Dark Web Marketplaces and COVID-19: before the vaccine
Alberto Bracci, Matthieu Nadini, Maxwell Aliapoulios, Damon McCoy, Ian Gray, Alexander Teytelboym, Angela Gallo, Andrea Baronchelli
TThe COVID-19 online shadow economy
Alberto Bracci , Matthieu Nadini , Maxwell Aliapoulios , Damon McCoy , Ian Gray ,Alexander Teytelboym , Angela Gallo , and Andrea Baronchelli City, University of London, Department of Mathematics, London EC1V 0HB, UK Center for Cybersecurity (CCS), New York Univ. Tandon School of Engineering, Brooklyn, NY 11201, USA Global Intelligence Team, Flashpoint. New York, NY 10003, USA Institute for New Economic Thinking, Oxford Martin School, University of Oxford, Oxford OX2 6ED, UK Department of Economics, University of Oxford, Oxford OX1 3UQ, UK Department of Finance, Cass Business School, London EC1Y 8TZ, UK UCL Centre for Blockchain Technologies, University College London, UK The Alan Turing Institute, British Library, 96 Euston Road, London NW12DB, UK * Corresponding author: [email protected]
The COVID-19 pandemic has reshaped the demand for goods and services worldwide.The combination of a public health emergency, economic distress, and disinformation-driven panic have pushed customers and vendors towards the shadow economy. In par-ticular Dark Web Marketplaces (DWMs), commercial websites easily accessible via freesoftware, have gained significant popularity. Here, we analyse 472,372 listings extractedfrom 23 DWMs between January 1, 2020 and July 7, 2020. We identify 518 listings directlyrelated to COVID-19 products and monitor the temporal evolution of product categoriesincluding Personal Protective Equipment (
PPE ), medicines (e.g., hydroxyclorochine), and medical frauds (e.g., vaccines). Finally, we compare trends in their temporal evolutionwith variations in public attention, as measured by Twitter posts and Wikipedia page vis-its. We reveal how the online shadow economy has evolved during the COVID-19 pandemicand highlight the importance of a continuous monitoring of DWMs, especially when realvaccines or cures become available and are potentially in short supply. We anticipate ouranalysis will be of interest both to researchers and public agencies focused on the protectionof public health. Introduction
COVID-19 gained global attention when China suddenly quarantined the city of Wuhan on January 23,2020. Declared a pandemic by the World Health Organization on March 11, 2020, at the moment ofwriting the virus has infected more than 18,000,000 people and caused over 650,000 deaths worldwide. Measures such as social distancing, quarantine, travel restrictions, testing, and tracking have proven vitalto containing the COVID-19 pandemic. a r X i v : . [ c s . C Y ] A ug estrictions have shaken the global economy and reshaped the demand for goods and services world-wide, with an estimated 2 . −
3% GDP loss each month since the crisis started. Demand for manyproducts has fallen; for example, Brent oil decreased from 68.90 USD a barrel on January 1, 2020 to43.52 USD as of August 2, 2020.
5, 6
Meanwhile demand for other products, like toilet paper , dra-matically increased. As a result of increased demand, some products are in short supply. Individualprotective masks were sold in the United States at 7 USD on February 2, 2020 and the price of alcoholdisinfectant doubled on July 1, 2020 in Japan. As a result, anti-gouging regulations were introduced tocontrol prices, which significantly affected the public attention on products related to COVID-19. Asthis trend has continued, further exacerbated by online disinformation, numerous customers have soughtto fulfill their needs through illicit online channels.
11, 12
DWMs offer an easy access to the shadow economy through user-friendly websites accessible viaspecialized browsers, like The Onion Router (Tor). These online markets offer a variety of goodsincluding drugs, firearms, credit cards and fake IDs. The most popular currency on DWMs is Bitcoin, but other cryptocurrencies are accepted for payment as well. The first modern DWM was the Silk Road,launched in 2011 and shut down by the FBI in 2013. Since then, dozens more DWMs have sprungup and many have shut down due to police action, hacks or scams. Today, DWMs form an ecosystem that has proven extremely resilient to law-enforcement. Whenever a marketplace is shut down, usersswiftly migrate to alternative active marketplaces and the economic activity recovers within a matter ofdays. In this study, we analyse 472,372 listings extracted from 23 DWMs between January 1, 2020 andJuly 7, 2020. We identify 518 COVID-19 specific listings that range from protective masks to hydrox-ychloroquine medicine. These listings were observed 7,159 times during this period, allowing us toinvestigate their temporal evolution. We then compare this COVID-19 related shadow economy withpublic attention measured through Twitter posts (tweets) and Wikipedia page visits. Finally, weinspect listings that mentioned delays in shipping or sales because of COVID-19. Our results significantlyextend previous analyses that surveyed 222 COVID-19 specific listings extracted from 20 DWMs on asingle day (April 3, 2020) and - to the best of our knowledge - offer the most comprehensive overviewof the DWM activity generated by the ongoing pandemic. Background: Dark Web Marketplaces
The online shadow economy is as old as the Internet. The first reported illegal online deal involved drugsand took place in 1972. The World Wide Web facilitated the emergence of online illicit markets
27, 28 but the first markets could not guarantee anonymity and facilitated the traceability of users by lawenforcement. Modern DWMs originated and still operate online, but outside the World Wide Web in an encryptedpart of the Internet whose contents are often not indexed by standard web search-engines. The SilkRoad marketplace was the first modern DWM, launched in 2011. It combined the use of the Torbrowser to communicate and Bitcoin to exchange money, allowing the anonymous online trading ofdrugs and other illegal products. After the FBI shut down Silk Road in 2013, new marketplacesquickly appeared, offering drugs, firearms, credit cards, and fake IDs. These markets also adaptedto further increase the level of privacy and security offered to users,
34, 35 such as the Invisible InternetProject (I2P) and escrow checkout services. As a result, law enforcement agencies have putconsiderable effort into combating them.
17, 39, 40
Furthermore, DWMs have been targets of cybercriminalactors through use of distributed denial-of-service (DDoS) attacks, hacking attempts, and some even shutdown autonomously due to administrators stealing funds from customers directly.
41, 42
However, DWMshave organised into a robust ecosystem which has proven exceptionally resilient to closures and whenevera marketplace is closed, the users trading higher volumes of Bitcoins migrate to active marketplaces orestablish new ones. The resiliency and functioning operations of modern DWMs are possible partially because of numerouswebsites and forums where users can share their experience. One example is Dread, a Reddit-like forumcreated in 2018 after the closure of the dedicated pages on Reddit. Other ad-hoc platforms exist tomonitor whether known marketplaces are active or currently unavailable.
