etc.), and weapons. One prominent category is that of digital goods [63], including ransomware, social engineering guides, and financial malware to steal credit cards and bank account credentials.

It is hard to estimate how many live DWMs currently exist. Some recent reports include one from independent researcher Gwern, who identified 19 live platforms on April 22, 2020 [64], the website www.darknetstats.com, which registered 10 live “established” DWMs on May 27, 2020 [65], and one where 20 DWMs were observed one single day (April 3, 2020) [35]. Currently established DWMs at the time of writing include Hydra and White House marketplaces.

3 Data and methods

3.1 Dark web marketplaces

The listings used for our study were obtained by web crawling DWMs. Web crawling consists of extracting data from websites and is performed by specialized software. Web crawling DWMs is a challenging task because crawlers must bypass several protective layers. Most DWMs require authentication and some even require a direct invitation from a current member. Additionally, strong CAPTCHAs [66] are implemented to avoid otherwise easy and automated access to the online DWM. Several research groups tried to overcome these challenges. Some examples are, HTTrack software used in [16], a combination of PHP, the curl library, and MySQL was proposed in [67], the Python library scrapy adopted in [68], and an automated methodology using the AppleScript language utilized in [69]. There are currently very few open source tools available [66, 70] for crawling DWMs, which often leaves companies and federal agencies to rely on commercial software [71]. Downloading content from DWMs remains a challenging task, and the objective becomes even harder when the research study requires monitoring multiple DWMs for an extended period of time.

Our dataset contains listings crawled from 30 DWMs between January 1, 2020 and November 16, 2020 by Flashpoint Intelligence [72], a company specializing in online risk intelligence. It includes the most popular DWMs in 2020, such as Hydra, White House, Empire and DarkMarket [35, 65]. The crawling pipeline consists of authenticating into DWMs and downloading key attributes for each active listing, as highlighted in Fig. 1. Each DWM was crawled for at least 90 different days. We categorized the COVID-19 specific listings into PPE, medicines, guides on scamming, web domains, medical frauds, tests, fake medical records, and ventilators. Representative examples of listings relative to these categories are presented in Table 1, with specific listing examples in Appendix B.1. Only a fraction of the selected listings were actual COVID-19 specific listings, since mitigation measures to prevent COVID-19 spreading have also impacted illegal trades of other listings. For instance, a vendor might sell cocaine and mention shipping delays due to COVID-19. We included such cases in the category COVID-19 mentions. For details about data pre-processing, see Appendix A, where we explain how we select listings related to COVID-19 and how we classify them in categories. We remark that our pre-processing pipeline is biased towards the English language, and this constitutes a limitation of our work.

Figure 1
figure 1

Example of a chloroquine listing in the DarkBay/Dbay marketplace, where we highlight some of its salient attributes. Among the attributes considered in this work and shown in Table 4, “Time” and “Marketplace name” attributes are not present in this screenshot, while the “Quantity” attribute is not fixed by the vendor

Table 1 Categories used to classify the selected COVID-19 dataset. The first five categories constitute COVID-19 specific listings, while the last one, called COVID-19 mentions, includes listings mentioning one of the keywords in Table 5 without selling actual COVID-19 specific listings

Overall, our dataset includes a total of 851,199 unique listings, which were observed a total of 8,538,593 times between January 1, 2020 and November 16, 2020. In Table 2 we report the breakdown of the number of unique listings and their total observations in each of the 30 DWMs. We did not find any mention of COVID-19 on 12 DWMs (Atshop, Black Market Guns, Cannabay, Darkseid, ElHerbolario, Exchange, Genesis, Mouse in Box, Rocketr, Selly, Skimmer Device and Venus Anonymous). This makes sense as these DWMs are primarily focused on specific goods with a pre-defined listing text structure. A brief description of each DWM together with its specialization can be found in Table 7. On the remaining 18 DWMs, there were a total of 10,455 unique listings related to COVID-19, which constitutes less than 1% of the entire dataset. These listings were mostly composed of drugs that reported discounts or delays in shipping due to COVID-19. Listings concerning more specific COVID-19 goods such as masks, ventilators, and tests were available on 13 DWMs (Connect, Cypher, DarkBay/DBay, DarkMarket, Empire, Hydra, MagBO, Monopoly, Plati.market, Torrez, CanadaHQ, White House, and Yellow Brick). There were 788 COVID-19 specific listings in these DWMs which were observed 9464 times during the analysed time period.

Table 2 This Table reports the number of days each DWM was crawled, the number of unique listings, all and COVID-19 specific, and the number of listing observations, all and COVID-19 specific. CanadaHQ indicates The Canadian HeadQuarters marketplace

3.2 Twitter

We sampled tweets related to COVID-19 using a freely available dataset introduced in Chen et al [33]. We downloaded the tweets ID from the public GitHub repository and then used the provided script to recover the original tweets through the Python library twarc. We studied the temporal evolution of the number of tweets mentioning selected keywords, such as “chloroquine”. In line with our dataset of DWM listings, most of the considered tweets were written in English and the time period considered ranges from January 21, 2020 to November 13, 2020.

3.3 Wikipedia

We used the publicly available Wikipedia API [34] to collect data about the number of visits at specific pages related with COVID-19, such as chloroquine. The Wikipedia search engine was case-sensitive and we considered strings with the first letter uppercase, while the others lowercase. We looked for the number Wikipedia page visits in the English language from January 1, 2020 to November 16, 2020.

4 Results

We assessed the impact of COVID-19 on online illicit trade along three main criteria. First, we focused on the 13 DWMs containing at least one COVID-19 specific listing, analysing their offers in terms of the categories PPE, medicines, guides on scamming, web domains, medical frauds, tests, fake medical records, and ventilators, as introduced in Table 1. Second, we considered the 18 DWMs that included at least one listing in one of the categories in Table 1, thus adding listings to the COVID-19 mentions category in our analysis. We investigated the relationship between major COVID-19 events, public attention, and the time evolution of the number of active listings. Third, we quantified the indirect impact that COVID-19 had on all 30 DWMs under consideration by tracking the percentage of listings mentioning the themes of lockdown, delays, and sales. We linked their frequency to major COVID-19 events.

4.1 Categories of listings

Here, we focus on the 788 COVID-19 specific listings present in our dataset, observed 9464 times in the considered time window. PPE is the most represented category, with 355 unique listings (45.1% of COVID-19 specific listings) observed 5660 times (59.8% of observations of COVID-19 specific listings). The second most represented category is medicines, with 228 (28.9%) unique listings observed 1917 (20.3% of all) times. Some medicines listings, which are often sold together, included 38 chloroquine listings, 65 hydroxychloroquine listings, 51 azythromicin listings and 45 Amoxicillin listings. Other medicines included 2 remdesivir listings, one of the drugs used to treat USA’s president Trump [73]. A breakdown of the medicines category together with a brief description of the specific drugs can be found in Table 8, and multiple medicines are sometimes sold in the same listing. Another prominent category was guides on scamming, with 99 unique listings (12.6%). It includes manuals on how to earn money exploiting flaws in COVID-19 related government relief funds, and others on how to exploit alleged pandemic related security weaknesses (e.g. online banking, delivery systems). A breakdown of the different kinds of guides can be found in Table 9. One DWM (MagBO) was specialised in selling web domains, like “coronavirusmasks.in,” with 50 unique listings (6.3%). Additionally, we classified 34 (4.3%) unique listings as medical frauds, which are listings that promised immunity from COVID-19 (no such product exists, at the moment of writing), or supposed devices able to detect COVID-19 in the air. These listings also included illicit drug mixes sold as cures. We also registered 17 test (2.2% of COVID-19 specific listings), 3 fake medical records (0.4%) and 2 ICU ventilator (0.3%) listings. More details on these listings together with some examples are reported in Appendix B. There were a total of 252 vendors selling COVID-19 specific listings. Additionally, sellers posted multiple unique listings. In fact, 88 of them sold PPE (34.9%), 106 sold medicines (42.1%), 40 sold guides on scamming (15.9%), 15 web domains (6.0%), 23 sold medical frauds (9.1%), 13 sold tests (5.2%), 3 sold fake medical records (1.2%), and 2 sold ventilators (0.8%). The information in this paragraph is summarized in Table 3.

