2021-shah.pdf: “Classifying Illegal Advertisements on the Darknet Using NLP”, (2021-05-25; ):
The Darknet has become a place to conduct various illegal activities like child labor, contract murder, drug selling while staying anonymous. Traditionally, international and government agencies try to control these activities, but most of those actions are manual and time-consuming. Recently, various researchers developed Machine Learning (ML) approaches trying to aid in the process of detecting illegal activities.
The above problem can benefit by using different Natural Language Processing (NLP) techniques. More specifically, researchers have used various classical topic modeling techniques like bag of words, N-grams, Term Frequency, Term Frequency Inverse Document Frequency (TF-IDF) to represent features and train machine learning models. Moreover, researchers have used an imbalanced dataset to perform those experiments.
The primary problem of this project is to classify illegal advertisements published on the Darknet by exploring the above-mentioned state of the art and comparing them against known approaches that use classical techniques, like TF-IDF. Also, we use various data balancing techniques and perform experiments using that data on classical techniques like TF-IDF.
2021-artner.pdf: “Shocks to production risk and supply responses: Evidence from darknet data”, (2021-04-05; ):
Darknet markets for illicit goods face law enforcement and public health researchers with new challenges and give economists a unique opportunity to study production under uncertainty. While current cryptomarket research focuses on the effects of police intervention on market participants, this thesis extends the literature by exploring the effects of Bitcoin price volatility, which is the main currency used on cryptomarkets.
Using scraped data from the largest cryptomarkets between 2014 and 2015, I exploit an event study design to causally estimate dynamic paths of shocks to these 2 types of production risk. Within a month, high levels of police intervention and Bitcoin volatility s statistically-significant decrease the expected probability of market entry by 4.3% and 6.4%. While established vendors only show weak reactions to impulses in terms of drug supply, they pass on the added risk to buyers in the form of a short-term risk premium of around 4.8% (8.7%) in the case of an arrest (volatility) shock.
To my knowledge, this is the first study to establish a causal link between Bitcoin volatility and market outcomes on cryptomarkets, showing that criminals see police intervention as one of several production risks that vendors respond to with higher prices rather than lower supply.
2021-broadhurst.pdf: “Impact of darknet market seizures on opioid availability”, (2021-02-01; ):
Opioids, including the highly potent synthetic opioids fentanyl and carfentanil, are commonly sold on illicit cryptomarkets or Tor darknet markets. Data collected throughout 2019 from 12 large darknet markets that sold opioids enabled observation of the impact of law enforcement seizures and voluntary or scam market closures on the availability of fentanyl and other opioids.
Trends in opioid and fentanyl availability before and after law enforcement interventions indicate whether market operators and sellers are deterred and whether market closures lead to displacement, dispersal or substitution. Evidence of all of these outcomes was present in both descriptive and trend analyses, although most effects were short lived. Market closures, especially law enforcement seizures, reduced the availability of opioids, in particular fentanyl, as well as increasing prices and displacing vendors to other markets. Market closures also led vendors to substitute fentanyl for other opioids or other illicit drugs.
Opioids, including the highly potent synthetic opioid fentanyl and carfentanil, which has the potential to be used as a chemical weapon, are commonly sold on illicit cryptomarkets or Tor darknet markets. This report investigates the impact of darknet market closures (voluntary or exit scams) and law enforcement market seizures on the availability of fentanyl and other opioids. Quantitative methods were used to investigate the presence of potential effects of closures and seizures. We analysed these effects across four dimensions: opioid availability (as measured by unique listings), vendor or trader movement and cross-market activity, market stock value and variations in the prices of opioid products. A unique product listings time series was constructed, and the time series was then split into several sub-intervals based on the timing of market closures.
Data were collected over 352 days, from 2 January to 20 December 2019 (excluding weekends), combining 251 scrapes from initially eight darknet markets: Apollon, Empire, Dream, Nightmare, Tochka (also known as Point), Berlusconi, Valhalla (also called Silkitie), and Wall Street. In April three ‘new’ markets (Agartha, Dream Alt and Samsara) were added after Wall Street and Valhalla were seized by law enforcement and Dream voluntarily closed. In July Cryptonia was added as a substitute for Nightmare, which closed in an exit scam (where a business stops sending orders but continues to accept payment for new orders). Cryptonia operated until a planned (voluntary) closure in November
Darknet markets have presented unique problems to law enforcement agencies (LEAs) since the inception of Farmer’s Market in 2006, and its subsequent move to the Tor hidden service in 2010. In 2011 Silk Road 1.0 emerged as a substantial innovation, combining then relatively novel cryptocurrencies with the anonymity of Tor, before it was seized and its operators arrested in 2013. The Silk Road model proved enduring and darknet markets continued to evolve. Accordingly, LEA operational techniques continue to adapt to the criminal use of the Tor platform and, as with cybercrime in general, transnational policing methods have become essential.
In early 2019, a transnational law enforcement task force of US and European LEAs, the Joint Criminal Opioid and Darknet Enforcement (J-CODE) team, focused on the darknet trade in fentanyl. J-CODE’s Operation SaboTor targeted Wall Street, a darknet market that was then among the most active in selling fentanyl and its derivatives. Under Operation SaboTor, Finnish Customs (with French National Police and Europol) seized Valhalla in February 2019, and then in April the German Federal Criminal Police (Bundeskriminalamt) arrested three Germans who operated Wall Street. Another 61 associated vendors or dealers, mostly located in the US and Europe, were also arrested. In May a major online gateway, DeepDotWeb, which linked buyers to darknet market URLs, was also seized by the J-CODE team. Throughout 2019, several other darknet markets also closed, either in exit scams (Nightmare in July, Tochka in November) or in voluntary closures (Dream Market in March, Cryptonia in November). In September 2019, as part of Operation Darknet, the Italian Guardia di Finanza seized Berlusconi, a market that was also active in the sale of fentanyl and other opioids.
The potential deterrence of market operators and sellers and the displacement, dispersal or product substitution that may follow such closures were explored by comparing trends in opioid and fentanyl availability before and after law enforcement interventions. Evidence of all of these outcomes was present in both descriptive and trend analyses, although effects were often short lived. Analysis also showed that market closures, especially seizures of markets by law enforcement, reduced the availability of opioids, in particular fentanyl, increased prices and displaced vendors to other markets. Market closures also led buyers to substitute fentanyl for other illicit drugs or other opioids.
Throughout 2019 a total of 2,089,694 listings, excluding duplicates, were identified, advertising a diverse range of illicit drugs and other contraband. 3% (n = 63,567) of these listings were opioids, of which ~5% (n = 3,151) were fentanyl. Among fentanyl listings, 19% (n = 606) were the extremely potent analogue carfentanil.
Over the observed period, Berlusconi offered the greatest number of unique listings, representing 36% of all listings. The items identified included illicit drugs, digital products such as malware and other contraband. Berlusconi also had the highest number of opioid listings (again at 36%) while Wall Street dominated listings of fentanyl (55%) and carfentanil (41%) until its seizure in April 2019. Tochka accounted for 21% of fentanyl and 30% of carfentanil availability until its exit scam in November of that year.
After the closure of Dream and the seizures of Valhalla and Wall Street, the April–July 2019 period saw the largest growth of opioid listings—from 5,320 at the end of April to 16,930 at the end of July. Yet this period also saw a decline in fentanyl listings: from 792 at the end of April to 531 listings by the end of July, and in December only seven listings (five of which advertised carfentanil) remained on Empire. Wall Street dominated fentanyl availability between January and April, but after its seizure Tochka took over the dominant market share until its exit scam in November. New markets also took up some market share after Tochka’s closure.
Over the observed period, 4,156 opioid vendors with unique aliases were identified. Roughly three-quarters (74%) of these vendors (n = 3,090) operated in only one market, while the remaining 26% of vendors (n = 1,066) operated across two or more markets. Almost one in five opioid vendors sold fentanyl (n = 793), with about a quarter (n = 212) of these advertising carfentanil.
This study shows the strengths and limitations of LEA operations targeting darknet markets. The results suggest that LEA operations targeting specific high-risk products (eg fentanyl) on darknet markets have a greater impact than voluntary closures or exit scams. However, there has always been an element of self-regulation in the operation of darknet markets, such as the widespread policy of banning the listing of child exploitation material. Many markets respond to LEA interventions by implementing further self-regulation of high-risk products. Potent synthetic opioids such as fentanyl and its derivatives were widely banned by many darknet markets throughout 2018 and 2019, indicating that the darknet market economy is risk sensitive and evolving.
LEA operations targeting darknet markets require a long-term effort, with success often the consequence of user error and complacency. Darknet criminal actors are aware of LEA disruption efforts and may underestimate the risks associated with policing activities such as undercover operations and the arrests of vendors and buyers. Market displacement and dispersal as a consequence of closures (voluntary or exit scams) and police operations make buyers, sellers and market operators more adaptable and risk averse.
The implications for criminal justice policy and policing practice are discussed and the probable forms of organised crime and criminal enterprise that may comprise the darknet economy are considered. Transnational and cross-agency police cooperation is crucial in the investigation and prosecution of darknet market players. Persistent surveillance and suppression will be necessary if the availability of the most dangerous synthetic opioids is to be disrupted. The darknet economy has proven to be resilient, and the large profits to be earned from fentanyl, carfentanil and other opioids ensure that these and other products will continue to be available on some darknet markets.
2020-yang.pdf: “pyDNetTopic: A Framework for Uncovering What Darknet Market Users Talking About”, (2020-12-12; ):
Although Dark Net Market (DNM) has attracted more and more researchers’ interests, we found most works focus on the markets while ignore the forums related with them. Ignoring DNM forums is undoubtedly a huge waste of informative intelligence. Previous works usually utilize LDA for darknet data mining. However, traditional topic models cannot handle the posts in forums with various lengths, which incurs unaffordable complexity or performance degradation. In this paper, an improved Bi-term Topic Model named Filtered Bi-term Model, is proposed to extract potential topics in DNM forums for balancing both overhead and performance. Experimental results prove that the topical words extracted by FBTM are more coherent than LDA and DMM. Furthermore, we proposed a general framework named pyDNetTopic for content extracting and topic modeling uncovering DNM forums automatically. The full results we apply pyDNetTopic to Agora forum demonstrate the capability of FBTM to capture informative intelligence in DNM forums as well as the practicality of pyDNetTopic.