Other mechanisms toenhance the resilience of these marketplaces and build trust towards the marketplace and its vendorsinclude feedbacks and ratings. In most marketplaces, buyers have to leave feedback and a ratingafter a purchase, similarly to what happens on legal online marketplaces. Additionally, marketplaceadministrators often act as vendor moderators by banning vendors or specific categories of products.Examples include DarkBay, where banned categories include human trafficking, contract killing andweapons, or Monopoly marketplace, where COVID-19 fake vaccine listings were recently banned bymoderators. It is hard to estimate how many live dark web marketplaces currently exist. Recent reports includeindependent researcher Gwern, which identified 19 live platforms on April 22, 2020, the website dark-netstats, which registered 10 live “established” marketplaces on May 27, 2020, and the already citedreport which crawled 20 different websites. Currently established marketplaces include Empire, Hydraand White House marketplaces. Data and methods
Dark web marketplaces
The listings used for our study were obtained by web crawling DWMs. Web crawling consists of extractingdata from websites and is performed by specialized software. Web crawling DWMs is a challenging taskbecause crawlers must bypass several protective layers. Most of the DWMs require authentication andsome even require a direct invitation from a current member. Strong CAPTCHAs are implemented toavoid otherwise easy and automated access to the online marketplace. Several research groups tried toovercome these challenges. For instance, the HTTrack software was used in; a combination of PHP ,the cURL library, and
MySQL was proposed in; the python library scrapy was adopted in; andan automated methodology using the AppleScript language was utilized in. There are currently veryfew open source tools available,
52, 56 often leaving companies and federal agencies to rely on commercialsoftware. Downloading content from DWMs remains a challenging task, which becomes even harderwhen the objective of the research study requires monitoring multiple marketplaces for a prolongedperiod of time.Our dataset contains listings crawled by 23 DWMs between January 1, 2020 and July 7, 2020 byFlashpoint Intelligence. The pipeline of crawling consists of entering DWMs and downloading key3 isting TitleListing PriceVendor NameListing BodyShipping Information
Figure 1: Example of a DWM listing. In this screenshot of a chloroquine listing in the DarkBay/Dbaymarketplace, we highlight some of its salient attributes. Among the attributes considered in this workand shown in Table 4, “Time” and “Marketplace name” attributes are not present in this screenshot,while the “Quantity” attribute is not fixed by the vendor.attributes for each active listing, as highlighted in Figure 1. Each DWM was crawled for at least 90different days. We categorized the COVID-19 specific listings into five categories;
PPE , medicines , medical frauds , tests , and ventilators . Only a fraction of the selected listings were actual COVID-19specific listings, since mitigation measures to prevent COVID-19 spreading have also impacted illegaltrades of other listings. For instance, a vendor might sell cocaine and mention shipping delays dueto COVID-19. We included such cases in the category COVID-19 mentions . Categories and relativeexamples of the listings are presented in Table 1. For details about data pre-processing, see Appendix A,where we explain how we select listings related to COVID-19 and how we classify them in categories.We remark that our pre-processing pipeline is biased towards the English language, and this constitutesa limitation of our work.Table 1: Categories used to classify the selected COVID-19 dataset. The first five categories constituteCOVID-19 specific listings, while the last one, called COVID-19 mentions , includes listings mentioningone of the keywords in Table 5 without selling actual COVID-19 specific listings.Category ExamplesPPE gloves, gowns, masks, n95Medicines azithromycin, chloroquine, azithromycin, favipiravir, remdesivirMedical Frauds antidotes, vaccines, allegedly curative recreational drug mixesTests diagnosis, testVentilators medical ventilatorsCOVID-19 mentions computer, drugs, scam (excluding listings in the medical frauds category)Overall, our dataset includes a total of 472,372 unique listings, which can be observed a total of4,088,840 times between January 1, 2020 and July 7, 2020. In Table 2 we report the breakdown of the4umber of unique listings and their total observations in each of the 23 DWMs. In 11 marketplaces (BlackGuns, Cannabay, Darkseid, ElHerbolario, Genesis, Hydra, MEGA Darknet, Rocketr, Selly, SkimmerDevice, and Venus Anonymous) we did not find any mention of COVID-19. This makes sense as thesemarkets are less generalized and primarily focused on specific goods with specific listing text structure.A brief description of each marketplace together with its specialization can be found in Table 7. Inthe remaining 12 marketplaces, there are a total of 4,010 unique listings related to COVID-19, whichconstitutes less than 1% of the entire dataset. These listings were mostly composed of drugs that reporteddiscounts or delays in shipping due to COVID-19. Listings concerning more specific COVID-19 goodssuch as masks , ventilators , and tests were available on seven marketplaces (Connect, DarkBay/DBay,DarkMarket, Empire, CanadaHQ, White House, and Yellow Brick). There were 518 total COVID-19specific listings in this markets which were observed 7,159 times during the analysed time period.Table 2: This table reports the number of days each marketplace was crawled, the number of uniquelistings, all and COVID-19 specific, and the number of listing observations, all and COVID-19 specific.CanadianHQ indicates The Canadian HeadQuarters marketplace.Name marketplace Days Listings Listings Observations Observationscrawled All COVID-19 specific All COVID-19 specificBlack Market Guns 163 18 0 2,934 0CanadaHQ 94 21,853 3 145,202 53Cannabay 119 1,074 0 1,303 0Cannazon 100 2,760 0 4,606 0Connect 179 476 2 13,579 23DarkBay/DBay 127 105,921 421 554,535 6570DarkMarket 92 32,272 19 37,742 20Darkseid 189 8 0 1,512 0ElHerbolario 186 13 0 1,430 0Empire 107 26,010 33 93,163 46Genesis 188 216,792 0 2,174,217 0Hydra 189 297 0 37,665 0MEGA Darknet 135 754 0 1,596 0Plati.Market 189 11,678 0 17,214 0Rocketr 189 460 0 7,843 0Selly 91 462 0 1,523 0Shoppy.gg 189 8,412 0 486,819 0Skimmer Device 189 12 0 2,268 0Tor Market 130 634 0 25,328 0Venus Anonymous 177 84 0 14,644 0White House 96 21,377 5 320,360 118Willhaben 189 14,626 0 45,774 0Yellow Brick 117 6,379 33 97,583 329Total >
90 472,372 518 4,088,840 7,159
We sampled tweets related to COVID-19 using a freely available dataset introduced in Chen et al. Wedownloaded the tweets ID from the public github repository. We then used the provided script to recoverthe original tweets through the python library twarc . We studied the temporal evolution of the numberof tweets mentioning selected keywords, like chloroquine. In line with our dataset of DWM listings, mostof the tweets considered were written in English and the time period considered ranges from January 21,5020 to July 3, 2020.
Wikipedia
We used the publicly available Wikipedia API to collect data about the number of visits at specificpages related with COVID-19, like chloroquine. The Wikipedia search engine was case sensitive and weconsidered strings with the first letter uppercase, while the others lowercase. We looked for the numberWikipedia page visits in the English language from January 1, 2020 to July 7, 2020. Results
We assessed the impact of COVID-19 on online illicit trade along three main criteria. First, we focusedon the 7 marketplaces containing at least one COVID-19 specific listing, analysing their offers in terms ofthe categories
PPE , medicines , medical frauds , tests , and ventilators , as introduced in Table 1. Second,we considered the 12 marketplaces that included at least one listing in one of the categories in Table 1,thus adding listings to the COVID-19 mentions category in our analysis. We investigated the relationshipbetween major COVID-19 events, public attention, and the time evolution of the number of active listings.Third, we quantified the indirect impact that COVID-19 had on all 23 marketplaces under considerationby tracking the percentage of listings mentioning the themes of lockdown, delays and sales. We linkedtheir frequency to major COVID-19 events. Categories of listings
Here, we focus on the 518 COVID-19 specific listings present in our dataset, observed 7,159 times be-tween January 2020 and July 2020.