Table 3 Summary statistics for the considered categories of listings. For each category, we included the number of unique listings, observations, and vendors. If the same vendor sold listings in different categories, we counted it as one unique vendor

It is important to note that vendors often do not provide complete information on their listings but rather invite direct communication to facilitate sales. In 391 (49.6%) unique listings, the vendor invited potential customers to communicate via email or messaging applications such as WhatsApp, Wickr Me, and Snapchat. Thus, 511 (64.8%) COVID-19 specific listings contained no information about the offered amount of goods, 579 (73.5%) did not provide shipping information, and 16 (2.0%) did not disclose the listing price.

PPE and web domains were the least expensive products with a median price of 5 USD. Followed by medicines with 33 USD, guides on scamming with 75 USD, fake medical records with 130 USD, tests with 250 USD, medical frauds with 275 USD, and ventilators with 1400 USD. The distribution of prices for these categories can be found in Fig. 2(a). It shows that many listings had a low price of around a few USD or less and only few listings exceeded thousands or more USD. The cumulative value of the detected unique listings was \(563\mbox{,}202\) USD, where we excluded listings with prices larger than \(40\mbox{,}000\) USD using manual inspection. When vendors post listings at high price this typically indicates they have halted sales of an item with the expectation of selling it again in the future. We remove these anomalously high priced listings since they would largely overestimate the sales price of actually active listings [18]. The shipping information declared in the analysed listings involved a total of 18 countries or regions. Most of the vendors are willing to ship worldwide. Shipping from different continents appears possible because some vendors explicitly declare in listing descriptions that they have multiple warehouses across the globe, while shipping to any continent is done through specialized delivery services. The United States is the second largest exporter and shipping destination. The United Kingdom is the third largest exporter and importer, and no vendors explicitly mentioned Germany as a shipping destination even thought it is the fourth largest exporter. Complete shipping information is available in Fig. 2(b). Some examples of the COVID-19 specific listings are available in the Appendix B.1.

Figure 2
figure 2

(a) Box plot of the distribution of listing prices for each COVID-19 category. The box ranges from the lower to the upper quartile, with the horizontal line indicating the median. The whiskers extend up to the 5th and 95th percentiles respectively. The dots represent outliers. (b) Shipping information in COVID-19 specific listings. Note that 545 (or 71.1%) of these listings did not provide any shipping information

Figure 3(a) presents a word cloud built from the titles of the selected COVID-19 specific listings. The word cloud was built from 1-grams, meaning single words, excluding common English words and stop words. The COVID-19 pandemic was referred to as either “coronavirus,” “corona,” “covid,” or “covid19”. Among COVID-19 medicines, “hydroxychloroquine,” and “chloroquine” were the most popular ones, with fewer mentions of “azithromycin,” “medicated,” and “medical” products in general.

Figure 3
figure 3

(a) Word cloud for “Listing title” in COVID-19 specific listings. (b) Category breakdown of COVID-19 specific listings in the DWM that offered them. (c) Fraction of vendors selling at least one COVID-19 specific listing. (d) Vendor specialisation. Most vendors responsible for at least one COVID-19 specific listing also sell other listings, and in greater number

DarkBay/DBay marketplace contained the majority of the COVID-19 specific listings in our dataset, amounting to 425 (54.0%). The most available unique listings in DarkBay/DBay were PPE, which totaled 293. We also found 105 medicines, 24 medical frauds, 2 ventilators, and 1 tests. The number of listings available in the other DWMs was: 94 in Empire (which shut down in August 2020), 50 in MagBO, 49 in DarkMarket, 48 in The Canadian Headquarters, 42 in White House, and 35 in Yellow Brick. These numbers together with statistics of the less represented DWMs are as shown in Table 2. The entire breakdown of the number of COVID-19 specific listings detected in each category is available in Fig. 3(b).

In Fig. 3(c), we ranked the DWMs by their share of vendors selling COVID-19 specific listings. The total number of vendors behind COVID-19 specific listings in our dataset is 252. Most vendors sold only one COVID-19 specific listing, while few of them sold more than ten different unique COVID-19 specific listings. In Appendix D, we analysed the distribution of COVID-19 specific listings for each vendor. We found that it was heterogeneous according to a power-law with an exponent equal to −2.3 and 80% of the vendors had fewer than 5 unique listings, as shown in Fig. 7. This may imply that vendors of COVID-19 related products have a focus on a specific product category, or are just creating one-off listings to try to make quick money. In DarkBay/DBay, more than 15% of the vendors were selling COVID-19 specific listings, while in MagBO, The Canadian HeadQuarters, and Cypher this fraction was around 5% (with almost all other DWMs around 1%). This shows that law enforcement or intelligence intervention should not necessarily be approached evenly across marketplaces but instead focused on select marketplaces first with a higher concentration of COVID-19 specific listings. Finally, Fig. 3(d) shows that essentially no vendors specialised on COVID-19 products, with only 7 vendors selling more COVID-19 specific listings than unrelated ones, 4 of which actually sold just one or two COVID-19 specific listings overall in our dataset.

4.2 Time evolution of DWM listings and public attention

The number of active unique listings evolved over time, as shown in Fig. 4(a). The first COVID-19 specific listing in our dataset appeared on January 28, 2020, following the Wuhan lockdown [1]. In March, lockdowns in many countries [74, 75] corresponded to an increase in the number of these listings, whose number kept increasing until May. In June and July, when quarantine restrictions in the northern hemisphere started to ease [76], we observed a decreasing trend in the selected COVID-19 specific listings, which continued until November. COVID-19 mentions followed the same trend with two notable exceptions. We observed two sudden increases in COVID-19 in correspondence of the second wave of contagions in Europe in September [77] and new lockdown measures in November [78]. Figure 4(b) shows the evolution of the total number of observed PPE and medicines, the two most available COVID-19 specific listings in our dataset (see Table 3). PPE followed a trend compatible with the overall observations shown in Fig. 4(a), with a peak in May and a sudden decrease after July, as PPE have gradually become more available worldwide with respect to the shortage in the beginning of the pandemic. COVID-19 medicines remained approximately stable throughout these months, with a peak after USA president Donald Trump first referred to chloroquine [79]. A different trend was found for COVID-19 guides on scamming, which saw spikes in the number of listings in correspondence to event related to relief program measures [8082]. More details can be found in Appendix D, Fig. 8.

Figure 4
figure 4

Longitudinal analysis of DWM activity. (a) Seven-days rolling average of active listings mentioning COVID-19 and COVID-19 specific listings. (b) Seven-days rolling average of the observed COVID-19 specific listings in the medicines and PPE categories. Black dashed vertical lines in panels (a) and (b) corresponded to significant COVID-19 world events, see Appendix C. (c) Seven-days median price with 95% confidence interval for COVID-19 specific listings. (d) Seven-days median price with 95% confidence interval for active COVID-19 specific listings in the PPE and medicines categories

The time evolution of the listing prices followed a different pattern. We considered the median price and its 95% confidence interval of active COVID-19 specific listings in Fig. 4(c), and of active PPE and medicines, in Fig. 4(d). Until March, the only COVID-19 specific listings concerned medicines, which influenced the overall median price. Afterwards, when PPE listings started to appear, they led the variation in the overall median price. In fact, over the entire time window, the median price of medicines listings was reasonably stable. PPE listings, instead, had a high price for March and most of April, possibly due to speculation. Interestingly, at the end of April, a vendor named “optimus,” active on DarkBay, started selling large quantities of PPE at 1 USD, putting many online listings at the same time, thus drastically reducing the median price, which remained low until July. Overall, “optimus” had 91 PPE listings during the registered period. PPE median price then increased back to the March level in July, when general worldwide availability of masks for the general population decreased the demand for small quantities of products. We report an analysis of the listings price for COVID-19 guides on scamming in Fig. 8 of Appendix D.