2020-tsuchiya.pdf: “Dark web in the dark: Investigating when transactions take place on cryptomarkets”, (2020-12-11):
- Activity of the six leading dark web marketplaces is measured.
- There was a larger volume of trades on Monday, Tuesday and Wednesday nights.
- There were fewer trades on Saturdays and Sundays.
- The drug trade for retail purposes accounts for a large part of the cryptomarkets
- Operation Onymous simply displaced users and did not deter activity.
Online illicit marketplaces known as cryptomarkets have gained considerable attention from the media, government authorities, law enforcement agencies, and researchers. An increasing number of studies have investigated various aspects of these cryptomarkets’ characteristics, such as product categories, sale volumes, and the number of listings and vendors. However, there is a gap in the literature regarding whether illegal transactions (of illicit drugs) take place during the day or week. This study fills this gap by tracing Bitcoin addresses associated with the six previously leading and most active cryptomarkets—Silk Road, Silk Road 2.0, Agora, Evolution, Nucleus, and Abraxas—to identify the specific timings of these transactions. This study reveals clear patterns of activity on the marketplaces. First, transactions more often take place at night in European countries (Germany, Netherlands, the UK), the US, and Canada, where the cryptomarket drug trade is most active. Second, there are more transactions on Mondays, Tuesdays, and Wednesdays, and fewer on Saturdays and Sundays. This indicates that the retail drug trade accounts for a large part of the cryptomarkets. Further, this study examines the impact of a cryptomarket policing effort known as Operation Onymous, and indicates that this policing effort only displaced users among these marketplaces and did not deter their activity, even in the short-term. It also suggests that Operation Onymous did not alter users’ transaction patterns.
2020-zhang.pdf: “dStyle-GAN: Generative Adversarial Network based on Writing and Photography Styles for Drug Identification in Darknet Markets”, (2020-12-01; ):
Despite the persistent effort by law enforcement, illicit drug trafficking in darknet markets has shown great resilience with new markets rapidly appearing after old ones being shut down. In order to more effectively detect, disrupt and dismantle illicit drug trades, there’s an imminent need to gain a deeper understanding toward the operations and dynamics of illicit drug trading activities. To address this challenge, in this paper, we design and develop an intelligent system (named dStyle-GAN) to automate the analysis for drug identification in darknet markets, by considering both content-based and style-aware information.
To determine whether a given pair of posted drugs are the same or not, in dStyle-GAN, based on the large-scale data collected from darknet markets, we first present an attributed heterogeneous information network (AHIN) to depict drugs, vendors, texts and writing styles, photos and photography styles, and the rich relations among them; and then we propose a novel generative adversarial network (GAN) based model over AHIN to capture the underlying distribution of posted drugs’ writing and photography styles to learn robust representations of drugs for their identifications. Unlike existing approaches, our proposed GAN-based model jointly considers the heterogeneity of network and relatedness over drugs formulated by domain-specific meta-paths for robust node (i.e., drug) representation learning. To the best of our knowledge, the proposed dStyle-GAN represents the first principled GAN-based solution over graphs to simultaneously consider writing and photography styles as well as their latent distributions for node representation learning.
Extensive experimental results based on large-scale datasets collected from 6 darknet markets and the obtained ground-truth demonstrate that dStyle-GAN outperforms the state-of-the-art methods. Based on the identified drug pairs in the wild by dStyle-GAN, we perform further analysis to gain deeper insights into the dynamics and evolution of illicit drug trading activities in darknet markets, whose findings may facilitate law enforcement for proactive interventions.
2020-hiramoto.pdf: “Measuring dark web marketplaces via Bitcoin transactions: From birth to independence”, (2020-12-01):
- Activity of the seven leading dark web marketplaces is measured.
- Transactions of Bitcoin is investigated.
- Internal Bitcoin transactions within each marketplace have a common characteristic.
- Dark web marketplaces continue to thrive despite of international policing effort.
This study measures the evolution of the anonymous marketplaces Silk Road, Silk Road 2.0, Agora, Evolution, Nucleus, Abraxas, and AlphaBay, which were the seven leading and most active dark web marketplaces. We identify that all the seven marketplaces use the same software to manage Bitcoin by investigating transactions in these marketplaces. However, the software was no longer used since May 2016 because of its vulnerability to protect anonymity. It indicates that dark web marketplaces advanced to the next stage with anonymity-enhancing tools around in March 2016. Using simple heuristics to identify and trace Bitcoin addresses associated with these marketplaces, purchases on these marketplaces are identified and evaluated. Our method provides evidence on market size, development, and fluctuation over time to fill a gap in previous studies. Dark web marketplaces continue to thrive because users migrate to new marketplaces after the existing ones are shut down. The total sales volume on Silk Road was 192.7 million US dollars between June 2012 and October 2013. The corresponding figures for Silk Road 2.0, Agora, Evolution, Nucleus, and Abraxas were 112.9, 220.7, 69.7, 88.3, and 35.6 million US dollars, respectively. The figures for AlphaBay was 166.0 million US dollars between December 2014 and February 2016.
2020-sutanrikulu.pdf: “Analysis of Darknet Market Activity as a Country-Specific, Socio-Economic and Technological Phenomenon”, (2020-11-16; ):
The technological peculiarities of the Darknet as well as the availability of illicit items on the embedded market-places have raised heated debates in the media and keen interest by law enforcement and academics. In prior work, researchers have already investigated the infrastructure of Darknet platforms and the global distribution of Darknet market activity.
In our work, we take a broader perspective by studying the Darknet as a regional, socio-economic and technological phenomenon. Our starting assumption is that there exist cross-country indicators that are related to Darknet market activity. We identify relevant indicators, and discuss their relationship to cybercrime from a theoretical perspective. We apply regression modelling and conduct a qualitative comparative analysis (QCA) to study the impact of the identified indicators on the number of items offered on the Darknet. We find that GDP per capita, the number of Bitcoin downloads per capita, the number of Tor relay users per capita and an education index correlate with market activity on Darknet platforms.
2020-norbutas.pdf: “Believe it when you see it: Dyadic embeddedness and reputation effects on trust in cryptomarkets for illegal drugs”, (2020-10-01; ):
- Exchange patterns between users of an illegal drug cryptomarket are analyzed.
- Buyers repeatedly exchange with a trusted seller (high dyadic embeddedness).
- For new ties, sellers’ market reputation matters less than dyadic embeddedness.
- Unsatisfied drug buyers tend to leave the market rather than form ties with new sellers.
Abstract: Large-scale online marketplace data have been repeatedly used to test sociological theories on trust between strangers. Most studies focus on sellers’ aggregate reputation scores, rather than on buyers’ individual decisions to trust. Theoretical predictions on how repeated exchanges affect trust within dyads and how buyers weigh individual experience against reputation feedback from other actors have not been tested directly in detail. What do buyers do when they are warned not to trust someone they have trusted many times before? We analyze reputation effects on trust at the dyadic and network levels using data from an illegal online drug marketplace [Abraxas]. We find that buyers’ trust decisions are primarily explained by dyadic embeddedness—cooperative sellers get awarded by repeated exchanges. Although buyers take third-party information into account, this effect is weaker and more important for first-time buyers. Buyers tend to choose market exit instead of retaliation against sellers after negative experiences.
[Keywords: Trust, Reputation, Cryptomarkets, Economic sociology]
2020-holt.pdf: “A Crime Script Analysis of Counterfeit Identity Document Procurement Online”, (2020-10-01; ):
Over the last two decades, researchers explored various aspects of the operational practices of online illicit market operations through the Open and Dark Web for various physical and digital goods. Far less work has considered the presence of counterfeit identity documents for sale within these markets, or the process of advertising, purchasing, producing, selling, and delivering these materials.
This study utilized a qualitative crime script analysis of 19 vendors advertising counterfeit documents on the Open and Dark Web, focusing on the advertising, actualization, and delivery of various products. The pricing for various document types and the locations they claim to reflect citizenship of were examined, along with the variations dependent on where the product was advertised.
The findings demonstrated that the market for identity documents shared common practices to other online markets, highlighting the value of crime script analyses to understand the distribution of goods through illicit markets generally.
2020-cork.pdf: “Using computational techniques to study social influence online”, (2020-09-30; ):
The social identity approach suggests that group prototypical individuals have greater influence over fellow group members. This effect has been well-studied offline. Here, we use a novel method of assessing prototypicality in naturally occurring data to test whether this effect can be replicated in online communities. In Study 1a (n = 53,049 Reddit users), we train a linguistic measure of prototypicality for two social groups: libertarians and entrepreneurs. We then validate this measure further to ensure it is not driven by demographics (Study 1b: n = 882) or local accommodation (Study 1c: n = 1,684 Silk Road users). In Study 2 (n = 8,259), we correlate this measure of prototypicality with social network indicators of social influence. In line with the social identity approach, individuals who are more prototypical generate more responses from others. Implications for testing sociopsychological theories with naturally occurring data using computational approaches are discussed.
[Keywords: computational social science, identity prototype, machine learning, online social influence, social identity theory]
2020-lamy.pdf: “Listed for sale: Analyzing data on fentanyl, fentanyl analogs and other novel synthetic opioids on one cryptomarket”, (2020-08-01; ):
- 33 Novel Synthetic Opioids identified on Dream Market from 03/
2018 to 01/ 2019.
- Novel Synthetic Opioids represented 3.3% of all opioid listings advertised.
- On average 2.8 kilograms of fentanyl and fentanyl analogs were proposed at each crawl.
- High availability of Novel Synthetic Opioids from within and to the US.
Background: The United States is facing a “triple wave” epidemic fueled by novel synthetic opioids. Cryptomarkets, anonymous marketplaces located on the deep web, play an increasingly important role in the distribution of illicit substances. This article presents the data collected and processed by the eDarkTrends platform concerning the availability trends of novel synthetic opioids listed on one cryptomarket.
Methods: Listings from the Dream Market cryptomarket “Opioids” and “Research Chemicals” sections were collected between March 2018 and January 2019. Collected data were processed using eDarkTrends Named Entity Recognition algorithm to identify opioid drugs, and to analyze their availability trends in terms of frequency of listings, available average weights, average prices, and geographic indicators of shipment origin and destination information.