PPE is the most represented category, with 343 unique listings(66.2% of COVID-19 specific listings) observed 5,536 times (77.3% of observations of COVID-19 specificlistings). The second most represented category is medicines , with 132 (25.5%) unique listings observed1,276 (17.8% of all) times. Some medicines listings, which are often sold together, included 59 chloro-quine listings, 56 hydroxychloroquine listings, and 30 azythromicin listings. Other medicines included 5favipiravir listings, 3 remdesivir listings, and 1 lopinavir listing. A breakdown of the medicines categorytogether with a brief description of the specific drugs can be found in Table 8, and multiple medicinesare sometimes sold in the same listing. We classified 31 (6.0%) unique listings as medical frauds , whichare listings that promised immunity from COVID-19 (no such product exists, at the moment of writing),or supposed devices able to detect COVID-19 in the air. These listings also included illicit drug mixessold as cures. We also registered 10 test (1.9% of COVID-19 specific listings) and 2 ICU ventilator(0.4%) listings. More details on these listings together with some examples are reported in Appendix B.The total number of vendors selling COVID-19 specific listings was 131. Additionally, sellers postedmultiple listings. In fact, 81 of them sold
PPE (61.8%), 54 sold medicines (41.2%), 20 sold medicalfrauds (15.3%), 9 sold tests (6.9%), and 2 sold ventilators (1.5%). The information in this paragraph issummarized in Table 3.It is important to note that vendors often do not provide complete information on their listings butrather invite direct communication. In 403 (77.8%) unique listings, the vendor invited potential customersto communicate via email or messaging applications like WhatsApp, Wickr Me, and Snapchat. Thus,6able 3: Summary statistics for the considered categories of listings. For each category, we includedthe number of unique listings, observations, and vendors. If the same vendor sold listings in differentcategories, we counted it as one unique vendor.Category Unique listings Total observations VendorsPPE 343 (66.2%) 5,536 (77.3%) 81 (61.8%)Medicines 132 (25.5%) 1,276 (17.8%) 54 (41.2%)Medical Frauds 31 (6.0%) 235 (3.3%) 20 (15.3%)Tests 10 (1.9%) 34 (0.5%) 9 (6.9%)Ventilators 2 (0.4%) 78 (1.1%) 2 (1.5%)COVID-19 518 (100%) 7,159 (100%) 131 (100%)478 (92.3%) COVID-19 specific listings contained no information about the offered amount of goods, 408(78.8%) did not provide shipping information, and 13 (2.5%) did not disclose the listing price.The median price of
PPE was 2 USD and they were the least expensive products, followed by medicines with 34 USD, tests with 70 USD, medical frauds with 200 USD, and ventilators with 1,400USD. The distribution of prices for these categories can be found in Figure 2(a), showing that manylistings had a low price around a few USD or less and only few listings exceeded thousands or more USD.The cumulative value of the detected unique listings is 531 ,
413 USD, where we excluded listing withprices larger than 40 ,
000 USD due to manual inspection. When vendors post listings at high price thistypical indicates they have halted sales of an item with the expectation of selling it again in the future.We remove these anomalously high priced listings since they would largely overestimate the sales price ofthe actually active listings. The shipping information declared in the analysed listings involved a totalof 12 countries or regions. Most of the vendors are willing to ship worldwide. Shipping from differentcontinents is possible because some vendors explicitly declare that they have multiple warehouses acrossthe globe, while shipping to any continent is done through specialized delivery services. The UnitedStates is the second largest exporter and shipping destination. Germany is the third largest exporter butno vendors explicitly mentioned it as a shipping destination. Complete shipping information is availablein Figure 2(b). Some examples of the COVID-19 specific listings are available in the Appendix B.1.Figure 3(a) presents a word cloud built from the titles of the selected COVID-19 specific listings. Thewordcloud was built from 1-grams, meaning single words, excluding common English words and stopwords. It illustrates that DWM vendors were particularly aware of the worldwide need of face masksbecause “face mask” were the most used words in the selected COVID-19 specific listings. The COVID-19 pandemic was referred to as either “coronavirus,” “corona,” “covid,” or “covid19.” Interestingly, wedid not find any mention about the word “pandemic” itself. Among COVID-19 medicines , “hydrox-ychloroquine” and “chloroquine” were the most popular ones, with fewer mentions of “azithromycin,”“medicated,” and “medical” products in general.DarkBay/DBay contained the majority of the COVID-19 specific listings in our dataset, amountingto 421 (81.3%). The most available unique listings in DarkBay/DBay were
PPE , which totaled 291. Wealso found 103 medicines , 24 medical frauds , 1 tests , and 2 ventilators . The number of listings availablein the other marketplaces was: 33 in Yellow Brick, 19 in DarkMarket, 2 in Connect, 33 in Empire, 3 inThe Canadian HeadQuarters, and 5 in White House, as shown in Table 2. The entire breakdown of thenumber of COVID-19 specific listings detected in each category is available in Figure 3(b).In Figure 3(c), we ranked the marketplaces for their share of vendors selling COVID-19 specificlistings. The total number of vendors behind COVID-19 specific listings in our dataset is 131. Most7 P E M e d i c i n e s M e d i c a l F r a u d s T e s t s V e n t il a t o r s P r i c e [ U S D ] (a) W o r l d w i d e U n i t e d S t a t e s G e r m a n y U n i t e d K i n gd o m E u r o p e A s i a Sp a i n C h i n a L e s o t h o G e o r g i a A u s t r a li a A u s t r i a Country L i s t i n g s (b) Ships ToShips From
Figure 2: (a) Box plot of the distribution of listing prices for each COVID-19 category. The box rangesfrom the lower to the upper quartile, with the horizontal line indicating the median. The whiskers extendup to the 5 th and 95 th percentiles respectively. The dots represent outliers. (b) Shipping informationin COVID-19 specific listings. Note that 408 (or 78.8%) of these listings did not provide any shippinginformation. D a r k B a y Y e ll o w B r i c k D a r k M a r k e t C o nn e c t E m p i r e C a n a d a H Q W h i t e H o u s e U n i q u e L i s t i n g s (b) PPEMedicinesMedical FraudsTestsVentilators D a r k B a y Y e ll o w B r i c k D a r k M a r k e t C o nn e c t E m p i r e C a n a d a H Q W h i t e H o u s e F r a c t i o n (c) COVID-19 N o n C O V I D - (d)(a) Figure 3: (a) Word cloud for “Listing title” in COVID-19 specific listings. (b) Category breakdown ofCOVID-19 specific listings in the specific marketplace that offered them. (c) Fraction of vendors sellingat least one COVID-19 specific listing. (d) Vendor specialisation. Most vendors responsible for at leastone COVID-19 specific listing also sell other listings, and in greater numbers.vendors sold only one COVID-19 specific listing, while few of them sold more than ten different COVID-89 specific listings. In Appendix D, we analysed the distribution of COVID-19 specific listings for eachvendor. We found that it was heterogeneous according to a power-law with an exponent equal to − . Time evolution of DWM listings and public attention
The number of active unique listings evolved over time, as shown in Figure 4(a). The first COVID-19specific listing in our dataset appeared on January 28, 2020, following the Wuhan lockdown. In March2020, lockdowns in many countries
59, 60 corresponded to an increase in the number of these listings,whose number kept increasing until May 2020. In June and July 2020, when worldwide quarantinerestrictions started to ease, we observed a decreasing trend in the selected COVID-19 specific listings.Figure 4(b) shows the evolution of the total number of observed PPE and medicines , the two mostavailable COVID-19 specific listings in our dataset (see Table 3).