We also considered tweets and Wikipedia page visits as proxies for public attention, as already done in prior studies analysing the COVID-19 pandemic [8385]. We compared trends in public attention with temporal variations in the number of active COVID-19 specific listings on DWMs. We focused our analysis on the PPE category and on relevant medicines in our dataset: hydroxychloroquine, chloroquine, and azitrhomycin. Figure 5(a) shows that a first peak in public attention on PPE was reached in late January following the Wuhan lockdown [1]. A second peak occurred in March [84] when PPE listings started to appear in DWMs. The number of PPE listings reached their maximum in May. After May, PPE listings steadily decreased along with public attention. It is worth noting that May also marked the end of the first wave of contagion in many European countries [86]. PPE listings virtually disappeared in July, as products became more accessible in legal shops. On the contrary Twitter saw a huge spike in June, when many states decided to gradually lift lockdown measures [76], causing a public debates on mask wearing which increased the twitter signal to stable high levels until November.

Figure 5
figure 5

DWMs and public attention. (a)-(c) Seven-days rolling average of active listings selling PPE, together with the time evolution of the number of tweets referring to masks and of visits in the relative Wikipedia page visits. (b)-(d) Similar comparison as in panels (a)-(c) but considering active listings of hydroxychloroquine, chloroquine, and azithromycin. Black dashed vertical lines in panels (a) and (b) mark significant events related with COVID-19, see Appendix C. See Appendix D for panels (a) and (b) with a linear y-axis

A similar relationship between mass media news, public attention, and DWMs was registered for the listings regarding the three considered medicines, as shown in Figs. 5(b) and (d). Four peaks in public attention were detected after four declarations from President Trump about these medicines [79, 8789]. The number of active medicines listings closely followed. However, a closer look reveals the different shapes of Wikipedia page visits, tweets, and DWM active listings curves. Wikipedia page visits saw a very high peak of page visits after the first declaration from President Trump [79], and smaller peaks in correspondence in the following declarations. Tweets instead saw peaks of attention of increasing height. DWM listings on the contrary were much steadier in time and with little variation in the number of active listings throughout the first wave of the pandemic, while decreasing to a lower steady availability from the summer.

4.3 Impact of COVID-19 on other listings

We considered the indirect impact of COVID-19 on all the 30 DWMs in our dataset. We analyzed all listings in these DWMs (COVID-19 related and beyond), and looked at listings mentioning: lockdown, using keywords “lockdown” or “quarantine,” delay, using “delay” or “shipping problem,” and sales, using “sale,” “discount,” or “special offer.” Examples of listings reporting these keywords are available in Appendix B.2.

Figure 6(a)-(b)-(c) shows the percentage of all listings mentioning these themes over time. The percentage of all listings in the 30 DWMs mentioning lockdown never exceeded 1%, as illustrated in Fig. 6(a). It reached its maximum in November, when Europe started new lockdown measures [78]. Other peaks occurred in April and September, when nations first started to implement these measures [1, 74, 75] and at the beginning of the second wave of contagion in Europe [77], respectively. Delay mentions reached local peaks in March and May. These peaks occurred after major COVID-19 events, such as lockdowns [74, 75] and the situation in Europe starting to improve [86], respectively. Two global peaks, instead, were reached in September and November, when cases started to surge again in Europe [77] and when Europe started new lockdown measures [78], as shown in Fig. 6(b). A similar pattern was visible for the percentage of all listings mentioning sales. In addition, we observed that sales had a first peak corresponding to the New Year, which is a common practice of many offline regulated shops, as displayed in Fig. 6(c). Despite observing that the increase in the percentage of all listings mentioning sales, delays, and lockdown followed major events related to the pandemic, not all of these listings also mentioned COVID-19. We further researched this by plotting which percentage of the relative listings also mentioned COVID-19 in Fig. 6(d). The percentage of listings mentioning that current sales were due to COVID-19 was less than 1%, while mentions of delays reached up to 40%. For lockdown it was close to 100% until July, as one can expect since lockdowns exist because of COVID-19. In the three selected cases, the percentages of listings mentioning COVID-19 followed the global awareness about the current pandemic: increasing trends from January to the July [1, 74, 75, 90], less attention during the summer [86], and a returning increase in September and November [77, 78].

Figure 6
figure 6

Percentage of all active listings mentioning the themes lockdown, delay and sales in panels (a), (b), (c), respectively. (d) Percentage of active listings in panels (a), (b), (c) that mentioned also COVID-19 in their listings. Black dashed vertical lines in panels (a), (b), and (c) corresponded to major COVID-19 events, see Appendix C

5 Discussion

We investigated the presence of listings related to COVID-19 in 30 DWMs, monitored over a ten-months period in 2020. We considered COVID-19 specific listings and COVID-19 mentions, found them in 13 and 18 DWMs, respectively. COVID-19 specific listings totaled 788 unique products and represented less than 1% of our dataset. The majority of COVID-19 specific listings offered PPE (45.1%), followed by medicines (28.9%), guides on scamming (12.6%), web domains (6.3%), medical frauds (4.3%), tests (2.2%), fake medical records (0.4%) and ventilators (0.3%). Most COVID-19 specific listings did not report the quantity sold (64.8%) or shipping information (73.5%). Almost half of these listings invited potential customers to communicate via email or messaging applications, like WhatsApp (49.6%). Although direct communication fosters a trustworthy vendor-buyer relationship and may lay the ground for future transactions outside DWMs, it also exposes users to higher risk of being traced by law enforcement [91].

In our dataset, DarkBay/DBay is featured prominently among DWMs offering COVID-19 specific listings. Ranking in the top 100 sites in the entire dark web [92], DarkBay/DBay is regarded as the eBay of the dark web because it offers more listings categories than other DWMs [93]. It was also frequently accessible during the period of time monitored during this research, with an uptime of 80%, higher from the 77% uptime of Empire, the largest global DWM at the time of writing [94].

Our work corroborates previous findings and expands them in several ways. To the best of our knowledge, the most extensive report to date examined the presence of COVID-19 specific listings in 20 DWMs on one single day (April 3, 2020) [35]. Despite only a subset of overlapping DWMs between that report and our study, (Cypher, DarkBay/DBay, DarkMarket, Empire, Monopoly, Venus Anonymous, White House, and Yellow Brick) we both assessed that COVID-19 specific listings constituted less than 1% of the total listings in the DWMs ecosystem. These listings were mostly PPE, followed by medicines and they were found in only a few DWMs, while non COVID-19 specific listings were widespread.

An important novelty of the present study is the analysis of the temporal evolution of DWM behaviour and its relationship to public attention, as quantified through tweets and Wikipedia page visits. Following the Wuhan lockdown [1], we observed a first peak in public attention [85], and a corresponding emergence of the COVID-19 specific listings. A second peak in public attention occurred in March, when quarantine measures were adopted by many European countries [74, 75]. Again, during the same period, the number of COVID-19 specific listings sharply increased. When worldwide quarantine began to ease [76] in many countries, in June and July, we registered a decrease in public attention and in available COVID-19 specific listings. Towards the end of 2020, we did not detect significant variations in COVID-19 specific listings and public attention, in correspondence of the second wave of contagions [77] and new lockdown measures in Europe [78]. Both vendors of COVID-19 specific listings and public attention have adapted to the COVID-19 pandemic and react more smoothly to its development.