Results: 95,011 opioid-related listings were collected through 26 crawling sessions. 33 novel synthetic opioids were identified in 3.3% of the collected listings. 44.7% of these listings advertised fentanyl (pharmaceutical and non-pharmaceutical) or fentanyl analogs for an average of 2.8 kilograms per crawl. “Synthetic heroin” accounted for 33.2% of novel synthetic opioid listings for an average 1.1 kilograms per crawl with 97.7% of listings advertised as shipped from Canada. Other novel synthetic opioids (e.g., U-47,700, AP-237) represented 2% of these listings for an average of 6.1 kilograms per crawl with 97.2% of listings advertised as shipped from China.
Conclusions: Our data indicate consistent availability of a wide variety of novel synthetic opioids both in retail and wholesale-level amounts. Identification of new substances highlights the value of cryptomarket data for early warning systems of emerging substance use trends.
[Keywords: cryptomarkets, darknet markets, fentanyl, fentanyl analogs, synthetic opioids]
- 33 Novel Synthetic Opioids identified on Dream Market from 03/
2020-munksgaard.pdf: “Distributing tobacco in the dark: assessing the regional structure and shipping patterns of illicit tobacco in cryptomarkets”, (2020-07-31):
The size of the global market for illicit tobacco products is estimated to be between USD$8.6 and USD$11.6 billion yearly. In addition to an estimated cost of USD$40.5 billion in lost tax revenue the illicit tobacco market further increases the accessibility of a harmful substance for minors and provides a revenue stream for both organised crime and violent political groups. In this paper, we examine how tobacco products are distributed globally through illicit online platform economies known as cryptomarkets. Using data from the cryptomarket Empire, we find tobacco products remain a small niche market exclusively shipping from the EU and that shipping patterns suggest the emergence of new supply routes for end-consumers within Western Europe originating from the UK. We find that the market for tobacco on cryptomarkets remains minimal, as in previous research, compared to the market for drugs.
[Keywords: Darkweb, cryptomarkets, tobacco, illicit markets]
2020-barratt.pdf: “No magic pocket_ Buying and selling on drug cryptomarkets in response to the COVID-19 pandemic and social restrictions”, Monica J. Barratt, Judith Aldridge
2020-bergeron.pdf: “Preliminary findings of the impact of COVID-19 on drugs crypto markets”, Andréanne Bergeron, David Décary-Hétu, Luca Giommoni
2020-zaunseder.pdf: “Pricing of illicit drugs on darknet markets: a conceptual exploration”, (2020-07-13; ):
Purpose: Trading illicit drugs on cryptomarkets differs in many ways from material retail markets. This paper aims to contribute to existing studies on pricing by studying the relationship between price changes in relation to changes in nominal value of the cryptocurrency. To this, the authors qualitatively study product descriptions and images to expand the knowledge on price formation.
methodology/: The authors analysed 15 samples based on visual and textual scrapes from two major drug markets—for Dream Market between January 2014 and July 2015 and for Tochka between January 2015 and July 2015. This longitudinal study relates changes in process to variations in the Bitcoin exchange rate and selling strategies. The analysis of the marketing of drugs online also addressed the development of the vendor profile and product offers. approach
Findings: Product prices change in relation to variations in the Bitcoin exchange rate. This points to the application of mechanisms for automatic price adaptations on the market level. Real prices of the drug offers constantly increase. The authors assert that there is a bidirectional relationship. Vendors structure price and discounts to encourage feedback. And feedback in combination with signals of commitment and authenticity inform pricing. Product descriptions are an important feature in the successful marketization of goods, whereas product images are predominantly used as an aspect of recognisability and feature of the vendor’s identity.
implications: Findings suggest that there is great potential for further qualitative research into the relationship between the online and offline identity of drug vendors, as well as price setting when entering the market and subsequent changes for offered products.
Practical implications: Findings also suggest that further investigation into the constitution and management of vendor’s identity on the cryptomarkets would allow a better understanding of vendors and their interactions on cryptomarkets.
Social implications: A better understanding of drug trading on cryptomarkets helps to more effectively address potentials for harm in the online drug trade. Also targeting crime would benefit from a better understanding of vendor identities and pricing.
value: The findings represent a valuable contribution to existing knowledge on drug trading on cryptomarkets, particularly in view of pricing and vending strategies.
2020-arce.pdf: “Differences in Cocaine Quality Sourced from Cryptomarkets and Traditional Drug Markets”, (2020-07-01; ):
Cryptomarkets tap into the very large and profitable market of illegal drugs, estimated to be in the billions of EUR. Some of the hazards (and societal costs) of illegal drug consumption are derived from the lack of quality control of these substances (adulteration and purity imbalances).
This study analyzes the effect of cryptomarkets in the quality of cocaine, comparing worldwide results of analyzed samples sourced from cryptomarkets versus traditional markets. Our findings show that cryptomarkets do not offer a substantially higher quality of cocaine with respect to traditional drug markets and we observe a lack of correlation between price per gram and quality. For both cryptomarkets and traditional markets, the geographical factor was the decisive factor in quality of cocaine.
We also show the inter and intra-country cocaine trade in cryptomarkets and we analyze and quantify the effect of the harm reduction possibilities enabled by cryptomarkets, showing that making an informed purchase has clear benefits in expected drug quality.
2020-shan.pdf: “Behavioral Profiling of Darknet Marketplace Vendors”, (2020-06-12; ):
The usage and number of darknet users has increased rapidly in recent years. A key reason is that the darknet allows users to be fully anonymous when browsing on the darknet. Though such privacy is needed for some users, others decide to abuse the darknet by selling or buying illicit goods off the darknet marketplace without being arrested or punished. Despite the hidden nature of darknet marketplaces, they oftentimes shut down due to reasons such as law enforcement activities or exit scams. As a result, the average life span of a darknet marketplace tends to be around 8 months. This leads to an important question: If a vendor has built up a good reputation before a darknet was shutdown, does that mean he will start over again from scratch? Not likely. A vendor would most likely use their username as a brand, in order to be recognizable on a different darknet marketplace when others shut down.
This thesis states and explores the hypothesis: Accounts that belong to the same individual are likely to have similar usernames, which are being used as a “brand” by the vendor. To verify this hypothesis, we first devise a method to correlate the accounts in a darknet marketplace data set using their PGP keys, thus linking multiple accounts to a single user. We then devise a method for determining username similarity, and check if the correlated accounts have a username similarity above a certain threshold. These experiments are done both internally within the datasets for the Evolution marketplace and the Silk Road 2 marketplace, and also between the two datasets.
From the experiments, 4 behaviors were identified and they were used to verify and strengthen the hypothesis. Most importantly, we find that two accounts that belong to the same user are likely to have similar usernames if the accounts belong to different marketplaces, but not if the accounts belong to the same marketplace. We thus conclude a modified version of our initial hypothesis: Accounts that belong to the same individual, but are on different marketplaces, are likely to have similar usernames, which are being used as a “Brand” by the vendor.
2020-jeziorowski-2.pdf: “Dark Vendor Profiling”, (2020-05-01; ):
Tor hidden services and anonymity tools alike provide an avenue for cyber criminals to conduct illegal activities online without fear of consequences. In particular, dark marketplaces are hidden services that enable the trade of paraphernalia such as drugs, weapons, malware, counterfeit identities, and pornography among other items of criminal nature.
Several effective Dark Web analysis techniques have been proposed for Dark Web Forums and primarily focus on authorship analysis where the goal is one of two tasks: (a) user attribution, where a user is profiled and identified given an artifact they own, and (b) alias attribution, where pairs of users are identified to belong to the same individual. While these techniques may support dark web investigations and help to identify and locate perpetrators, existing automated techniques are predominately forum-based and stylometry-based, leaving non-textual artifacts, such as images, out of consideration due to the illicit nature of dark marketplace listings. Thus, new methodologies for adequate evidence collection and image handling in dark marketplaces are essential.
In this thesis, stylometric, image, and attribute-based artifacts are collected from 25 dark marketplaces and machine learning based Dark Vendor Profiling methodologies are proposed to achieve dark vendor attribution and alias attribution across dark marketplaces, thereby supporting investigative efforts in deanonymizing cyber criminals acting on the anonymous web.
Namely, we first propose the collection of image hashes in place of image content to reduce the storage demands of our proposed technique and reduce the risk of obtaining illicit digital material during data collection. Second, we design two unique feature sets for authorship analysis tasks that are extracted per listing and per vendor. Third, we propose a novel application of the Random Forest machine learning technique for the task of vendor attribution in dark marketplaces, achieving over 90% accuracy in distinguishing between over 2,500 unique dark vendors from various marketplaces. Lastly, we propose a novel application of the Record Linkage technique for the task of alias attribution and obtain imperative preliminary observations from Support Vector Machine and Logistic Regression based models that can assist in the design of future alias attribution models.
Therefore, this thesis presents a detailed description of these contributions along with an evaluation of our proposed Dark Vendor Profiling system and several future research directions.
2020-arabnezhad.pdf: “A Light in the Dark Web: Linking Dark Web Aliases to Real Internet Identities”, (2020-04-01):
Most users have several Internet names. On Face-book or LinkedIn, for example, people usually appear with the real one. On other standard websites, like forums, people often use aliases to protect their real identities with respect to the other users, with no real privacy against the web site and the authorities. Aliases in the Dark Web are different: users expect strong identity protection.
In this paper, we show that using both “open” aliases (aliases used in the standard Web) and Dark Web aliases can be dangerous per se. Indeed, we develop tools to link Dark Web to open aliases. For the first time, we perform a massive scale experiment on real scenarios. First between two Dark Web forums, then between the Dark Web forums and the standard forums. Due to a large number of possible pairs, we first reduce the search space cutting down the number of potential matches to a small set of candidates, and then on the selection of the correct alias among these candidates. We show that our methodology has excellent precision, from 87% to 94%, and recall around 80%.