PPE followed a trend compatible withthe overall observations shown in Figure 4(a), with a peak in May 2020 and a decrease afterwards, whileCOVID-19 medicines remained approximately stable from April 2020.The time evolution of the listing prices followed a different pattern. We considered the median priceand its 95% confidence interval of active COVID-19 specific listings in Figure 4(c), and of active
PPE and medicines , in Figure 4(d). Initially, the only COVID-19 specific listings concerned medicines andspecifically azithromycin, already sold on DWMs before the pandemic as an antibiotic. These listingswere not observed in the first part of March.
Medicines reappeared in DWMs the week after the Presidentof the United States Donald Trump first mentioned chloroquine. Their median price was stable for theremaining time period under consideration.
PPE listings appeared for the first time in March 2020. Themedian price of
PPE was high for March and most of April, possibly due to speculation. Interestingly, atthe end of April, a vendor named “optimus,” active on DarkBay, started selling large quantities of
PPE at 1 USD, putting many online listings at the same time, thus drastically reducing the median price,which remained low until July. Overall, “optimus” had 91
PPE listings during the registered period.We also considered tweets and Wikipedia page visits as proxies for public attention. We focused ouranalysis on the
PPE category and on the three most present medicines in our dataset: hydroxychloro-quine, chloroquine and azitrhomycin. Figure 5(a) shows that a first peak in public attention on
PPE was reached in late January 2020 following the Wuhan lockdown and a second peak in March 2020 when PPE listings started to appear in DWMs. The number of
PPE listings reached their maximum inMay 2020. After May,
PPE listings steadily decreased along with public attention. It is worth notingthat May also marked the end of the “first wave” of contagion in many European countries. The lastpeak detected for the number of tweets in the beginning of July might be caused by the introduction ofa new methodology to collect tweets in the freely available dataset we considered. A similar relationship between mass media news, public attention, and DWMs was registered for thelistings regarding the three considered medicines , as shown in Figures 5(b) and (d). Three peaks in publicattention were detected after three declarations from President Trump about these medicines
62, 65, 66 andthe number of active medicines listings closely followed. However, a closer look reveals the different shapesof the Wikipedia page visits, tweets, and DWMs curves. Wikipedia saw a very high peak of page visits9 a n F e b M a r A p r M a y J u n J u l Month (2020)0200400600 A c t i v e L i s t i n g s (a) ItalyWuhan EuropeNYC1M cases 100k USA deaths
COVID-19 specific listingsCOVID-19 mentions J a n F e b M a r A p r M a y J u n J u l Month (2020)0255075100 A c t i v e L i s t i n g s Trump 1Trump 2 Trump 3 (b)
PPEMedicines J a n F e b M a r A p r M a y J u n J u l Month (2020)10 M e d i a n P r i c e [ U S D ] (c) COVID-19 specific listings J a n F e b M a r A p r M a y J u n J u l Month (2020)10 M e d i a n P r i c e [ U S D ] (d) PPEMedicines
Figure 4: Longitudinal analysis of DWM activity. (a) Seven-days rolling average of active listingsmentioning COVID-19 and COVID-19 specific listings. (b) Seven-days rolling average of the observedCOVID-19 specific listings in the medicines and
PPE categories. Dots represent daily observations.Black dashed vertical lines in panels (a) and (b) corresponded to significant COVID-19 world events, seeAppendix C. (c) Seven-days median price with 95% confidence interval for COVID-19 specific listings.(d) Seven-days median price with 95% confidence interval for active COVID-19 specific listings in the
PPE and medicines categories.after the first declaration from President Trump, and smaller peaks in correspondence in the followingdeclarations. Tweets instead saw peaks of attention of increasing height. DWM listings on the contrarywere much steadier in time and with little variation in the number of active listings. J a n F e b M a r A p r M a y J u n J u l Month (2020)10 T w ee t s / P a g e v i e w s ItalyWuhan Europe (a)
PPE
WikipediaTwitter J a n F e b M a r A p r M a y J u n J u l Month (2020)10 T w ee t s / P a g e v i e w s Trump 1Trump 2 Trump 3 (b)
Hydroxychloroquine, Chloroquine and Azithromycin
WikipediaTwitter J a n F e b M a r A p r M a y J u n J u l Month (2020)0 A c t i v e L i s t i n g s (c) ItalyWuhan Europe J a n F e b M a r A p r M a y J u n J u l Month (2020)0 A c t i v e L i s t i n g s (d) Trump 1Trump 2 Trump 3
Figure 5: DWMs and public attention. (a)-(c) Seven-days rolling average of active listings selling
PPE ,together with the time evolution of the number of tweets referring to masks and of visits in the relativeWikipedia page visits. (b)-(d) Similar comparison as in panels (a)-(c) but considering active listings ofhydroxychloroquine, chloroquine, and azithromycin. Black dashed vertical lines in panels (a) and (b)mark significant events related with COVID-19, see Appendix C. See Appendix D for panels (a) and (b)with a linear y-axis. 10 mpact of COVID-19 on other listings
We considered the indirect impact of COVID-19 on all the 23 DWMs in our dataset by looking at listingsmentioning lockdown, using keywords “lockdown” or “quarantine,” delay, using “delay” or “shippingproblem,” and sales, using “sale,” ”discount,” or “special offer.” Examples of listings reporting thesekeywords are available in Appendix B.2.Figure 6(a)-(b)-(c) shows the percentage of listing in time mentioning these themes, considering thefull dataset. The percentage of all listings in the 23 DWMs mentioning lockdown never exceeded 1% andreached its maximum in late April only, when many lockdown measures were adopted,
1, 59, 60 as illustratedin Figure. 6(a). Delay mentions reached their peaks in March, April, and May, after major COVID-19events, such as lockdowns,
59, 60 one million worldwide cases, and the situation in Europe starting toimprove, respectively, as shown in Figure 6(b). A similar pattern was visible for the percentage of alllistings mentioning sales. In addition, we observed that sales had a first peak corresponding to the NewYear, which is a common practice of many in-person legal shops, as displayed in Figure 6(c). Interestingly,despite observing that the increase in the percentage of all listings mentioning sales, delays, and lockdownfollowed major events related to the pandemic, not all of these listings also mentioned COVID-19. Wefurther researched this by plotting which percentage of the relative listings also mentioned COVID-19 inFigure 6(d). The percentage of listings mentioning that the current sales were due to COVID-19 was lessthan 1%, while mentions of delays reached up to 40%. For lockdown it was 100%, as one can expect sincelockdowns exist because of COVID-19. In the three selected cases, the percentages of listings mentioningCOVID-19 increased in time, following the global awareness about the current pandemic. J a n F e b M a r A p r M a y J u n J u l Month (2020)