Listing prices correlated with both variations in public attention and individual choices of a few vendors. Median price experienced a sharp increase in March, probably due to speculation, and then decreased in April due to the choice of a single vendor responsible for 91 listings, named “optimus.” The vendor sold a large quantity of PPE at 1 USD only, which constituted the 37% of active PPE listings in April. Finally, we observed an increase in the percentage of all listings citing delays in shipping and sale offers, which peaked in March, May, September, and November. Similar to a prior work that found Wikipedia page visits of a given drug to be a good predictor for its demand in DWMs [95], we provided further evidence that the DWMs ecosystem is embedded in our society and responds in line with social changes [96]. The DWMs ecosystem swiftly reacted to the pandemic by offering goods in high demand, and even offering vaccines already in March, when no tested vaccination existed.

Our research shares some limitations with previous studies, namely that not all active DWMs were surveyed. For instance, we did not analyse 12 of the DWMs explored in the previous report [35]. It must be noted, however, that the number of active DWMs is constantly changing due to closures or new openings [19] and obtaining full coverage is challenging due to the active efforts of DMWs to obstruct research studies and law enforcement investigations, for example through the use of CAPTCHAs. Another limitation is the lack of reliable fully automated annotation method: this forced us to manually annotate listings and thus limited our analysis to listings only directly related to COVID-19. One key problem to be solved in this regard is the presence of false positives when doing a keyword search. In the presence of a more automated pipeline, one could extend this analysis to a more precise quantification of the effect of the pandemic on traditional goods traded on DWMs such as weapons, drugs, or digital goods.

6 Conclusion

By revealing that DWMs listings of goods related to COVID-19 exist and are correlated with public attention, we highlight the need for a close monitoring of the online shadow economy in the future months, in order to control and anticipate dangerous effects of the COVID-19 “infodemic” [84, 85]. We plan to improve our analysis of DWM activity by increasing the number of monitored DWMs and conducting a more extensive analysis of the impact on the pandemic on overall DWM trade by considering changes in prices of non-COVID-19 specific listings, such as drugs, weapons, or malware. We released a new website [97], where we will provide constant updates on the effect of the pandemic on DWMs.

We anticipate that our work will interest a wide audience and spark new research. Future research work may further explore the behaviour of DWMs over time, potentially extending the spectrum of monitored goods and relating the observed trends to specific social changes. Policy makers and public agencies (especially those focused on protecting consumer rights and health) can use our findings to better assess and shape the effects of legislation on the shadow economy [98]. Practitioners may gain insights on how DWMs posit additional threats to public health. Uninformed citizens exposed to waves of misinformation, such as the ones related to hydroxychloroquine, chloroquine, and azitrhomycin [79, 8789], may be tempted to shop on DWMs thus exposing themselves to serious health risks. Moreover, the availability of regulated products currently in shortage in the traditional economy undermines anti-price gouging regulations and regulated businesses which sell the same products.

Availability of data and materials

The data that support the findings of this study are available from Flashpoint Intelligence but restrictions apply to the availability of these data, which were used under license for the current study, and so are not publicly available.

References

  1. Taylor DB (2020) A timeline of the coronavirus pandemic. https://www.nytimes.com/article/coronavirus-timeline.html Accessed August 2, 2020. The New York Times

  2. WHO (2020) Coronavirus disease (COVID-2019) situation reports. https://www.who.int/emergencies/diseases/novel-coronavirus-2019/situation-reports Accessed August 2, 2020. World Health Organization

  3. Kraemer MU, Yang C-H, Gutierrez B, Wu C-H, Klein B, Pigott DM, Du Plessis L, Faria NR, Li R, Hanage WP et al. (2020) The effect of human mobility and control measures on the COVID-19 epidemic in China. Science 368(6490):493–497

    Article  Google Scholar 

  4. Fernandes N (2020) Economic effects of coronavirus outbreak (COVID-19) on the world economy. Available at SSRN 3557504

  5. Arezki R, Nguyen H (2020) 4 Novel coronavirus hurts the Middle East and North Africa through many channels. Economics in the Time of COVID-19, 53

  6. Bloomberg (2020) Markets energy. https://www.bloomberg.com/energy Accessed August 2, 2020

  7. Narishkin A, Cameron S (2020) Why toilet-paper demand spiked 845%, and how companies kept up with it. https://www.businessinsider.com/why-toilet-paper-demand-spiked-845-how-companies-kept-up-2020-5?r=US&IR=T Accessed August 2, 2020

  8. Miller AM (2020) The Wuhan coronavirus has led to a face mask shortage, with sellersnow offering masks at up to $7 apiece. https://www.businessinsider.com/wuhan-coronavirus-mask-shortage-causing-price-increase-2020-1?IR=T Accessed August 2, 2020. Business Insider

  9. Sakuma K (2020) Woman reported to prosecutors for alcohol disinfectant at double price in Japan. https://mainichi.jp/english/articles/20200701/p2a/00m/0na/012000c Accessed August 2, 2020. The Mainichi

  10. Chakraborti R, Roberts G Anti-price gouging laws, shortages, and COVID-19: big data insights from consumer searches

  11. GIATOC (2020) CovidCrimeWatch: crime and contagion: the impact of a pandemic on organized crime. https://globalinitiative.net/crime-contagion-impact-covid-crime/ Accessed August 2, 2020

  12. Europol, EMCDDA (2020) EU drug markets impact of COVID-19. https://www.europol.europa.eu/newsroom/news/eu-drug-markets-impact-of-covid-19 Accessed August 2, 2020

  13. Dingledine R, Mathewson N, Syverson P (2004) Tor: the second-generation onion router. Technical report, Naval Research Lab Washington DC

  14. Gwern (2019) Darknet market mortality risks. https://www.gwern.net/DNM-survival Accessed August 2, 2020

  15. Nakamoto S (2008) Bitcoin: a peer-to-peer electronic cash system. Technical report, Manubot

  16. Christin N (2013) Traveling the Silk Road: a measurement analysis of a large anonymous online marketplace. In: Proceedings of the 22nd international conference on world wide web, pp 213–224

    Chapter  Google Scholar 

  17. Lynch GE (2017) United States of America : vs. Ross William Ulbricht. https://caselaw.findlaw.com/us-2nd-circuit/1862572.html Accessed August 2, 2020. United States Court of Appeals

  18. Soska K, Christin N (2015) Measuring the longitudinal evolution of the online anonymous marketplace ecosystem. In: 24th {USENIX} security symposium ({USENIX} security 15), pp 33–48

    Google Scholar 

  19. ElBahrawy A, Alessandretti L, Rusnac L, Goldsmith D, Teytelboym A, Baronchelli A (2020) Collective dynamics of dark web marketplaces. Sci Rep 10(1):1–8

    Article  Google Scholar 

  20. Van Hout MC, Bingham T (2013) Silk Road, the virtual drug marketplace: a single case study of user experiences. Int J Drug Policy 24(5):385–391

    Article  Google Scholar 

  21. Van Hout MC, Bingham T (2014) Responsible vendors, intelligent consumers: Silk Road, the online revolution in drug trading. Int J Drug Policy 25(2):183–189

    Article  Google Scholar 

  22. Lacson W, Jones B (2016) The 21st century darknet market: lessons from the fall of Silk Road. Int J Cyber Criminol 10(1):40–61

    Google Scholar 

  23. Barratt MJ, Ferris JA, Winstock AR (2014) Use of Silk Road, the online drug marketplace, in the United Kingdom, Australia and the United States. Addiction 109(5):774–783