2019-chan.pdf: “Shedding Light on the Dark: The Impact of Legal Enforcement on Darknet Transactions”, (2020-03-17; ):
Darknet markets have been increasingly used for the transaction of illegal products and services in the last decade. In particular, it is estimated that drugs make up two-thirds of darknet market transactions. The growth of illicit transactions on darknet markets have led enforcement agencies to invest greater proportion of time and efforts to monitor and crack down on criminal activities on the darknet websites.
Despite the successes in convicting perpetrators, it is unknown whether these policing efforts are truly effective in deterring future darknet transactions, given that the identities of the transacting parties are well protected by the markets’ features and that these participants may migrate to other darknet platforms to transact. To this end, this study attempts to empirically evaluate the susceptibility of darknet markets breaking down upon successful policing of participants on the platform.
Using drug review data from three largest darknet markets [Silk Road 2, Agora, Evolution], we rely on a difference-in-difference procedure to assess the impact of policing on future transaction levels, by contrasting various outcomes from the policed site with those from the non-policed sites. Our analyses found that enforcement efforts produce a negative effect on subsequent transactions on the policed site, for both vendors in the same country and in different countries as that of the arrested perpetrators. Not only do the average number of transactions per vendor decreased, we also found that the number of active vendors that remained on the site dropped substantially.
This dampening effect cannot be explained by migratory behaviors, to which we interpret as evidence of a deterrence effect at work. Furthermore, we find heterogeneity effects in the enforcement effort, wherein small vendors and vendors with short site tenure are relatively more affected by the arrest shock. Study findings have policy and theoretical implications to law makers, enforcement agencies, and academicians.
2020-ladegaard.pdf: “Open Secrecy: How Police Crackdowns and Creative Problem-Solving Brought Illegal Markets out of the Shadows”, (2020-03-16; ):
Can organized illegal activities grow stronger and more advanced in response to legal pressure? In October 2013, the FBI shut down Silk Road, a thriving e-commerce market for illegal drugs. After the shock, market actors adopted a new identity verification method that enabled mass-migration to other markets, and created websites for information distribution that reduced post-shock uncertainties. The outcome was a decentralized market in which actors could operate in “open secrecy” across multiple websites. With verifiable pseudonyms and securely obfuscated real-world identities, actors could publicly discuss, plan, and participate in illegal activities. Threats from police and opportunistic criminals persisted but were no longer crippling concerns as buyers and sellers could reasonably expect that their exchange partners would be available for future business; the illegal market could operate more like a legal one. Drawing on quantitative and qualitative data, the author argues that advances in information technology have expanded the opportunity structure for cooperation and creative problem-solving in the underworld, and therefore that shocks did not hinder but rather stimulate development in digital drug markets. Data, collected in 2013–2017, include nearly one million transactions from three illicit e-commerce markets, three million messages from eight discussion forums, and website traffic from two market-independent websites.
2020-jeziorowski.pdf: “Towards Image-Based Dark Vendor Profiling: An Analysis of Image Metadata and Image Hashing in Dark Web Marketplaces”, (2020-03-01; ):
Anonymity networks, such as Tor, facilitate the hosting of hidden online marketplaces where dark vendors are able to anonymously trade paraphernalia such as drugs, weapons, and hacking services. Effective dark marketplace analysis and dark vendor profiling techniques support dark web investigations and help to identify and locate these perpetrators. Existing automated techniques are text-based, leaving non-textual artifacts, such as images, out of consideration. Though image data can further improve investigative analysis, there are two primary challenges associated with dark web image analysis: (a) ethical concerns over the presence of child exploitation imagery in illegal markets, and (b) the computational overhead needed to download, analyze, and store image content. In this research, we investigate and address the aforementioned challenges to enable dark marketplace image analysis. Namely, we examine image metadata and explore several image hashing techniques to represent image content, allowing us to collect image-based intelligence and identify reused images among dark marketplaces while preventing exposure to illegal content and decreasing computational overhead. Our study reveals that approximately 75% of dark marketplace listings include image data, indicating the importance of considering image content for investigative analysis. Additionally, 2% of considered images were found to contain metadata and approximately 50% of image hashes were repeated among marketplace listings, suggesting the presence of easily obtainable incriminating evidence and frequency of image reuse among dark vendors. Finally, through an image hash analysis, we demonstrate the effectiveness of using image hashing to identify similar images between dark marketplaces.
2020-zhou.pdf: “A Market in Dream: the Rapid Development of Anonymous Cybercrime”, (2020-02-01; ):
In this paper we have conducted a comprehensive measurement and analysis on the Dream market, an anonymous online market that uses cryptocurrency as transaction currency. We first collect data between October 30th 2018 and March 1st 2019. Then we use decision tree-based approach to classify goods. Following we analyze the category of goods sold in the market, the shipping place of vendors. By analyzing more than 1,970,303 items, we find the goods sold in Dream Market are mainly drugs and digital goods. We estimate the total sales of all vendors, and find that an average monthly income is [$14]($2019) million during the measurement period, which means that the market commission income is more than $560,000 per month. Based on these data, we use transaction cost theory to analyze the transaction attributes of illegal transactions, which shows that anonymous online market can reduce transaction cost of illegal transactions. We finally discuss the results analyzed and the intervention policy, as well as recent DDoS attacks and future trends of illegal transactions in anonymous online market.
2020-heistracher.pdf: “Machine Learning Techniques for the Classification of Product Descriptions from Darknet Marketplaces”, (2020-01-29; ):
Over the past decade, the darknet has created unprecedented opportunities for trafficking in illicit goods, such as weapons and drugs, and it has provided new ways to offer crime as a service. Natural language processing techniques can be applied to find the types of goods that are traded in these markets. In this paper we present the results of evaluating state-of-the-art machine learning methods for the classification of darknet market offers.
Several embeddings, such as GloVe embeddings , FastText , Tensor Flow Universal Sentence Encoder , Flair’s contextual string embedding  and term-frequency inverse-document-frequency (TF-IDF), as well as our domain-specific darknet embedding have been evaluated with a series of machine learning models, such as Random Forest, SVM, Naïve Bayes and Multilayer Perceptron.
To find the best combination of feature set and machine learning model for this task, the performance was evaluated on a publicly available collection covering 13 darknet markets with more than 10 million product offers . After extracting unique advertisements from the corpus, the classifier was trained on a subset with those advertisements that contain strings related to weapons. The purpose was to determine how well the classifier can distinguish between different types of advertisements which seem all to be related to weapons according to the keywords they contain.
The best performance for this classification task was achieved using the Linear Support Vector Machine model with the Tensor Flow Universal Sentence Encoder for feature extraction, resulting in a micro-f1-score of 96%.
[Keywords: Natural language processing, machine learning, text classification, document embedding, darknet market]
2020-childs.pdf: “Evolving and Diversifying Selling Practices on Drug Cryptomarkets: An Exploration of Off-Platform “Direct Dealing””, (2020-01-24):
This is the first study to explore how cryptomarket actors are increasingly adopting encrypted messaging applications to “direct deal” beyond the provided platforms, to obviate the protocols of cryptomarkets, and to diversify the communication experience of drug buying via the dark net. Drawing on 965 forum posts discussing encrypted messaging applications, results showed that direct dealing may be more likely to occur in the context of preestablished trust between vendors and buyers, during instances of law enforcement crackdowns, and when buyers are enticed by discounts or promotions. Our findings also suggested a general hesitancy toward direct dealing, as it was often associated with greater exposure to scams, and perceptions that direct dealing increases the risks concerning personal security and detection from law enforcement. These findings provide insight into the interconnection of online drug markets, and how actors make decisions to drift between multichannel supply points mediated by perceptions of trust and risk.
2020-harviainen.pdf: “Drug traders on a local dark web marketplace”, J. Tuomas Harviainen, Ari Haasio, Lasse Hämäläinen
2020-yang-2.pdf: “Crawling and Analysis of Dark Network Data”, (2020; ):
Due to its anonymity and non-traceability, it is very difficult to research websites on the dark network. The research of the dark network is very important for our network security. Now there is very little data for studying the dark network, so we independently developed dark web crawler that runs automatically. This article will detail the implementation process of our dark web crawler and the data analysis process of crawled data. Currently, we can use crawled data to detect if multiple URLs belong to the same site. We can use data to extract features of similar websites and we have generated an ever-increasing data set that can be used for simple website classification. We use the crawled data as a categorical dataset to categorize newly discovered URLs. When we get a certain number of new URLs, we crawl again and the crawled data will be added to the previous data set. After multiple rounds of crawling, our data sets will be more and more abundant. Through our approach, we can solve the problem that the dark network data is small, researchers can use our method to get enough data to study all aspects of the dark network.
2020-ganan.pdf: “Beneath the radar: Exploring the economics of business fraud via underground markets”, (2020; ):
Underground marketplaces have emerged as a common channel for criminals to offer their products and services. A portion of these products comprises the illegal trading of consumer products such as vouchers, coupons, and loyalty program accounts that are later used to commit business fraud. Despite its well-known existence, the impact of this type of business fraud has not been analyzed in depth before.
By leveraging longitudinal data from 8 major underground markets from 2011–2017 [Agora, Alphabay, BlackMarket Reloaded, Evolution, Hydra, Pandora, Silk Road 1, Silk Road 2], we identify, classify, and quantify different types of business fraud to then analyze the characteristics of the companies who suffered from them. Moreover, we investigate factors that influence the impact of business fraud on these companies.
Our models show that cybercriminals prefer selling products of well-established companies, while smaller companies appear to suffer higher revenue losses. Stolen accounts are the most transacted items, while pirated software together with loyalty programs create the heaviest revenue losses. The estimated criminal revenues are relatively low, at under $600,000 in total for the whole period; but the total estimated revenue losses are up to $7.5 million.
2020-bradley.pdf: “Essays in Demand Estimation: Illicit Drugs and Commercial Mushrooms”, (2020; ):
This dissertation consists of two essays analyzing the various effects of market competition in the United States. The first chapter explores the impact of competition among drug dealers. Although opioid buyers are often addicted to the products they are purchasing, due to the competition among sellers, the buyers have a wide variety of opioid chemicals to choose from. The net result shows buyers to be price sensitive and without loyalty to any particular opioid compound. The second chapter shows that although Mushroom Council post market price and quantity information to all mushroom growers, it does not serve as a focal point for farmers to tacitly collude.