Italy Europe1M cases (a)
Lockdown J a n F e b M a r A p r M a y J u n J u l Month (2020)
Italy Europe1M cases (b)
Delay J a n F e b M a r A p r M a y J u n J u l Month (2020)
Italy Europe1M cases (c)
Sales J a n F e b M a r A p r M a y J u n J u l Month (2020)
ItalyWuhan EuropeNYC 1M cases 100k USA deaths (d)
LockdownDelaySales
Figure 6: Percentage of all active listings mentioning the themes lockdown, delay and sales in panels(a), (b), (c), respectively. (d) Percentage of active listings in panels (a), (b), (c) that also mentionedCOVID-19 in their listings. Black dashed vertical lines in panels (a), (b), and (c) corresponded to majorCOVID-19 events, see Appendix C. 11 onclusion and discussion
In summary, we investigated the presence of listings related to COVID-19 in 23 DWMs, monitored overa six-month period in 2020. We considered COVID-19 mentions and COVID-19 specific listings, find-ing them in 12 and 7 DWMs, respectively. COVID-19 specific listings totaled 518 and represented lessthan 1% of our dataset. The majority of COVID-19 specific listings offered
PPE (66.2%), followed by medicines (25.5%), medical frauds (6.0%), tests (1.9%), and ventilators (0.4%). Most COVID-19 specificlistings did not report the quantity sold (92.3%) or shipping information (78.8%), and invited potentialcustomers to communicate via email or messaging applications, like WhatsApp (77.8%). Direct com-munication fosters a trustworthy vendor-buyer relationship and may lay the ground for future tradingsoutside DWMs. However, they expose users to higher risks of being traced by law enforcement. In our dataset, DarkBay/DBay is featured prominently among marketplaces offering COVID-19 spe-cific listings. Ranking in the top 100 sites in the entire dark web, DarkBay/DBay is regarded as theeBay of the dark web because it offers more listings categories than other DWMs. It was also frequentlyaccessible during the period of time monitored during this research, with an uptime of 86% during thisperiod, higher from the 77% uptime of Empire, the largest marketplace at the time of writing Our work corroborates previous findings and expands on them in several ways. The most extensivereport to date, to the best of our knowledge, examined the presence of COVID-19 specific listings in 20DWMs on one single day (April 3, 2020). Despite a small subset of overlapping marketplaces betweenthat report and our study, (DarkBay/DBay, DarkMarket, Empire, White House, and Yellow Brick) weboth assessed that COVID-19 specific listings constituted less than 1% of the total listings in the DWMecosystem. These listings were mostly
PPE , followed by medicines and they were found in only a fewDWMs, while non COVID-19 specific listings were widespread.An important novelty of the present study, compared to the existing literature, is the analysis of thetemporal evolution of DWM behaviour and its relationship to public attention, as quantified throughtweets and Wikipedia page visits. Following the Wuhan lockdown, we observed a first peak in thepublic attention, and a corresponding emergence of the COVID-19 specific listings. A second peak inpublic attention occurred in March 2020, when quarantine measures were adopted by many Europeancountries.
59, 60
Again, during the same period, the number of COVID-19 specific listings sharply in-creased. Finally, when worldwide quarantine began to easy in many countries, in June and July 2020,we registered a decrease in public attention and in available COVID-19 specific listings.Listing prices correlated with both variations in public attention and individual choices of a fewvendors. Median price experienced a sharp increase in March 2020, probably due to speculation, andthen decreased in April due to the choice of a single vendor responsible for 91 listings, named “optimus.”The vendor sold a large quantity of PPE at 1 USD only, which constituted the 37% of active
PPE listings in April 2020. Finally, we observed an increase in the percentage of all listings citing delays inshipping and sale offers, which peaked in March, April, and May 2020. Similar to a prior work that foundWikipedia page visits of a given drug to be a good predictor for its demand in DWMs, we providefurther evidence that the DWM ecosystem is embedded in our society and behaves organically to socialchanges. The DWM ecosystem swiftly reacted to the pandemic by offering goods in high demand, andeven tried to fulfill desires through evident scams, for example by offering vaccines already in March2020, when no tested vaccination existed.Our research shares some limitations with previous studies, namely that not all active DWMs were12urveyed. For instance, we did not analyse 15 of the marketplaces explored in the previous report. Itmust be noted, however, that the number of active marketplaces is constantly changing due to closures ornew openings; and obtaining full coverage is challenging due to the active efforts of DMWs to obstructresearch studies and law enforcement investigations, for example through the use of CAPTCHAs.By revealing that DWMs listings of goods related to COVID-19 exist and that they are correlatedwith public attention, we highlight the need for a close monitoring of the online shadow economy in thefuture months. For example, we expect that initial delays in the availability of a cure and/or vaccinewould dramatically increase public interest for the online shadow economy, posing concrete risks topublic health. We plan to improve our analysis of DWM activity by increasing the number of monitoredDWMs and conducting a more extensive analysis of the impact on the pandemic on overall DWM tradeby considering changes in prices of non-COVID-19 specific listings, such as drugs, weapons or malware.We anticipate that our results and future work will help inform the efforts of public agencies focused onprotecting consumer rights and health. Competing interests
The authors declare that they have no competing interests.
Author’s contributions
A.Ba., A.T. and A.G. conceived of the project. A.Ba. coordinated the project. All authors designed theresearch. M.A. and I.G. provided the data. A.Br., M.N., M.A. and I.G. preprocessed and analysed thedata. All authors analysed the results. A.Br., M.N., and A.Ba. wrote the manuscript. All authors readand commented on the manuscript.
Acknowledgements
A.Br., M.N., A.T., A.G and A.Ba. were supported by ESRC as part of UK Research and Innovationsrapid response to COVID-19, through grant ES/V00400X/1. M.A and D.M., acknowledge support fromthe U.S. National Science Foundation grant 1717062.
Correspondence
Correspondence and requests for materials should be addressed toAndrea Baronchelli: [email protected].
References [1] Derrick Bryson Taylor. A timeline of the coronavirus pandemic.