    Article  Google Scholar 

  24. Martin J (2014) Lost on the Silk Road: online drug distribution and the cryptomarket. Criminol Criminal Justice 14(3):351–367

    Article  Google Scholar 

  25. Aldridge J, Décary-Hétu D (2014) Not an Ebay for drugs: the cryptomarket Silk Road as a paradigm shifting criminal innovation. Available at SSRN 2436643

  26. Dolliver DS, Love KL (2015) Criminogenic asymmetries in cyberspace: a comparative analysis of two tor marketplaces. J Glob Stud 6(2):75–96

    Google Scholar 

  27. Dolliver DS (2015) Evaluating drug trafficking on the Tor network: Silk Road 2, the sequel. Int J Drug Policy 26(11):1113–1123

    Article  Google Scholar 

  28. Broséus J, Rhumorbarbe D, Mireault C, Ouellette V, Crispino F, Décary-Hétu D (2016) Studying illicit drug trafficking on darknet markets: structure and organisation from a Canadian perspective. Forensic Sci Int 264:7–14

    Article  Google Scholar 

  29. Rhumorbarbe D, Staehli L, Broséus J, Rossy Q, Esseiva P (2016) Buying drugs on a darknet market: a better deal? Studying the online illicit drug market through the analysis of digital, physical and chemical data. Forensic Sci Int 267:173–182

    Article  Google Scholar 

  30. BBC (2020) Covid-19 vaccine: first person receives Pfizer jab in UK. https://www.bbc.co.uk/news/uk-55227325 Accessed December 8, 2020

  31. WHO (2020) Coronavirus disease (COVID-19) advice for the public: when and how to use masks. https://www.who.int/emergencies/diseases/novel-coronavirus-2019/advice-for-public/when-and-how-to-use-masks Accessed August 2, 2020. World Health Organization

  32. BMJ (2020) Coronavirus disease 2019 (COVID-19): emerging treatments. https://bestpractice.bmj.com/topics/en-gb/3000168/emergingtxs Accessed August 2, 2020

  33. Chen E, Lerman K, Ferrara E (2020) Tracking social media discourse about the COVID-19 pandemic: development of a public coronavirus Twitter data set. JMIR Public Health Surveill 6(2):19273

    Article  Google Scholar 

  34. Wikipedia (2020) Wikimedia REST API. https://wikimedia.org/api/rest_v1/ Accessed August 2, 2020

  35. Broadhurst R, Ball M, Jiang CJ et al. (2020) Availability of COVID-19 related products on tor darknet markets. Australasian Policing 12(3):8

    Google Scholar 

  36. Markoff J (2005) What the dormouse said: how the sixties counterculture shaped the personal computer industry. Penguin, New York

    Google Scholar 

  37. Berners-Lee T, Cailliau R, Luotonen A, Nielsen HF, Secret A (1994) The world wide web. Commun ACM 37(8):76–82

    Article  Google Scholar 

  38. Power M (2013) Drugs 2.0: the web revolution that’s changing how the world gets high. https://www.theguardian.com/books/2013/may/12/drugs-web-revolution-power-review Accessed August 2, 2020. The Guardian

  39. Zetter K (2012) 8 suspects arrested in online drug market sting. https://www.wired.com/2012/04/online-drug-market-takedown/ Accessed August 2, 2020. Wired

  40. Barratt MJ (2011) Discussing illicit drugs in public internet forums: visibility, stigma, and pseudonymity. In: Proceedings of the 5th international conference on communities and technologies, pp 159–168

    Chapter  Google Scholar 

  41. Martin J (2014) Drugs on the dark net: how cryptomarkets are transforming the global trade in illicit drugs. Springer, London

    Book  Google Scholar 

  42. Cappa F, Pinelli M (2020) Collecting money through blockchain technologies: first insights on the determinants of the return on initial coin offerings. Inf Technol Dev 1–18. https://doi.org/10.1080/02681102.2020.1801564

    Article  Google Scholar 

  43. Masoni M, Guelfi MR, Gensini GF (2016) Darknet and Bitcoin, the obscure and anonymous side of the internet in healthcare. Technol Health Care 24(6):969–972

    Article  Google Scholar 

  44. Zantout B, Haraty R et al. (2011) I2P data communication system. In: Proceedings of ICN, pp 401–409. Citeseer

    Google Scholar 

  45. Wehinger F (2011) The dark net: self-regulation dynamics of illegal online markets for identities and related services. In: 2011 European intelligence and security informatics conference. IEEE, pp 209–213

    Chapter  Google Scholar 

  46. Hayes D, Cappa F, Le-Khac NA (2020) An effective approach to mobile device management: security and privacy issues associated with mobile applications. Digit Bus 1(1):100001

    Article  Google Scholar 

  47. Lee S, Yoon C, Kang H, Kim Y, Kim Y, Han D, Son S, Shin S (2019) Cybercriminal minds: an investigative study of cryptocurrency abuses in the dark web. In: Network and distributed system security symposium. Internet Society, pp 1–15

    Google Scholar 

  48. Foley S, Karlsen JR, Putniņš TJ (2019) Sex, drugs, and bitcoin: how much illegal activity is financed through cryptocurrencies? Rev Financ Stud 32(5):1798–1853

    Article  Google Scholar 

  49. Möser M, Soska K, Heilman E, Lee K, Heffan H, Srivastava S, Hogan K, Hennessey J, Miller A, Narayanan A et al. (2018) An empirical analysis of traceability in the monero blockchain. Proc Priv Enhanc Technol 2018(3):143–163

    Google Scholar 

  50. Christin N (2017) An EU-focused analysis of drug supply on the AlphaBay marketplace. EMCDDA commissioned paper

  51. Ilascu I (2019) Dark web’s Wall Street market and Valhalla seized, six arrested. https://www.bleepingcomputer.com/news/security/dark-web-s-wall-street-market-and-valhalla-seized-six-arrested/ Accessed August 2, 2020. Bleeping Computer

  52. FBI (2017) Darknet takedown: authorities shutter online criminal market AlphaBay. https://www.fbi.gov/news/stories/alphabay-takedown Accessed August 2, 2020

  53. DarknetLive (2019) Grey Market Unsurprisingly Exit Scammed. https://darknetlive.com/post/grey-market-unsurprisingly-exit-scammed/ Accessed August 2, 2020

  54. DarknetLive (2019) BitBazaar is Exit Scamming. https://darknetlive.com/post/bitbazaar-is-exit-scamming/ Accessed August 2, 2020

  55. (2020) Dread forum. https://onion.live/site/dread-forum Accessed via Tor browser August 2, 2020

  56. Porter K (2018) Analyzing the darknetmarkets subReddit for evolutions of tools and trends using lda topic modeling. Digit Investig 26:87–97

    Article  Google Scholar 

  57. (2020) Onion.live. https://onion.live/page/about Accessed via Tor browser August 2, 2020

  58. (2020) Darknetlive. https://darknetlive.com/ Accessed August 2, 2020

  59. (2020) Dark.fail. https://dark.fail/ Accessed August 2, 2020

  60. (2020) DNStats. https://dnstats.net/ Accessed August 2, 2020

  61. (2020) Darknetlive. https://darknetlive.com/markets/darkbay/ Accessed August 2, 2020

  62. Cuthbertson A (2020) Coronavirus: dark web market bans drug dealers selling fake COVID-19 vaccines. https://www.independent.co.uk/life-style/gadgets-and-tech/news/coronavirus-vaccine-cure-dark-web-drugs-market-covid-19-a9442671.html Accessed August 2, 2020. Independent

  63. van Wegberg R, Tajalizadehkhoob S, Soska K, Akyazi U, Ganan CH, Klievink B, Christin N, van Eeten M (2018) Plug and prey? Measuring the commoditization of cybercrime via online anonymous markets. In: 27th USENIX security symposium (USENIX security 18). USENIX Association, Baltimore, pp 1009–1026