2020-barrsmith.pdf: “Phishing With a Darknet: Imitation of Onion Services”, (2020; ):
In this work we analyse the use of malicious mimicry and cloning of darknet marketplaces and other ‘onion services’ as means for phishing, akin to traditional ‘typosquatting’ on the web. This phenomenon occurs due to the complex trust relationships in Tor’s onion services, and particularly the complex webs of trust enabled by darknet markets and similar services.
To do so, we built a modular scraper tool to identify networks of maliciously cloned darknet marketplaces; in addition to other characteristics of onion services, in aggregate. The networks of phishing sites identified by this scraper are then subject to clustering and analysis to identify the method of phishing and the networks of ownership across these sites. We present a novel discovery mechanism for sites, means for clustering and analysis of onion service phishing and clone sites, and an analysis of their spectrum of sophistication.
2019-yang.pdf: “Anonymous market product classification based on deep learning”, (2019-12; ):
With the rapid development of Internet technology, the abuse of dark networks and anonymous technology has brought great challenges to network supervision. Therefore, it is important to study the anonymous market. In this paper, we propose a single-mode multivariate classification model for anonymous market product classification. Divide anonymous markets products into 5 categories. Our algorithm uses the word vector embedded in a convolutional neural network based on Word2vec training. Compared with the simple machine learning classification model, the accuracy of the single-mode multivariate classification model on the test set is 91.84%. By studying the classification of anonymous market products, law enforcement personnel can better supervise anonymous market of illegal products and maintain network security.
2019-martin.pdf: “Selling Drugs on Darkweb Cryptomarkets: Differentiated Pathways, Risks and Rewards”, (2019-11-28):
Cryptomarkets, anonymous online markets where illicit drugs are exchanged, have operated since 2011, yet there is a dearth of knowledge on why people use these platforms to sell drugs, with only one previous study involving interviews with this novel group. Based on 13 interviews with this hard to reach population, and data analysis critically framed from perspectives of economic calculation, the seductions of crime, and drift and techniques of neutralization, we examine the differentiated motivations for cryptomarket selling. Throughout the interviews, we observe an appreciation for the gentrified norms of cryptomarkets and conclude that cryptomarket sellers are motivated by concerns of risks and material rewards, as well as non-material attractions in a variety of ways that both correspond with, and differ from, existing theories of drug selling.
2019-bancroft.pdf: “Producing Trust Among Illicit Actors: A Techno-Social Approach to an Online Illicit Market”, (2019-11-12; ):
Illicit market exchanges in cybercriminal markets are plagued by problems of verifiability and enforceability: trust is one way to ensure reliable exchange. It is fragile and hard to establish. One way to do that is to use the administrative structure of the digital market to control transactions. This is common among a specific type of market—darknet cryptomarkets. These are sites for the sale of illicit goods and services, hosted anonymously using the Tor darknet. However, reliance by users on the technology and the market administrators exposes users to excessive risk. We examine a case of a market that rejects several key technological features now common in cryptomarkets but that is nonetheless reliable and robust. We apply a techno-social approach that looks at the way participants use and combine technologies with trust relationships. The study was designed to capture the interactional context of the illicit market. We aimed to examine both person-to-person interaction and the technical infrastructure the market relied on. We find that the social space of the market maintains itself through a shared common security orientation, community participation in key decisions about products sold, performing trust signalling, and relying on lateral trust between members. There are implications for how resilience in cryptomarkets is understood.
2019-vana.pdf: “From Darknets to Light”, (2019-10-20; ):
A large majority of e-commerce happens on the “Surface Web”, which consists of all the websites that can be accessed through search engines. However, there has recently been a rapid growth in the “Dark Web”, consisting of websites which cannot be indexed by search engines. The Dark Web offers a high degree of anonymity and security to its users and has attracted illicit activity. Online marketplaces similar to eBay and Etsy on the Surface Web have also evolved on the Dark Web and are commonly known as “Darknet markets”. These markets have attracted sellers and buyers of illegal products such as drugs, weapons, and counterfeits. Law enforcement agencies are interested in curbing the rise of these markets. In this research, we focus on a bust operation conducted by the FBI and Europol in November 2014 that shut down Silk Road 2.0, one of the biggest Darknet markets at the time. Using the bust as an exogenous shock, we investigate the causal effect of the bust on Evolution and Agora, the next two biggest Darknet markets that were not subject to the bust. We find that the bust had positive marketing consequences for the buyers and the administrators of Evolution and Agora. Specifically, the prices reduced, and the number of transactions per vendor increased following the bust. Our results also indicate that these benefits are not simply a product of the forces of supply and demand but that they occur despite them. Our findings demonstrate that there could be surprising and unintended consequences to such busts and recommend law enforcement agencies consider them into their enforcement strategies.
[Keywords: two-sided markets, e-commerce, Dark Web.]
2019-miller.pdf: “The War On Drugs 2.0: Darknet Fentanyl's Rise And The Effects Of Regulatory And Law Enforcement Action”, (2019-10-08; ):
U.S. overdose deaths attributed to synthetic opioids, such as fentanyl, have increased from under 3,000 in 2013 to nearly 20,000 in 2016, making up half of all opioid-related overdose deaths. Using web scrapes of darknet markets from 2014 to 2016, I provide historical prices for fentanyl and its most popular analogues and find that fentanyl vendors priced fentanyl in 2014 at a 90% discount compared to an equivalent dose of heroin. Using regression discontinuity, I evaluate the effects of two major law enforcement and regulatory events. I find minimal lasting effects of U.S. legal actions intended to disrupt darknet markets, but there are statistically-significant indications of a price increase corresponding with regulatory action in China. Despite these indications of some regulatory success, fentanyl prices remained approximately 90% cheaper than heroin.
2019-morelato.pdf: “An insight Into Prescription Drugs and Medicine on the AlphaBay Cryptomarket”, (2019-09-13):
Internet access has provided new ways to trade goods. Unlike conventional legal sale sites, cryptomarkets facilitate exchanges in a context where the anonymity of participants is warranted. The aim of this article was to obtain a better understanding of the trafficking of prescription drugs and medicine on the AlphaBay cryptomarket. The results showed that alprazolam, oxycodone, and Adderall were the most offered prescription drugs while alprazolam, diazepam, and oxycodone were the most sold substances. The sale was dominated by North America, Australia, and Western European countries. The revenue of prescription drugs was estimated to be more than US$65 million since the creation of AlphaBay, a small market in comparison with the worldwide legal pharmaceutical market’s estimate of US$1.3 trillion in 2020. Digital traces offer a complementary way to understand the trafficking of prescription drugs and medicine and to identify the most prolific vendors and their implication in this trafficking.
2019-yannikos.pdf: “An Analysis Framework for Product Prices and Supplies in Darknet Marketplaces”, York Yannikos, Julian Heeger, Maria Brockmeyer ( )
2019-du.pdf: “Identifying High-Impact Opioid Products and Key Sellers in Dark Net Marketplaces: An Interpretable Text Analytics Approach”, (2019-07-01; ):
As the Internet based applications become more and more ubiquitous, drug retailing on Dark Net Marketplaces (DNMs) has raised public health and law enforcement concerns due to its highly accessible and anonymous nature. To combat illegal drug transaction among DNMs, authorities often require agents to impersonate DNM customers in order to identify key actors within the community. This process can be costly in time and resource. Research in DNMs have been conducted to provide better understanding of DNM characteristics and drug sellers’ behavior. Built upon the existing work, researchers can further leverage predictive analytics techniques to take proactive measures and reduce the associated costs. To this end, we propose a systematic analytical approach to identify key opioid sellers in DNMs. Utilizing machine learning and text analysis, this research provides prediction of high-impact opioid products in two major DNMs. Through linking the high-impact products and their sellers, we then identify the key opioid sellers among the communities. This work intends to help law enforcement authorities to formulate strategies by providing specific targets within the DNMs and reduce the time and resources required for prosecuting and eliminating the criminals from the market.
2019-chun.pdf: “The Limits of Reputation Signaling in Adversely Selected Markets: Applications to Dark Net Cocaine Markets”, (2019-06-01; ):
Dark net markets present a rare opportunity to examine markets with little contract enforcement and strong asymmetric information. The review systems on these sites prevent market collapse by allowing good vendors to accrue reputation, signaling high quality products. This paper examines cocaine listings on the Dream Market dark net site. Despite uniformly high ratings across all vendors, I find a price differential between escrow transactions—which function as strong contracts—and non-escrow transactions.
This supports existing models of markets with reputation signaling that become heavily saturated with highly reputable vendors, yet these vendors still have a nonzero chance of scamming their customers in an exit-scheme. I argue that the price differential represents the discount high-reputation vendors must offer consumers to offset the inherent risk the transaction is a scam.
[Keywords: Adverse Selection, Dark Net Markets, Moral Hazard, Online, Drugs.]
2019-foley.pdf: “Sex, Drugs, and Bitcoin: How Much Illegal Activity Is Financed through Cryptocurrencies?”, (2019-04-04; ):
Cryptocurrencies are among the largest unregulated markets in the world. We find that approximately one-quarter of bitcoin users are involved in illegal activity. We estimate that around $76 billion of illegal activity per year involve bitcoin (46% of bitcoin transactions), which is close to the scale of the U.S. and European markets for illegal drugs. The illegal share of bitcoin activity declines with mainstream interest in bitcoin and with the emergence of more opaque cryptocurrencies. The techniques developed in this paper have applications in cryptocurrency surveillance. Our findings suggest that cryptocurrencies are transforming the black markets by enabling “black e-commerce.”