Accessed August 2, 2020, 2020. The New York Times.132] WHO. Coronavirus disease (COVID-2019) situation reports.
Accessed August 2, 2020, 2020. WorldHealth Organization.[3] Moritz UG Kraemer, Chia-Hung Yang, Bernardo Gutierrez, Chieh-Hsi Wu, Brennan Klein, David MPigott, Louis Du Plessis, Nuno R Faria, Ruoran Li, William P Hanage, et al. The effect of humanmobility and control measures on the COVID-19 epidemic in china.
Science , 368(6490):493–497,2020.[4] Nuno Fernandes. Economic effects of coronavirus outbreak (COVID-19) on the world economy.
Available at SSRN 3557504 , 2020.[5] Rabah Arezki and Ha Nguyen. 4 novel coronavirus hurts the middle east and north africa throughmany channels.
Economics in the Time of COVID-19 , page 53, 2020.[6] Markets energy.
Accessed August 2, 2020, 2020. Bloomberg.[7] Abby Narishkin and Steve Cameron. Why toilet-paper demand spiked 845%, and how companieskept up with it.
Accessed August 2, 2020, 2020.[8] Anna Medaris Miller. The Wuhan coronavirus has led to a face mask shortage, with sellersnow of-fering masks at up to $7 apiece.
Accessed August 2, 2020, 2020. Business In-sider.[9] Kazuki Sakuma. Woman reported to prosecutors for alcohol disinfectant at double price in japan. https://mainichi.jp/english/articles/20200701/p2a/00m/0na/012000c
Accessed August 2,2020, 2020. The Mainichi.[10] Rik Chakraborti and Gavin Roberts. Anti-price gouging laws, shortages, and covid-19: Big datainsights from consumer searches.[11] GIATOC. CovidCrimeWatch: crime and contagion: the impact of a pandemic on organizedcrime. https://globalinitiative.net/crime-contagion-impact-covid-crime/
Accessed Au-gust 2, 2020, 2020.[12] Europol and EMCDDA. EU drug markets impact of COVID-19.
Accessed August 2, 2020, 2020.[13] Roger Dingledine, Nick Mathewson, and Paul Syverson. Tor: the second-generation onion router.Technical report, Naval Research Lab Washington DC, 2004.[14] Gwern. Darknet market mortality risks.
Accessed August2, 2020, 2019.[15] Satoshi Nakamoto. Bitcoin: a peer-to-peer electronic cash system. Technical report, Manubot, 2008.[16] Nicolas Christin. Traveling the Silk Road: a measurement analysis of a large anonymous onlinemarketplace. In
Proceedings of the 22nd international conference on World Wide Web , pages 213–224, 2013. 1417] Gerard E. Lynch. United States of America : Vs. Ross William Ulbricht. https://caselaw.findlaw.com/us-2nd-circuit/1862572.html
Accessed August 2, 2020, 2017. United States Courtof Appeals.[18] Kyle Soska and Nicolas Christin. Measuring the longitudinal evolution of the online anonymousmarketplace ecosystem. In { USENIX } security symposium ( { USENIX } security 15) , pages33–48, 2015.[19] Abeer ElBahrawy, Laura Alessandretti, Leonid Rusnac, Daniel Goldsmith, Alexander Teytelboym,and Andrea Baronchelli. Collective dynamics of dark web marketplaces. ArXiv:1911.09536 , 2019.[20] WHO. Coronavirus disease (covid-19) advice for the public: when and how to usemasks.
Accessed August 2, 2020, 2020. World Health Organiza-tion.[21] Coronavirus disease 2019 (covid-19): Emerging treatments. https://bestpractice.bmj.com/topics/en-gb/3000168/emergingtxs
Accessed August 2, 2020, 2020.[22] Emily Chen, Kristina Lerman, and Emilio Ferrara. Tracking social media discourse about theCOVID-19 pandemic: development of a public coronavirus Twitter data set.
JMIR Public Healthand Surveillance , 6(2):e19273, 2020.[23] Wikipedia. Wikimedia REST API. https://wikimedia.org/api/rest_v1/
Accessed August 2,2020, 2020.[24] Roderic Broadhurst, Matthew Ball, and Chuxuan Jiang. Availability of COVID-19 related productson Tor darknet markets.
Australian Institute of Criminology , April 2020.[25] John Markoff.
What the dormouse said: how the sixties counterculture shaped the personal computerindustry . Penguin, New York, USA, 2005.[26] Tim Berners-Lee, Robert Cailliau, Ari Luotonen, Henrik Frystyk Nielsen, and Arthur Secret. Theworld-wide web.
Communications of the ACM , 37(8):76–82, 1994.[27] Mike Power. Drugs 2.0: the web revolution that’s changing how the world gets high.
Accessed August2, 2020, 2013. The Guardian.[28] Kim Zetter. 8 suspects arrested in online drug market sting.
Accessed August 2, 2020, 2012. Wired.[29] Monica J Barratt. Discussing illicit drugs in public internet forums: visibility, stigma, andpseudonymity. In
Proceedings of the 5th International Conference on Communities and Technologies ,pages 159–168, 2011.[30] James Martin.
Drugs on the dark net: how cryptomarkets are transforming the global trade in illicitdrugs . Springer, London, UK, 2014.[31] Monica J Barratt, Jason A Ferris, and Adam R Winstock. Use of Silk Road, the online drugmarketplace, in the United Kingdom, Australia and the United States.
Addiction , 109(5):774–783,2014. 1532] James Martin. Lost on the Silk Road: online drug distribution and the cryptomarket.
Criminology& Criminal Justice , 14(3):351–367, 2014.[33] Judith Aldridge and David D´ecary-H´etu. Not an Ebay for drugs: the cryptomarket Silk Road as aparadigm shifting criminal innovation.
Available at SSRN 2436643 , 2014.[34] Marie Claire Van Hout and Tim Bingham. Silk Road, the virtual drug marketplace: a single casestudy of user experiences.
International Journal of Drug Policy , 24(5):385–391, 2013.[35] Marie Claire Van Hout and Tim Bingham. Responsible vendors, intelligent consumers: Silk Road,the online revolution in drug trading.
International Journal of Drug Policy , 25(2):183–189, 2014.[36] Bassam Zantout, Ramzi Haraty, et al. I2p data communication system. In
Proceedings of ICN ,pages 401–409. Citeseer, 2011.[37] Frank Wehinger. The dark net: self-regulation dynamics of illegal online markets for identities andrelated services. In , pages 209–213.IEEE, 2011.[38] Nicolas Christin. An eu-focused analysis of drug supply on the alphabay marketplace.
EMCDDAcommissioned paper. , 2017.[39] Ionut Ilascu. Dark webs wall street market and valhalla seized, six arrested.
Accessed August 2, 2020, 2019. Bleeping Computer.[40] Darknet takedown: authorities shutter online criminal market AlphaBay.