    Google Scholar 

  64. Gwern (2020) Updated: list of dark net markets (Tor & I2P). https://www.gwern.net/docs/sr/2019-04-22-deepdotweb-dnmlist.html Accessed August 2, 2020

  65. Darknet Stats (2020) Dark net markets comparison chart. https://www.darknetstats.com/dark-net-markets-comparison-chart/ Accessed August 2, 2020

  66. Ball M, Broadhurst R, Niven A, Trivedi H (2019) Data capture and analysis of darknet markets. Available at SSRN 3344936

  67. Baravalle A, Lopez MS, Lee SW (2016) Mining the dark web: drugs and fake ids. In: 2016 IEEE 16th international conference on data mining workshops (ICDMW). IEEE, pp 350–356

    Chapter  Google Scholar 

  68. Celestini A, Me G, Mignone M (2017) Tor marketplaces exploratory data analysis: the drugs case. In: International conference on global security, safety, and sustainability. Springer, Berlin, pp 218–229

    Google Scholar 

  69. Hayes DR, Cappa F, Cardon J (2018) A framework for more effective dark web marketplace investigations. Information 9(8):186

    Article  Google Scholar 

  70. Décary-Hétu D, Aldridge J (2013) DATACRYPTO: the dark net crawler and scraper. Software Program

  71. X-Byte Enterprise Crawling. https://www.xbyte.io/dark-deep-web-data-scraping.php Accessed August 2, 2020

  72. (2020) Flashpoint Intelligence. https://www.flashpoint-intel.com/ Accessed August 2, 2020

  73. Gallagher J (2020) Dexamethasone, remdesivir, Regeneron: Trump’s Covid treatment explained. https://www.bbc.co.uk/news/health-54418464 Accessed December 8, 2020. BBC

  74. Horowitz J, Bubola E (2020) On day 1 of lockdown, Italian officials urge citizens to abide by rules. https://www.nytimes.com/2020/03/08/world/europe/italy-coronavirus-quarantine.html Accessed August 2, 2020. The New York Times

  75. Landler M, Castle S (2020) Britain locks down to stem the coronavirus. more or less. https://www.nytimes.com/2020/03/24/world/europe/britain-coronavirus-lockdown.html Accessed August 2, 2020. The New York Times

  76. Santora M (2020) The world reopens, despite skyrocketing coronavirus cases. https://www.nytimes.com/2020/06/09/world/coronavirus-reopenings.html Accessed November 27, 2020. The New York Times

  77. Jones S, Willsher K, Grover N (2020) Spain is first country in western Europe to record half a million COVID cases. https://www.theguardian.com/world/2020/sep/07/spain-set-to-record-half-a-million-covid-cases Accessed November 28, 2020. The Guardian

  78. BBC (2020) COVID-19: PM announces four-week England lockdown. https://www.bbc.co.uk/news/uk-54763956 Accessed November 28, 2020

  79. White House (2020) Remarks by President Trump, Vice President Pence, and members of the coronavirus task force in press briefing. https://www.whitehouse.gov/briefings-statements/remarks-president-trump-vice-president-pence-members-coronavirus-task-force-press-briefing-6/ Accessed August 2, 2020

  80. The New York Times (2020) Remarks by President Trump at Signing of H.R.748, The CARES Act. https://www.whitehouse.gov/briefings-statements/remarks-president-trump-signing-h-r-748-cares-act/ Accessed November 27, 2020

  81. Warmbrodt Z (2020) Senate agrees to extend small business rescue in surprise move. https://www.politico.com/news/2020/06/30/senate-small-business-346412 Accessed November 27, 2020. Politico.com

  82. Zhou L (2020) The Senate failed to pass more stimulus for a struggling economy. Here’s why. https://www.vox.com/2020/9/10/21429678/senate-stimulus-vote Accessed November 30, 2020. Vox

  83. Gozzi N, Tizzani M, Starnini M, Ciulla F, Paolotti D, Panisson A, Perra N (2020) Collective response to media coverage of the COVID-19 pandemic on Reddit and Wikipedia: mixed-methods analysis. J Med Internet Res 22(10):21597

    Article  Google Scholar 

  84. Gallotti R, Valle F, Castaldo N, Sacco P, De Domenico M (2020) Assessing the risks of “infodemics” in response to COVID-19 epidemics. Nat Hum Behav. https://doi.org/10.1038/s41562-020-00994-6

    Article  Google Scholar 

  85. Cinelli M, Quattrociocchi W, Galeazzi A, Valensise CM, Brugnoli E, Schmidt AL, Zola P, Zollo F, Scala A (2020) The COVID-19 social media infodemic. Sci Rep 10(1):2352

    Article  Google Scholar 

  86. Cakmak BNB (2020) COVID-19: Europe sees hope in decline in new infections. https://www.aa.com.tr/en/europe/covid-19-europe-sees-hope-in-decline-in-new-infections/1817159 Accessed August 2, 2020. AA

  87. Crowley M, Thomas K, Haberman M (2020) Ignoring expert opinion, Trump again promotes use of hydroxychloroquine. https://www.nytimes.com/2020/04/05/us/politics/trump-hydroxychloroquine-coronavirus.html Accessed August 2, 2020. The New York Times

  88. McCarthy T, Greve JE (2020) Trump is taking hydroxychloroquine, White House confirms. https://www.theguardian.com/us-news/2020/may/19/trump-hydroxychloroquine-covid-19-white-house Accessed August 2, 2020. The Guardian

  89. Greve JE, Pengelly M (2020) Twitter limits Donald Trump Jr’s account for posting COVID-19 misinformation. https://www.theguardian.com/us-news/2020/jul/28/donald-trump-jr-twitter-restricted-hydroxychloroquine Accessed November 28, 2020. The Guardian

  90. BBC (2020) Coronavirus: confirmed global cases pass one million. https://www.bbc.co.uk/news/world-52144390 Accessed August 2, 2020

  91. Arun C (2019) On Whatsapp, rumours, and lynchings. Econ Polit Wkly 54(6):30–35

    Google Scholar 

  92. (2020) Onion.live: DarkBay. https://onion.live/site/darkbay Accessed via Tor browser August 2, 2020

  93. (2020) DNStats: DarkBay. https://dnstats.net/site/darkbay Accessed August 2, 2020

  94. DNStats (2020) Comparison uptime dark markets. https://web.archive.org/web/20200807144202/https://dnstats.net/markets/1 Accessed August 7, 2020

  95. Miller S, El-Bahrawy A, Dittus M, Graham M, Wright J (2020) Predicting drug demand with Wikipedia views: evidence from darknet markets. In: Proceedings of the web conference 2020, pp 2669–2675

    Chapter  Google Scholar 

  96. Bancroft A (2019) The darknet and smarter crime: methods for investigating criminal entrepreneurs and the illicit drug economy. Springer, Cham

    Google Scholar 

  97. Bracci A, Nadini M, Teytelboym A, Gallo A, Baronchelli A (2020) We monitor the effects of COVID-19 on illicit online trade by analysing dozens of dark web marketplaces. https://darkmarkets.live/ Accessed November 28, 2020

  98. European Monitoring Centre for Drugs and Drug Addiction (EMCDDA) (2020) EMCDDA special report: COVID-19 and drugs – drug supply via darknet markets. https://www.emcdda.europa.eu/publications/ad-hoc/covid-19-and-drugs-drug-supply-via-darknet-markets_en Accessed August 2, 2020

  99. (2018) Duckling open-source library. https://github.com/facebook/duckling Accessed August 2, 2020

  100. (2020) Cryptocompare API. https://min-api.cryptocompare.com/ Accessed August 2, 2020

  101. Väin M (2019) Foreign exchange rates API with currency conversion. https://exchangeratesapi.io Accessed August 2, 2020

Download references

Acknowledgements

Not applicable.