2019-zhang.pdf: “Your Style Your Identity: Leveraging Writing and Photography Styles for Drug Trafficker Identification in Darknet Markets over Attributed Heterogeneous Information Network”, Yiming Zhang, Yujie Fan, Wei Song, Shifu Hou, Yanfang Ye*, Xin Li, Liang Zhao, Chuan Shi, Jiabin Wang, Qi Xiong ( )
2019-wu.pdf: “Python Scrapers for Scraping Cryptomarkets on Tor”, Yubao Wu, Fengpan Zhao, Xucan Chen, Pavel Skums, Eric L. Sevigny, David Maimon, Marie Ouellet, Monica Haavisto Swahn, Sheryl M. Strasser, Mohammad Javad Feizollahi, Youfang Zhang, Gunjan Sekhon ( )
2019-mittal.pdf: “Knowledge for Cyber Threat Intelligence”, Sudip Mittal ( )
2019-hardy.pdf: “Rationality on the Fringes”, Robert Augustus Hardy ( )
2019-chen.pdf: “Characteristics of Bitcoin Transactions on Cryptomarkets”, Xucan Chen, Mohammad Al Hasan, Xintao Wu, Pavel Skums, Mohammad Javad Feizollahi, Marie Ouellet, Eric L. Sevigny, David Maimon, Yubao Wu
2019-berman.pdf: “Making Sense of Darknet Markets: Automatic Inference of Semantic Classifications from Unconventional Multimedia Datasets”, Alexander Berman, Celeste Lyn Paul ( )
2019-04-24-deepdotweb-219cr0015dwa-indictment.pdf: “US Federal Indictment of DeepDotWeb.com (Tal Prihar, Michael Phan)”, Scott W. Brady ( )
2019-veringmeier.pdf: “Repeat Buying Behavior of Illegal Drugs on Cryptomarkets”, (2019; ):
The goal of this research is to get a better understanding of buyer behavior on cryptomarkets, and to what extent buyers buy repeatedly from sellers. Cryptomarkets are anonymized markets only accessible through encryption software such as Tor. These markets provide opportunity for people to trade in illegal goods such as drugs in relative safety from legal authorities. Trading on cryptomarkets relies on trust and reputation.
Theory from The Trust Game is used to explain the relations between buyers and sellers, as well as the actions that the actors can make. Although sellers have high short-term incentives to scam their customers, long-term success relies on trustworthy behavior. Buyers have to make risk assessments to place trust based on available information and experience. Data was gathered from the AlphaBay cryptomarket shortly before it was taken down by U.S. authorities. Logistic regressions were used to analyze the odds of buyers repurchasing after each purchase both on network level as well as on dyad level. 69.4% of the buyers on AlphaBay bought repeatedly, and 32.5% of all dyads were repeated. It was found that positive experiences give better odds of buyers making more purchases on network and dyad level. Using safe payments services such as escrow and experience also increase odds of buyers repeatedly purchasing.
Future quantitative research on buyer behavior may want to focus on availability of alternative products and sellers for buyers, qualitative research may be valuable for finding buyer motivations to keep purchasing, stop purchasing or change sellers.
[Keywords: cryptomarket, AlphaBay, buyer behavior, repeated buying, trust]
This chapter explores collective information processing among black-hat hackers during their crises events. The chapter presents a preliminary study on one of Tor-based darknet market forums, during the shutdowns of 2 cryptomarkets.
Content and network analysis of forum conversations showed that black-hat users mostly engaged with rational information processing and were adept at reaching collective solutions by sharing security advices, new market information, and alternative routes for economic activities. At the same time, the study also found that anti-social and distrustful interactions were aggravated during the marketplace shutdowns. Communication network analysis showed that not all members were affected by the crisis events, alluding to a fragmented network structure of black-hat markets.
The chapter concludes that, while darknet forums may constitute resilient, solution-oriented users, market crises potentially make the community vulnerable by engendering internal distrust.
[Keywords: darknet, cybercrime, hidden organization, crisis, collective problem solving, virtual organization, cyber security]
2018-batikas.pdf: “Entrepreneurs on the Darknet: Reaction to Negative Feedback”, (2018-09-03; ):
Reputation is one of the key assets of a digital entrepreneur in markets for experience goods, especially in settings like Darknet and anonymous marketplaces. But what happens if this asset is diminished by a shock, i.e. negative feedback? We study how entrepreneurs on anonymous marketplaces respond to negative feedback by adjusting their product portfolio, or even exiting the market altogether.
We find that the entrepreneurs are more likely to exit following negative feedback, but that a entrepreneur’s accumulated transactions experience on the market platform negatively moderates this. Interestingly, the entrepreneurs that do remain tend to expand their product portfolio. This effect, however, is again driven by entrepreneurs with relative high transactions experience, i.e. those with a high prior transactions volume.
These results suggest that the reputation and the transactions experience of an entrepreneur interact in intricate ways to drive an entrepreneur’s choice of remaining in the market or adjusting her portfolio. We derive managerial and policy implications of these results.
[Keywords: digital entrepreneurship, reputation, anonymous marketplaces, illicit drugs, darknet]
2018-morelato.pdf: “Forensic drug intelligence and the rise of cryptomarkets. Part II: Combination of data from the physical and virtual markets”, (2018-07; ):
- Online data were compared to data related to traditional market descriptors.
- The results highlighted a link between the virtual and physical markets.
- Forensic drug intelligence processes rely on the combination of different information.
Technology provides new ways to access customers and suppliers while enhancing the security of off-line criminal activity. Since the first cryptomarket, Silk Road, in 2011, cryptomarkets have transformed the traditional drug sale by facilitating the creation of a global network of vendors and buyers. Due to the fragmented nature of traces that result from illegal activities, combining the results of concurrent processes based on traces of different nature should provide supplementary benefit to understand the drug market.
This article compares the data of the Australian virtual market (in particular data extracted from cryptomarkets) to the data related to traditional market descriptors, namely national seizures and arrests, prevalence data, shipping countries of seized post shipments as well as outcomes of specific surveys targeting users’ behaviour online. Results revealed the domestic nature of the online illicit drug trade in Australia which is dominated by amphetamine-type substances (ATS), in particular methylamphetamine and cannabis. These illicit drugs were also the most seized drugs on the physical market.
This article shows that the combination of different information offers a broader perspective of the illicit drug market in Australia and thus provides stronger arguments for policy makers. It also highlights the links between the virtual and physical markets.
[Keywords: darknet, illicit drug market, problem-oriented approach, National Forensic Rapid Laboratory (Australia)] [part I]
2017-rhumorbarbe.pdf: “Technical Note: Characterising the online weapons trafficking on cryptomarkets”, (2018-07; ):
Weapons related webpages from nine cryptomarkets were manually duplicated in February 2016. Information about the listings (i.e. sales proposals) and vendors’ profiles were extracted to draw an overview of the actual online trafficking of weapons. Relationships between vendors were also inferred through the analysis of online digital traces and content similarities.Weapons trafficking is mainly concentrated on two major cryptomarkets. Besides, it accounts for a very small proportion of the illicit trafficking on cryptomarkets compared to the illicit drugs trafficking. Among all weapon related listings (n = 386), firearms only account for approximately 25% of sales proposal since the proportion of non-lethal and melee weapons is important (around 46%). Based on the recorded pseudonyms, a total of 96 vendor profiles were highlighted. Some pseudonyms were encountered on several cryptomarkets, suggesting that some vendors may manage accounts on different markets. This hypothesis was strengthened by comparing pseudonyms to online traces such as PGP keys, images and profiles descriptions. Such a method allowed to estimate more accurately the number of vendors offering weapons across cryptomarkets. Finally, according to the gathered data, the extent of the weapons trafficking on the cryptomarkets appear to be limited compared to other illicit goods.
[Keywords: Darknet markets; Firearms; Ammunition; Digital traces; Forensic intelligence; Internet traces.]
…The selected markets are: Aflao marketplace (AFL), AlphaBay (ALB), Dr D’s multilingual market (DDM), Dream market(DMA), French Darknet (FRE), The Real Deal (TRD), Oasis (OAS), Outlaw market (OUT), Valhalla (aka Silkkitie) (VAL).
2018-wegberg.pdf: “Bitcoin money laundering: mixed results? An explorative study on money laundering of cybercrime proceeds using Bitcoin”, (2018-05-08):
Purpose: This paper aims to shed light into money laundering using bitcoin. Digital payment methods are increasingly used by criminals to launder money obtained through cybercrime. As many forms of cybercrime are motivated by profit, a solid cash-out strategy is required to ensure that crime proceeds end up with the criminals themselves without an incriminating money trail. The authors examine how cybercrime proceeds can be laundered using services that are offered on the Dark Web.
methodology/: Focusing on service-percentages and reputation-mechanisms in underground bitcoin laundering services, this paper presents the results of a cash-out experiment in which 5 mixing and 5 exchange services are included. approach
Findings: Some of the examined services provide an excellent, professional and well-reviewed service at competitive cost. Whereas others turned out to be scams, accepting bitcoin but returning nothing in return.
Practical implications: The authors discuss what these findings mean to law enforcement, and how bitcoin laundering chains could be disrupted.
value: These cash-out strategies are increasingly facilitated by cryptocurrencies, mainly bitcoin. Bitcoins are already relatively anonymous, but with the rise of specialised bitcoin money laundering services on the Dark Web, laundering money in the form of bitcoins becomes available to a wider audience.
2018-tzanetakis.pdf: “Comparing cryptomarkets for drugs. A characterisation of sellers and buyers over time”, Meropi Tzanetakis ( )
2018-tzanetakis-2.pdf: “Social order of anonymous digital markets: Towards an economic sociology of cryptomarkets”, Meropi Tzanetakis
2018-paquetclouston.pdf: “Assessing market competition and vendors’ size and scope on AlphaBay”, Masarah Paquet-Clouston, David Décary-Hétu, Carlo Morselli ( )
2018-lorenzodus.pdf: “‘I know this whole market is based on the trust you put in me and I don’t take that lightly’: Trust, community and discourse in crypto-drug markets”, (2018-01-01; ):
This study uses a Corpus Assisted Discourse Studies methodology to provide the first systematic analysis of how trust is discursively constructed in crypto-drug markets. The data come from two purpose-built corpora. One comprises all the forum messages posted on the flag ship crypto-drug market Silk Road during the years in which it traded on the hidden net (c. 250 million words). The other corpus comprises all the reports published by the United Nations Office on Drugs and Crime (UNODC) during the same period (c. 153,000 words). Our analysis of trust focuses on the identities of those buying and selling drugs. The findings reveal that the Silk Road community members (a) regularly discussed vendors’ identities alongside a continuum of trust–risk calculation, explicitly identifying both ‘good’ and ‘bad’ practices and hence engaging in self-regulatory discourses, and (b) mainly constructed drug users’ identities in relation to values of expertise, integrity and benevolence. The findings also suggest that hard law enforcement activity, such as crypto-drug market closure, may encourage technological innovation within these markets. Moreover, our results show a disconnect between the discursive reality of the policy-making documents we examined and the very crypto-drug markets that they seek to legislate.