Accessed August 2, 2020, 2017. FBI.[41] Grey market unsurprisingly exit scammed. https://darknetlive.com/post/grey-market-unsurprisingly-exit-scammed/
Accessed August 2, 2020, 2019. DarknetLive.[42] Bitbazaar is exit scamming. https://darknetlive.com/post/bitbazaar-is-exit-scamming/
Accessed August 2, 2020, 2019. DarknetLive.[43] Dread forum. https://onion.live/site/dread-forum
Accessed via Tor browser August 2, 2020,2020.[44] Kyle Porter. Analyzing the darknetmarkets subreddit for evolutions of tools and trends using ldatopic modeling.
Digital Investigation , 26:S87 – S97, 2018.[45] Onion.live. https://onion.live/page/about
Accessed via Tor browser August 2, 2020, 2020.[46] Darknetlive. https://darknetlive.com/
Accessed August 2, 2020, 2020.[47] Dark.fail. https://dark.fail/
Accessed August 2, 2020, 2020.[48] Dnstats. https://dnstats.net/
Accessed August 2, 2020, 2020.[49] Anthony Cuthbertson. Coronavirus: dark web market bans drug dealers selling fake covid-19 vac-cines.
Accessed August 2, 2020,2020. Independent. 1650] Gwern. Updated: list of dark net markets (tor & i2p).
Accessed August 2, 2020, 2020.[51] Dark net markets comparison chart.
Accessed August 2, 2020, 2020.[52] Matthew Ball, Roderic Broadhurst, Alexander Niven, and Harshit Trivedi. Data capture and anal-ysis of darknet markets.
Available at SSRN 3344936 , 2019.[53] Andres Baravalle, Mauro Sanchez Lopez, and Sin Wee Lee. Mining the dark web: drugs and fakeids. In , pages350–356. IEEE, 2016.[54] Alessandro Celestini, Gianluigi Me, and Mara Mignone. Tor marketplaces exploratory data analysis:the drugs case. In
International Conference on Global Security, Safety, and Sustainability , pages218–229. Springer, 2017.[55] Darren R Hayes, Francesco Cappa, and James Cardon. A framework for more effective dark webmarketplace investigations.
Information , 9(8):186, 2018.[56] D D´ecary-H´etu and J Aldridge. Datacrypto: the dark net crawler and scraper.
Software Program ,2013.[57] X-byte enterprise crawling.
Ac-cessed August 2, 2020.[58] Flashpoint Intelligence.
Accessed August 2, 2020, 2020.[59] Jason Horowitz and Emma Bubola. On day 1 of lockdown, italian officials urge citizens to abide byrules.
Accessed August 2, 2020, 2020. The New York Times.[60] Mark Landler and Stephen Castle. Britain locks down to stem the coronavirus. more orless.
Accessed August 2, 2020, 2020. The New York Times.[61] Marc Santora. The world reopens, despite skyrocketing coronavirus cases.
Accessed August 2, 2020, 2020. The NewYork Times.[62] Remarks by president trump, vice president pence, and members of the coronavirus task forcein press briefing.
Ac-cessed August 2, 2020, 2020. White House.[63] Riccardo Gallotti, Francesco Valle, Nicola Castaldo, Pierluigi Sacco, and Manlio De Domenico.Assessing the risks of “infodemics” in response to COVID-19 epidemics.
ArXiv:2004.03997 , 2020.[64] Covid-19: Europe sees hope in decline in new infections.
Accessed Au-gust 2, 2020, 2020. AA. 1765] Ignoring expert opinion, trump again promotes use of hydroxychloroquine.
Accessed Au-gust 2, 2020, 2020. The New York Times.[66] Trump is taking hydroxychloroquine, white house confirms.
Accessed August 2,2020, 2020. Guardian.[67] Coronavirus: confirmed global cases pass one million.
Accessed August 2, 2020, 2020. BBC.[68] Chinmayi Arun. On whatsapp, rumours, and lynchings.
Economic & Political Weekly , 54(6):30–35,2019.[69] Onion.live: Darkbay’s trust report. https://onion.live/reports/2005451?page=1
Accessed viaTor browser August 2, 2020, 2020.[70] Dnstats: Darkbay. https://dnstats.net/site/darkbay
Accessed August 2, 2020, 2020.[71] Comparison uptime dark markets. https://dnstats.net/markets/1
Accessed August 2, 2020,2020.[72] Sam Miller, Abeer El-Bahrawy, Martin Dittus, Mark Graham, and Joss Wright. Predicting drug de-mand with wikipedia views: evidence from darknet markets. In
Proceedings of The Web Conference2020 , pages 2669–2675, 2020.[73] Angus Bancroft.
The darknet and smarter crime: methods for investigating criminal entrepreneursand the illicit drug economy . Springer Nature, Cham, Switzerland, 2019.[74] Emcdda special report: Covid-19 and drugs drug supply via darknet markets.
Accessed August 2, 2020, 2020. European Monitoring Centre for Drugs andDrug Addiction (EMCDDA).[75] Duckling open-source library. https://github.com/facebook/duckling
Accessed August 2, 2020,2018.[76] Cryptocompare api. https://min-api.cryptocompare.com/
Accessed August 2, 2020, 2020.[77] Foreign exchange rates api with currency conversion. https://exchangeratesapi.io
AccessedAugust 2, 2020, 2019.[78] New york has 5% of covid-19 cases worldwide as city becomes battlefront.
Ac-cessed August 2, 2020, 2020. Guardian.[79] United states coronavirus (covid-19) death toll surpasses 100,000.