Funding

A.Br., M.N., A.T., A.G and A.Ba. were supported by ESRC as part of UK Research and Innovation’s rapid response to COVID-19, through grant ES/V00400X/1. M.A and D.M., acknowledge support from the U.S. National Science Foundation grants 1717062 and 2039693.

Author information

Authors and Affiliations

Authors

Contributions

ABa, AT and AG conceived of the project. ABa coordinated the project. All authors designed the research. MA and IG provided the data. ABr, MN, MA and IG preprocessed and analysed the data. All authors analysed the results and wrote the manuscript. All authors approved the final version of the manuscript.

Corresponding author

Correspondence to Andrea Baronchelli.

Ethics declarations

Competing interests

The authors declare that they have no competing interests.

Appendices

Appendix A: Data pre-processing

In the following, we describe the DWMs dataset in more details, by focusing on how listings were stored and how we formed the COVID-19 categories in Table 1, that is, PPE, medicines, guides on scamming, web domains, medical frauds, tests, fake medical records, ventilators, and COVID-19 mentions.

The listings appearing on the DWMs were crawled and stored according to selected attributes. While a brief explanation of these attributes is already presented in Table 4, here we focus on those attributes which involved some pre-processing before the analysis, that is, “Shipping information,” “Quantity,” and “Price.” The “Shipping information” attribute was initially stored considering what the vendor declared. Then, it was standardised among vendors to correct any misspellings, using the standard python library pycountry. Vendors may declare a specific country, like United States, a continent, like Europe, or the entire world, which we standardise here as worldwide. The “Quantity” attribute was instead retrieved from the title of the listing using Facebook open-source library Duckling [99], then it was manually checked and corrected during an annotation process. The “Price” attribute on DWMs was displayed in the listings in various currencies, such as cryptocurrencies and fiat currencies. In order to standardise and properly compare listing prices, we converted prices to USD at the daily conversion rate. Rates were taken from Cryptocompare [100] for cryptocurrencies, and from the European Central Bank [101] for fiat currencies.

Table 4 Selected attributes of the listings under consideration along with a brief explanation of their respective purposes

The attributes “Listing body” and “Listing title” in Table 4, representing the title and description of the listings, were used to select the COVID-19 categories in Table 1. To this end, we prepared two sets of keywords as shown in Table 5. Every selected COVID-19 listing contained either a word in the “Listing body” that matched one keyword in the first set or a word in the “Listing title” that matched one keyword in the second set. The rationale behind this choice was that the listing title was usually more precise on the product sold, whereas the body might contain promotions of other items the vendor was selling in other listings. At the same time, the vendor might mention COVID-19 in the body for various reasons, which we analysed in the main text. In order to classify listings in either COVID-19 specific listings (that is, PPE, medicines, guides on scamming, web domains, medical frauds, tests, fake medical records, ventilators) or COVID-19 mentions, we ran a regex query in google bigquery. We remark that the chosen method returned words containing a string equal to one of our keywords. For instance, with the keyword chloroquin, we detected also chloroquine and hydroxychloroquine. After this automatic filtering step, we manually checked the selected COVID-19 related listings to further improve the accuracy of our sample. In order to minimize human error, at least two authors of the present manuscript checked each of these listings. A limitation of our approach was that keywords considered were in English. Therefore, even if drug names such as chloroquine were common to many languages and we detected some listings in a non-English language, our sample of COVID-19 related listings was biased toward the English language.

Table 5 Keywords used to sample COVID-19 specific listings from the DWMs in Table 2

While each listing had an associated url to determine its uniqueness, which allowed us to track listing over time, vendors receiving bad reviews sometimes put identical copies of the same listing online. To overcome this issue and correctly count the number of listings, we determined a listing as unique if it had the combination of “Listing body,” “Listing title,” “Marketplace name,” and “Vendor” different than any other listings. For instance, if two listings had the same title and body but were sold in two different DWMs, we considered them as two different listings. Also, we considered at most one observation for each unique listing per day. The total number of unique listings and observations of these listings in each DWM is available in Table 2.

Appendix B: Examples of listings related with COVID-19 in dark web marketplaces

Here, we present detailed examples of the selected listings. We consider both COVID-19 specific listings and COVID-19 mentions.

2.1 B.1 COVID-19 specific listings

The most popular category of COVID-19 specific listings was PPE, which included mainly face masks. We detected listings selling small quantities of masks, like “KN95 Face Mask for Corona Virus box of 50” priced at 50 USD, while others proposed wholesale deals, as in “AFFORDABLE 20 BOXS OF SURGICAL FACE MASK (WHOLESALE PRICE)” in which 5000 masks were available at 2000 USD.

The second most popular COVID-19 category was guides on scamming and includes listings explaining how to stole several kinds of COVID-19 related relief funds. Specifically, a subset of these listings were about the Small Business Administration loan in the USA. They provided step-by-step instructions, with constant updates to ensure the scam activities were effective. One listing in particular suggested: “I do not recommend taking more than 10,000 of the approved amount, because after that cashing out becomes a little harder.” The price of this listing was 113 USD.

MagBo was the only DWM selling listings in the web domains category. These listings may cause a potential threat to public health. They may be the actor of several phishing activities or sell scams. Examples of these web domains were “coronavintheworld.com,” “covid-conspiracy.net,” and “coronavirusmasks.in.” Prices of these domains were low and less than 10 USD.

Listings on the medicines category were composed mostly by chloroquine, hydroxychloroquine, and azythromicin. We registered several wholesale deals, as in “9000 tabs hydroxychloroquine 200mg (USA AND CANADA ONLY)” where 9000 tabs were sold for 1194 USD. The smallest quantity we detected was 50 pills “chloroquine 50pills for 250$,” sold at 250 USD. We also noticed that vendors often specified the size of the pill, being it 200 mg, 250 mg, or 50 mg. The azythromicin was usually sold together with hydroxychloroquine as a prescription against COVID-19. One example of it was “hydroxychloroquine sulfate 200mg and azithromycin 250mg,” where an unknown quantity of these drugs was sold for 40 USD.

In the COVID-19 category of medical frauds, the most prominent listings were vaccines. Despite at the moment of writing of the first version of this manuscript (July 2020), vaccines are far from being actually developed, they were sold in DWMs since March. These listings included both low price vaccines like “complete order free shipment COVID19 VACCINE,” sold at just 200 USD, or high price one like “Covid-19 Vaccine. Lets keep it low key for now,” priced at \(15\mbox{,}000\) USD. In addition, among the listings in the medical frauds category, one could find potentially dangerous illicit drug mixes with claimed curative power against COVID-19, like “Protect yourself from the corona virus:” a marijuana based drug mix supposedly helpful in recovery from coronavirus infection. Other medical frauds included a 300 USD “CORONAVIRUS DETECtOR DEVICE, SAVE LIVES NOW” or a 1000 USD “Buy CORONAVIRUS THERMO METER.”

Tests category of COVID-19 specific listings count a few different items. We detected listings in the tests category both at low quantities, such as, “25 pcs COVID-19 (coronavirus) quick test,” sold for 430 USD, or at very large one, like “Corona Virus Test / Covid-19 Test Kits (5000Pcs),” for a price of 7500 USD.

The three listings in the fake medical records categories can be used to fake COVID-19 diagnosis. One of these listings said in its title: “Novelty/Fake Medical Records! Any diagnosis, custom made.” And in its body claimed “The right medical excuse can get you out of anything, and open many doors,” with a following disclaimer “IT IS UP TO YOU TO USE THESE ETHICALLY AND LEGALLY!” The price for this listing was 20 USD only, which could favour its wide adoption.