2018-ladegaard.pdf: “Instantly Hooked? Freebies and Samples of Opioids, Cannabis, MDMA, and Other Drugs in an Illicit E-Commerce Market”, (2018-01-01; ):
Do drug dealers entice nonusers with free samples? Police, the popular press, and social media users say so, but crime researchers have found little support for this theory and argue instead that sample distribution is an unsound strategy for illegal market business. But what about in digital drug markets, where operational logics are based on sophisticated anonymization technology and reputation systems? The author collected data from a large e-commerce website for drugs over 305 days in 2014 and 2015 and documents that (a) drug dealers give away samples of all major substance categories and (b) sample distribution increases vendor sales for prescription drugs and opioid-based painkillers. To explore possible explanations of these findings, the author collected data from the market’s online forum and analyzed 175 discussions (2,218 posts) about samples. Among the findings is that samples are preferably given to reputable review writers, or “drug critics.”
2018-decaryhetu.pdf: “Six Years Later”, (2018-01-01):
Cryptomarkets are online illicit marketplaces where drug dealers advertise the sale of illicit drugs. Anonymizing technologies such as the Tor network and virtual currencies are used to hide cryptomarket participants’ identity and to limit the ability of law enforcement agencies to make arrests. In this paper, our aim is to describe how herbal cannabis dealers and buyers in the United States have adapted to the online sale of herbal cannabis through cryptomarkets. To achieve this goal, we evaluate the size and scope of the American herbal cannabis market on cryptomarkets and compare it to other drug markets from other countries, evaluate the impact of cryptomarkets on offline sales of herbal cannabis, and evaluate the ties between the now licit herbal cannabis markets in some States and cryptomarkets. Our results suggest that only a small fraction of herbal cannabis dealers and drug users have transitioned to cryptomarkets. This can be explained by the need for technical skills to buy and sell herbal cannabis online and by the need to have access to computers that are not accessible to all. The slow rate of adoption may also be explained by the higher price of herbal cannabis relative to street prices. If cryptomarkets were to be adopted by a larger portion of the herbal cannabis market actors, our results suggest that wholesale and regional distributors who are not active on cryptomarkets would be the most affected market’s participants.
2018-baravalle.pdf: “Dark Web Markets: Turning the Lights on AlphaBay”, Andres Baravalle, Sin Wee Lee ( )
2018-rolando.pdf: “This place is like the jungle: discussions about psychoactive substances on a cryptomarket”, (2018; ):
Purpose: The purpose of this paper is to analyse dynamics amongst members to better understand in what terms and to what extent marketplace forums can be seen as new forms of harm reduction.
methodology/: This is a qualitative analysis focused on conversations about psychoactive substances on the forum community of AlphaBay Market. A sample consists of 100 online threads. The data, collected in July 2016, were analysed by applying the grounded theory approach with the support of Atlas.ti. approach
Findings: Conversations in the marketplace forum focus mostly on the purchase. Concerns and disputes are voiced in a substantial proportion of them, and interactions are affected by a climate of distrust where stigmatisation processes can emerge between users of different drug categories. This casts a certain amount of doubt on the thesis that marketplace forums—like online forums—are new forms of harm reduction and peer-led communities.
implications: The study focuses on only one marketplace forum. Other such forums should be analysed to corroborate its findings.
Practical implications: Harm reduction interventions in the online environment should take different form according to the forum type, and take the differences and boundaries that separate users of different substances into account.
value: Thanks to its infrequently used qualitative approach, the study provides a more thorough understanding of the relationships on marketplace forums.
2017-broseus-2.pdf: “Forensic drug intelligence and the rise of cryptomarkets. Part I: Studying the Australian virtual market”, (2017-10-01; ):
- Results revealed the domestic nature of the virtual Australian illicit drug trade.
- The virtual Australian illicit drug trade is dominated by amphetamine-type substances (ATS).
- The online price fixed by Australian sellers for the considered illicit drugs is higher than for any other shipping countries.
- Understanding the link between virtual and physical drug market necessitates the integration of different perspective.
Analysing and understanding cryptomarkets is essential to become proactive in the fight against the illicit drug trade. Such research seeks to combine a diversity of indicators related to the virtual (darknet markets) and physical (the traditional “offline” market) aspects of the illicit drug trade to provide information on the distribution and consumption as well as to assess similarities/
differences between the virtual and physical markets.
This study analysed data that had previously been collected on cryptomarkets from December 2013 to March 2015. In this article, the data was extracted from 2 marketplaces, Evolution and Silk Road 2, and analysed to evaluate the illicit drug trade of the Australian virtual market (e.g. information about the supply and demand, trafficking flows, prices of illicit drugs and market share) and highlight its specificities.
The results revealed the domestic nature of the virtual Australian illicit drug trade (i.e. Australian sellers essentially ship their products to local customers). This may explain the coherence between supply and demand. Particularly, the virtual Australian illicit drug trade is dominated by amphetamine-type substances (ATS), mainly methamphetamine and 3,4-Methylenedioxymethamphetamine (MDMA), and cannabis. Australia, as a shipping country, accounts for half of the methamphetamine offered and purchased on Silk Road 2. Moreover, it was observed that the online price fixed by Australian sellers for the considered illicit drugs is higher than for any other shipping countries, which is in line with previous studies.
Understanding the virtual and physical drug market necessitates the integration and fusion of different perspectives to capture the dynamic nature of drug trafficking, monitor its evolution and finally improve our understanding of the phenomenon so policy makers can make informed decisions.
[Keywords: cryptomarkets, supply & demand, illicit drug market, Australian perspective, darknet] [part 2]
2017-broseus.pdf: “A geographical analysis of trafficking on a popular darknet market”, (2017-08-01; ):
- Type and proportions of all products offered for sale on Evolution are analysed.
- A combined study of shipping country and type of product indicates spatial trends.
- The study of trafficking flows reveals the global or domestic character of the trade.
- Spatial specificities tend to reflect the structure of the traditional market.
Cryptomarkets are online marketplaces, located on the darknet, that facilitate the trading of a variety of illegal goods, mostly drugs. While the literature essentially focus on drugs, various other goods and products related to financial or identity fraud, firearms, counterfeit goods, as well as doping products are also offered on these marketplaces.
Through the analysis of relevant data collected on a popular marketplace in 2014–2015, Evolution, this research provides an analysis of the structure of trafficking (types and proportions of products, number of vendors and shipping countries). It also aims at highlighting geographical patterns in the trafficking of these products (e.g. trafficking flows, specialisation of vendors and assessment of their role in the distribution chain).
The analysis of the flow of goods between countries emphasises the role of specific countries in the international and domestic trafficking, potentially informing law enforcement agencies to target domestic mails or international posts from specific countries. The research also highlights the large proportion of licit and illicit drug listings and vendors on Evolution, followed by various fraud issues (in particular, financial fraud), the sharing of knowledge (tutorials) and finally goods, currencies and precious metals (principally luxury goods). Looking at the shipping country, there seems to be a clear division between digital and physical products, with more specific information for physical goods. This reveals that the spatial analysis of trafficking is particularly meaningful in the case of physical products (such as illicit drugs) and to a lesser extent for digital products. Finally, the geographical analysis reveals that spatial patterns on Evolution tend to reflect the structure of the traditional illicit market.
However, regarding illicit drugs, country-specificity has been observed and are presented in this article.
[Keywords: cryptomarket, digital traces, NPS, trafficking flows, illicit market, spatial analysis]
2017-wadsworth.pdf: “A market on both sides of the law: The use of the hidden web for the sale of new psychoactive substances”, Elle Wadsworth, Colin Drummond, Andreas Kimergård, Paolo Deluca ( )
2017-luo.pdf: “An exploratory investigation into the darknet marketplace discussion forum Agora”, Qiaoyu Luo ( )
2017-hull.pdf: “The Effects of Police Interventions on Darknet Market Drug Prices”, Glenn Hull ( )
2017-duxbury.pdf: “The Network Structure of Opioid Distribution on a Darknet Cryptomarket”, Scott W. Duxbury, Dana L. Haynie
2017-bakken.pdf: “Coordination problems in cryptomarkets: Changes in cooperation, competition and valuation”, (2017-01-01; ):
The new drug markets emerging on the dark net have reduced earlier drug market risk factors such as visibility and violence. This study uses economic sociology and transaction cost economics to broaden the present understanding of cryptomarkets. Results focus on three coordination problems characterizing illegal markets and how they are alleviated in cryptomarkets. More information and better visibility increase competition, the feedback system enforces cooperation and border control introduces a new cost influencing valuation. Cryptomarkets are formally structured and regulated by rules of conduct and centralized decisions. We argue that the online context circumvents earlier coordination problems in illegal markets, making dark net markets more structurally efficient compared with conventional drug markets.
- The Evolution cryptomarket is described through the analysis of source code files.
- Illicit drug orders on Evolution and chemical analyses are performed.
- The study of packaging reveals concealment techniques used to avoid detection.
- Products purity does not correspond with information provided on listings.
- Chemical profiling reveals a relationship between purchases and police seizures.
Darknet markets, also known as cryptomarkets, are websites located on the Darknet and designed to allow the trafficking of illicit products, mainly drugs. This study aims at presenting the added value of combining digital, chemical and physical information to reconstruct sellers’ activities. In particular, this research focuses on Evolution, one of the most popular cryptomarkets active from January 2014 to March 2015.
Evolution source code files were analysed using Python scripts based on regular expressions to extract information about listings (i.e., sales proposals) and sellers. The results revealed more than 48,000 listings and around 2700 vendors claiming to send illicit drug products from 70 countries. The most frequent categories of illicit drugs offered by vendors were cannabis-related products (around 25%) followed by ecstasy (MDA, MDMA) and stimulants (cocaine, speed). The cryptomarket was then especially studied from a Swiss point of view. Illicit drugs were purchased from 3 sellers located in Switzerland. The purchases were carried out to confront digital information (e.g., the type of drug, the purity, the shipping country and the concealment methods mentioned on listings) with the physical analysis of the shipment packaging and the chemical analysis of the received product (purity, cutting agents, chemical profile based on minor and major alkaloids, chemical class). The results show that digital information, such as concealment methods and shipping country, seems accurate. But the illicit drugs purity is found to be different from the information indicated on their respective listings. Moreover, chemical profiling highlighted links between cocaine sold online and specimens seized in Western Switzerland.
This study highlights that (1) the forensic analysis of the received products allows the evaluation of the accuracy of digital data collected on the website, and (2) the information from digital and physical/
chemical traces are complementary to evaluate the practices of the online selling of illicit drugs on cryptomarkets.
[Keywords: cryptomarket, cocaine, drug profiling, Evolution market, concealment techniques, source codes]
2016-zulkarnine.pdf: “Surfacing Collaborated Networks in Dark Web to Find Illicit and Criminal Content”, (2016-09-28):
The Tor Network, a hidden part of the Internet, is becoming an ideal hosting ground for illegal activities and services, including large drug markets, financial frauds, espionage, child sexual abuse. Researchers and law enforcement rely on manual investigations, which are both time-consuming and ultimately inefficient.
The first part of this paper explores illicit and criminal content identified by prominent researchers in the dark web. We previously developed a web crawler that automatically searched websites on the internet based on pre-defined keywords and followed the hyperlinks in order to create a map of the network. This crawler has demonstrated previous success in locating and extracting data on child exploitation images, videos, keywords and linkages on the public internet. However, as Tor functions differently at the TCP level, and uses socket connections, further technical challenges are faced when crawling Tor. Some of the other inherent challenges for advanced Tor crawling include scalability, content selection tradeoffs, and social obligation. We discuss these challenges and the measures taken to meet them. Our modified web crawler for Tor, termed the “Dark Crawler” has been able to access Tor while simultaneously accessing the public internet.
We present initial findings regarding what extremist and terrorist contents are present in Tor and how this content is connected to each other in a mapped network that facilitates dark web crimes. Our results so far indicate the most popular websites in the dark web are acting as catalysts for dark web expansion by providing necessary knowledge base, support and services to build Tor hidden services and onion websites.
[Keywords: Tor network, web crawler, criminal network, dark web, web graph, social network analysis]
2016-caudevilla-2.pdf: “Results of an international drug testing service for cryptomarket users”, (2016-09-01; ):
Introduction: User surveys indicate that expectations of higher drug purity are a key reason for cryptomarket use. In 2014–2015, Spain’s NGO Energy Control conducted a 1-year pilot project to provide a testing service to cryptomarket drug users using the Transnational European Drug Information (TEDI) guidelines. In this paper, we present content and purity data from the trial.
Methods: 219 samples were analyzed by gas chromatography associated with mass spectrometry (GC/
MS). Users were asked to report what substance they allegedly purchased.
Results: 40 different advertised substances were reported, although 77.6% were common recreational drugs (cocaine, MDMA, amphetamines, LSD, ketamine, cannabis). In 200 samples (91.3%), the main result of analysis matched the advertised substance. Where the advertised compound was detected, purity levels (m ± SD) were: cocaine 71.6 ± 19.4%; MDMA (crystal) 88.3 ± 1.4%; MDMA (pills) 133.3 ± 38.4 mg; Amphetamine (speed) 51.3 ± 33.9%; LSD 123.6 ± 40.5 μg; Cannabis resin THC: 16.5 ± 7.5% CBD: 3.4 ± 1.5%; Ketamine 71.3 ± 38.4%. 39.8% of cocaine samples contained the adulterant levamisole (11.6 ± 8%). No adulterants were found in MDMA and LSD samples.
Discussion: The largest collection of test results from drug samples delivered from cryptomarkets are reported in this study. Most substances contained the advertised ingredient and most samples were of high purity. The representativeness of these results is unknown.
[Keywords: cryptomarkets, drug markets, purity, adulterants, drug checking, drug trend monitoring]
[See also Arce 2020.]
2016-munksgaard.pdf: “A replication and methodological critique of the study “Evaluating drug trafficking on the Tor Network””, (2016-09; ):
[Debunking a remarkably sloppy darknet market paper which screwed up its scraping and somehow concluded that the notorious Silk Road 2, in defiance of all observable evidence & subsequent FBI data, actually sold primarily e-books and hardly any drugs. This study has yet to be retracted.] The development of cryptomarkets has gained increasing attention from academics, including growing scientific literature on the distribution of illegal goods using cryptomarkets. Dolliver’s 2015 article “Evaluating drug trafficking on the Tor Network: Silk Road 2, the Sequel” addresses this theme by evaluating drug trafficking on one of the most well-known cryptomarkets, Silk Road 2.0. The research on cryptomarkets in general—particularly in Dolliver’s article—poses a number of new questions for methodologies. This commentary is structured around a replication of Dolliver’s original study. The replication study is not based on Dolliver’s original dataset, but on a second dataset collected applying the same methodology. We have found that the results produced by Dolliver differ greatly from our replicated study. While a margin of error is to be expected, the inconsistencies we found are too great to attribute to anything other than methodological issues. The analysis and conclusions drawn from studies using these methods are promising and insightful. However, based on the replication of Dolliver’s study, we suggest that researchers using these methodologies consider and that datasets be made available for other researchers, and that methodology and dataset metrics (e.g. number of downloaded pages, error logs) are described thoroughly in the context of web-o-metrics and web crawling.
2016-munksgaard-2.pdf: “Mixing politics and crime—The prevalence and decline of political discourse on the cryptomarket”, (2016-09; ):
Background: Dread Pirate Roberts, founder of the first cryptomarket for illicit drugs named Silk Road, articulated libertarian political motives for his ventures. Previous research argues that there is a large political component present or involved in cryptomarket drug dealing which is specifically libertarian. The aim of the paper is to investigate the prevalence of political discourses within discussions of cryptomarket drug dealing, and further to research the potential changes of these over the timespan of the study.
Methods: We develop a novel operationalization of discourse analytic concepts which we combine with topic modelling enabling us to study how politics are articulated on cryptomarket forums. We apply the Structural Topic Model on a corpus extracted from crawls of cryptomarket forums encompassing posts dating from 2011 to 2015.
Results: The topics discussed on cryptomarket forums are primarily centered around the distribution of drugs including discussions of shipping and receiving, product advertisements, and reviews as well as aspects of drug consumption such as testing and consumption. However, on forums whose primary function is aiding operations on a black market, we still observe political matter. We identified one topic which expresses a libertarian discourse that emphasizes the individual’s right to non-interference. Over time, we observe an increasing prevalence of the libertarian discourse from 2011 to the end of 2013. In the end of 2013—when Silk Road was seized—we observe an abrupt change in the prevalence of the libertarian discourse.
Conclusions: The libertarian political discourse has historically been prevalent on cryptomarket forums. The closure of Silk Road has affected the prevalence of libertarian discourse suggesting that while the closure did not succeed in curtailing the cryptomarket economy, it dampened political sentiments.
[Keywords: digital methods, cryptomarkets, discourse analysis, harm-reduction, political theory, anarchism, topic models, libertarianism]
2016-winstock.pdf: “Global Drug Survey 2016: What We Learned from GDS2016 - An Overview of Our Key Findings”, Adam W. Winstock, Monica Barrett, Jason Ferris, Larissa Maier
2016-martin.pdf: “Ethics in Cryptomarket Research”, James Martin, Nicolas Christin ( )
2016-gouwe.pdf: “Purity, adulteration and price of drugs bought online versus offline in the Netherlands”, Daan Gouwe, Tibor M. Brunt, Margriet Laar, Peggy Pol ( )
2016-demant.pdf: “Personal use, social supply or redistribution? cryptomarket demand on Silk Road 2 and Agora”, Jakob Demant, Rasmus Munksgaard, Esben Houborg ( )
2016-decaryhetu.pdf: “Do police crackdowns disrupt drug cryptomarkets? A longitudinal analysis of the effects of Operation Onymous”, D. Décary-Hétu, L. Giommoni ( )
2015-interpol-pharmaceuticals.pdf: “Pharmaceutical Crime on the Darknet”, MCCLINTOCK Bjorn Douglas ( )
2013-aldridge.pdf: “Not an 'Ebay for Drugs': The Cryptomarket 'Silk Road' as a Paradigm Shifting Criminal Innovation”, (2014-05-15; ):
The online cryptomarket Silk Road has been oft-characterised as an ‘eBay for drugs’ with customers drug consumers making personal use-sized purchases. Our research demonstrates that this was not the case. Using a bespoke web crawler, we downloaded all drugs listings on Silk Road in September 2013. We found that a substantial proportion of transactions on Silk Road are best characterised as ‘business-to-business’, with sales in quantities and at prices typical of purchases made by drug dealers sourcing stock. High price-quantity sales generated between 31-45% of revenue, making sales to drug dealers the key Silk Road drugs business. As such, Silk Road was what we refer to as a transformative, as opposed to incremental, criminal innovation. With the key Silk Road customers actually drug dealers sourcing stock for local street operations, we were witnessing a new breed of retail drug dealer, equipped with a technological subcultural capital skill set for sourcing stock. Sales on Silk Road increased from an estimate of $18.24$14.42012 million in mid-2012 to $111.97$89.72013 million by our calculations. This is a more than 600% increase in just over a year, demonstrating the demand for this kind of illicit online marketplace. With Silk Road functioning to considerable degree at the wholesale/
broker market level, its virtual location should reduce violence, intimidation and territorialism. Results are discussed in terms of the opportunities cryptomarkets provide for criminologists, who have thus far been reluctant to step outside of social surveys and administrative data to access the world of ‘webometric’ and ‘big data’.
[Keywords: drug markets, cryptomarkets, webometrics, drug dealing]
2014-spitters.pdf: “Towards a Comprehensive Insight into the Thematic Organization of the Tor Hidden Services”, Martijn Spitters, Stefan Verbruggen, Mark van Staalduinen ( )
2013-van-hout.pdf: “‘Silk Road’, the virtual drug marketplace: A single case study of user experiences”, Marie Claire Van Hout, Tim Bingham ( )
1994-doj-sentencing.pdf: “FY1995 Federal Sentencing Statistics by State, District and Circuit”, U. S. Sentencing Commission ( )