The two listings in the ventilator category were ICU ventilators. They were advertising fundamental hospital instrument, such as, “ICU Respiratory Ventilators, Emergency Room Vents” sold at 800 USD or “BiPAP oxygen concentrator ventilato Amid Covid-19” for 2000 USD.

2.2 B.2 COVID-19 mentions

We describe three examples of listings in the COVID-19 mentions category. The listing with title “Best Organic Virginia Bright Tobacco Premium quality 600g” refers to the lockdown in its body as “unfortunately we have to respect coronavirus lockdowns, in order to ensure as much security as possible, we had to choose one type of shiping that is unfortunately much more expensive while lockdowns last.” Another listing with title “(Out of Stock! Lower Price for Pre-orders Only) Testosterone Enanthate 250mg/ml - 10ml - Buy 4 Get 1,” mentions in the body that they “are currently out of stock of this product due to our oil suppliers not being able to get their raw powders shipped to them because of the Coronavirus” and they “have lowered the price a little to help make up for this delay.” A third listing mention a sale directly in the title “COVID-19 SPECIAL OFFER 1GR CROWN BOLIVIAN COCAINE 90% £65,” and link the discount with the distress caused by the pandemic.

Appendix C: Timeline of the COVID-19 pandemic

In this Section we aim at providing a summary of the main events related to the pandemic, focusing on the ones cited in the main text and listed in Table 6. This is by no means a complete summary of the COVID-19 pandemic timeline.

Table 6 Significant COVID-19 events. We defined an acronym for each event and reported it in the main text plots. Please note that this list does not intend to be exhaustive or to establish a ranking between events

The first event to gain international attention and make the public aware of the coronavirus was the decision from China to lockdown the city of Wuhan, first epicenter of the pandemic, on January 23, 2020 [1]. The virus then found its way to Europe, where the first country to be heavily hit by the pandemic was Italy. The Italian government decided to lockdown the entire country on March 9, 2020 [74]. The virus rapidly spread in Europe and internationally, with cases appearing more and more in the United States, leading USA’s President Donald Trump to first take a stance on the possibility of using chloroquine to cure individuals infected from COVID on the March 18, 2020 [79]. The epidemic started to heavily hit the United States and cases were surging almost everywhere in the world: 70 days after the lockdown of Wuhan, the worldwide count of infections had already surpassed 1 Million cases on April 3, 2020 [90]. On March 27, President Trump signed the Cares Act with the first economic aids to whose affected by COVID-19 [80]. After that, he explicitly promoted the use of hydroxychloroquine on April 5, 2020, before any official medical trial ended [87]. In April the situation started to become asymmetric. In Europe, thanks to the many policies in place, the COVID-19 became less threatening [86] and lockdowns started to be eased [76]. USA and other countries were instead seeing a rise in cases, and the USA Senate prolonged the small business rescue fund [81].

In May, President Trump declared he was now taking Hydroxychloroquine preventively against COVID-19 [88], while in July, he posted a video (labet banned by Twitter) diffusing misinformation about the medicine [89]. The second wave of contagions hit Spain in September, and few weeks later the entire Europe [77], while The USA saw the failing on the negotiations around a second relief package [82]. Several new lockdown measures have took place in November in Europe [78] and, through that month, the number of COVID-19 related new infections has started to reduce. In the meantime, the USA is continuing to register a high number of new contagions.

Appendix D: Supplementary material

In this Section we provide additional material that support our main findings. In Table 7 we provide more details on the 30 DWMs considered in our study. In particular we indicate the main specialization of the DWMs, i.e., the main category of products sold. If it is “Mixed”, it means that the DWM is not specialised in any particular category of goods. In the description we instead put information on the DWMs, with more details where available. All this information has been researched and compiled by the authors, with particular help given by Flashpoint Intelligence [72].

Table 7 List of all DWMs, together with their specialization and a brief description

In Table 8 we provide a Table reporting the different COVID-19 related medicines which were found in the listings. The medicines were selected as they have been found or claimed to be effective against COVID-19 [32]. The number of listings related to each medicine is also reported, noting that some listings sell more than one medicine (e.g. listings selling both hydroxychloroquine and azitrhomycin). We do the same for guides on scamming in Table 9, reporting the different kinds of guides which were found in the listings.

Table 8 COVID-19 related medicines appearing in the listings, together with a brief description and the number of listings related to that drug
Table 9 COVID-19 related guides on scamming appearing in the listings, together with a brief description and the number of listings related to that sub-category

In Fig. 7 we plot the distribution of listings per vendor in log-log plot, showing a clear power-law shape with exponent −2.0. In the inset of Fig. 7, we show the histogram using linear spacing, through which we understand that most vendors sold very few COVID-19 specific listings, while few vendors going as high as 91 different listings. We noted that 80% of the vendors had indeed less or equal than 5 listings.

Figure 7
figure 7

Probability distribution function (Pdf) for the number of listings per vendor. The power law fit results in an exponent of −2.3. In inset, the histogram of the number of listings per vendor, with a vertical line showing the 80th percentile

In the main text, we performed a longitudinal analysis of the time evolution of all COVID-19 specific listings and all listings mentioning COVID-19, as well as the PPE and medicines categories, as shown in Fig. 4. Now, we provide a similar analysis for COVID-19 guides on scamming, as illustrated in Fig. 8. We observe they first appeared in March, when the first lockdown measures were adopted. The number of listings then started increasing after the Cares act was introduced in USA [80]. Other peaks coincide to the extension of the SBA loan program in July [81] and to the failing of negotiations on the Heroes act [82], after which the number of listings decreased up to April levels. Listings in the guides on scamming category teach people how to take advantage of several kinds of COVID-19 relief funds, or other pandemic related scam opportunities. In many western countries, new relief funds were signed on a monthly basis constant updates made on the relative listings on DWMs.

Figure 8
figure 8

Time evolution of the active COVID-19 specific listings in the guides on scamming category. (a) Seven-days rolling average of these observed listings at a given time. Black dashed vertical lines corresponded to significant COVID-19 world events, see Appendix C. (b) Seven-days median price with 95% confidence interval for these observed listings

In order to complement Fig. 5(a) and (b) in the main text and properly show the peaks of Wikipedia page visits and tweets, we create Fig. 9. The new representation of Fig. 5 does not modify the claims made in the main text and how major event related with COVID-19 impacted public attention.

Figure 9
figure 9

Wikipedia page visits for pages relative to (aPPE, (b) hydroxychloroquine, chloroquine and azitrhomycin. Number of tweets mentioning (cPPE, (d) hydroxychloroquine, chloroquine and azitrhomycin. Panels (a) and (b) corresponds to Fig. 5(a) in the main text, while panels (c) and (d) to Fig. 5(b). The main difference between these panels and Fig. 5(a) and (b) is the linear scale on y axis

Rights and permissions

Open Access This article is licensed under a Creative Commons Attribution 4.0 International License, which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons licence, and indicate if changes were made. The images or other third party material in this article are included in the article’s Creative Commons licence, unless indicated otherwise in a credit line to the material. If material is not included in the article’s Creative Commons licence and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder. To view a copy of this licence, visit http://creativecommons.org/licenses/by/4.0/.

Reprints and permissions

About this article

Check for updates. Verify currency and authenticity via CrossMark

Cite this article

Bracci, A., Nadini, M., Aliapoulios, M. et al. Dark Web Marketplaces and COVID-19: before the vaccine. EPJ Data Sci. 10, 6 (2021). https://doi.org/10.1140/epjds/s13688-021-00259-w

Download citation

  • Received:

  • Accepted:

  • Published:

  • DOI: https://doi.org/10.1140/epjds/s13688-021-00259-w

Keywords