Accessed August 2, 2020, 2020. CDC.18 he COVID-19 online shadow economyContents
A Data pre-processing 20B Examples of listings related with COVID-19 in dark web marketplaces 21
B.1 COVID-19 specific listings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21B.2 COVID-19 mentions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
C Timeline of the COVID-19 pandemic 22D Supplementary material 23
Data pre-processing
In the following, we describe the DWMs dataset in more details, by focusing on how listings were storedand how we formed the COVID-19 categories in table 1, that is,
PPE , medicines , medical frauds , tests , ventilators , and COVID-19 mentions .Table 4: Selected attributes of the listings under consideration along with a brief explanation of theirrespective purposes.Attribute of a listing Explanation“Listing body” Description of the listing as it appears in the DWM“Listing title” Title of the listing as it appears in the DWM“Marketplace name” Name of the DWM“Shipping information” Where the listing is declared to ship from and to“Time” When the listing is observed“Quantity” Quantity of the listing sold“Price” Price of listing“Vendor” Unique identifier of the vendorThe listings appearing on the DWMs were crawled and stored according to selected attributes. Whilea brief explanation of these attributes is already presented in table 4, here we focus on those attributeswhich involved some pre-processing before the analysis, that is, “Shipping information,” “Quantity,”and “Price.” The “Shipping information” attribute was initially stored considering what the vendordeclared. Then, it was standardised among vendors to correct any misspellings, using the standardpython library pycountry . Vendors may declare a specific country, like United States, a continent, likeEurope, or the entire world, which we standardise here as worldwide. The “Quantity” attribute wasinstead retrieved from the title of the listing using Facebook open-source library Duckling , then it wasmanually checked and corrected during an annotation process. The “Price” attribute on DWMs wasdisplayed in the listings in various currencies, such as cryptocurrencies and fiat currencies. In order tostandardise and properly compare listing prices, we converted prices to USD at the daily conversion rate.Rates were taken from Cryptocompare for cryptocurrencies, and from the European Central Bank for fiat currencies.The attributes “Listing body” and “Listing title” in table 4, representing the title and descriptionof the listings, were used to select the COVID-19 categories in table 1. To this end, we prepared twosets of keywords as shown in T table 5. Every selected COVID-19 listing contained either a word in the“Listing body” that matched one keyword in the first set or a word in the “Listing title” that matchedone keyword in the second set. The rationale behind this choice was that the listing title was usually moreprecise on the product sold, whereas the body might contain promotions of other items the vendor wasselling in other listings. At the same time, the vendor might mention COVID-19 in the body for variousreasons, which we analysed in the main text. In order to classify listings in either COVID-19 specificlistings (that is, PPE , medicines , medical frauds , tests , ventilators ) or COVID-19 mentions , we ran aregex query in google bigquery . We remark that the chosen method returned words containing a stringequal to one of our keywords. For instance, with the keyword chloroquin, we detected also chloroquineand hydroxychloroquine. After this automatic filtering step, we manually checked the selected COVID-19 related listings to further improve the accuracy of our sample. In order to minimize human error, atleast two authors of the present manuscript checked each of these listings. A limitation of our approachwas that keywords considered were in English. Therefore, even if drug names such as chloroquine were20ommon to many languages and we detected some listings in a non-English language, our sample ofCOVID-19 related listings was biased toward the English language.Table 5: Keywords used to sample COVID-19 specific listings from the DWMs in table 2.First set of keywords checked against the words included in the attribute “Listing body” in table 4corona virus, coronavirus, covid, covid-19, covid19Second set of keywords checked against the words included in the attribute “Listing title” in table 4anakinra, antidote, antiviral, azithromycin, baloxavir, baricitinib, bemcentinib, chloroquin,corona virus, coronavirus, covid, covid-19, covid19, darunavir, dexamethason, diagnosis,diagnostic, favipiravir, ganciclovir, glove, gown, lopinavir, marboxil, mask, n95, n99,oseltamivir, prevention, remdesivir, repurposed, ribavirin, ritonavir, sanitiser,sanitizer, sarilumab, siltuximab, surgical, thermo scanner, thermo-scanner,thermometr, thermoscanner, tocilizumab, umifenovir, vaccine, ventilatorWhile each listing had an associated url to determine its uniqueness, which allowed us to track listingover time, vendors receiving bad reviews sometimes put identical copies of the same listing online. Toovercome this issue and correctly count the number of listings, we determined a listing as unique if it hadthe combination of “Listing body,” “Listing title,” “Marketplace name,” and “Vendor” different thanany other listings. For instance, if two listings had the same title and body but were sold in two differentmarketplaces, we considered them as two different listings. Also, we considered at most one observationfor each unique listing per day. The total number of unique listings and observations of these listings ineach DWM is available in table 2. B Examples of listings related with COVID-19 in dark webmarketplaces
Here, we present detailed examples of the selected listings. We consider both COVID-19 specific listingsand COVID-19 mentions . B.1 COVID-19 specific listings
The most popular category of COVID-19 specific listings was
PPE , which included mainly face masks.We detected that 91% of listings did not specify the amount of masks sold. Within those who declaredthe amount sold, we found listings selling small quantities of masks, like “KN95 Face Mask for CoronaVirus box of 50” priced at 50 USD, while others proposed wholesale deals, as in “AFFORDABLE 20BOXS OF SURGICAL FACE MASK (WHOLESALE PRICE)” in which 5000 masks were available at2 ,
000 USD.The second most popular COVID-19 category was medicines , composed mostly by chloroquine, hy-droxychloroquine, and azythromicin. Like
PPE , 84% of the times vendors did not specify the quantitysold. When they did, it usually was for wholesale deals, as in “9000 tabs hydroxychloroquine 200mg(USA AND CANADA ONLY)“ where 9,000 tabs were sold for 1,194 USD. The smallest quantity wedetected was 50 pills “chloroquine 50pills for 250$,” sold at 250 USD. We also noticed that vendorsoften specified the size of the pill, being it 200mg, 250mg, or 500mg. The azythromicin was usually soldtogether with hydroxychloroquine as a prescription against COVID-19. One example of it was “hydrox-21chloroquine sulfate 200mg and azithromycin 250mg,” where an unknown quantity of these drugs wassold for 40 USD.In the COVID-19 category of medical frauds , the most prominent listings were vaccines. Despite at themoment of writing of this manuscript (July 2020), vaccines are far from being actually developed, theywere sold in DWMs since March 2020. These listings included both low price vaccines like “completeorder free shipment COVID19 VACCINE,” sold at just 200 USD, or high price one like “Covid-19Vaccine. Lets keep it low key for now,” priced at 15 ,
000 USD. In addition, among the listings in the medical frauds category, one could find potentially dangerous illicit drug mixes with claimed curativepower against COVID-19, like “Protect yourself from the corona virus:” a marijuana based drug mixsupposedly helpful in recovery from coronavirus infection. Other medical frauds included a 300 USD“CORONAVIRUS DETECtOR DEVICE, SAVE LIVES NOW” or a 1 ,
000 USD “Buy CORONAVIRUSTHERMO METER.”
Tests for COVID-19 were also moderately present in DWMs during the pandemic. We detectedlistings in the tests category both at low quantities, such as, “25 pcs COVID-19 (coronavirus) quicktest,” sold for 430 USD, or at very large one, like “Corona Virus Test / Covid-19 Test Kits ( 5000Pcs),”for a price of 7,500 USD.The two listings in the ventilator category were ICU ventilators. They were advertising fundamentalhospital instrument, such as, “ICU Respiratory Ventilators , Emergency Room Vents” sold at 800 USDor “BiPAP oxygen concentrator ventilato Amid Covid-19” for 2 ,
000 USD.
B.2 COVID-19 mentions
We describe three examples of listings in the COVID-19 mentions category. The listing with title“Best Organic Virginia Bright Tobacco Premium quality 600g” refers to the lockdown in its body as“unfortunately we have to respect coronavirus lockdowns, in order to ensure as much security as possible,we had to choose one type of shiping that is unfortunately much more expensive while lockdowns last.”Another listing with title “(Out of Stock! Lower Price for Pre-orders Only) Testosterone Enanthate250mg/ml - 10ml - Buy 4 Get 1,” mentions in the body that they “are currently out of stock of thisproduct due to our oil suppliers not being able to get their raw powders shipped to them because of theCoronavirus” and they “have lowered the price a little to help make up for this delay.” A third listingmention a sale directly in the title “COVID-19 SPECIAL OFFER 1GR CROWN BOLIVIAN COCAINE90% 65,” and link the discount with the distress caused by the pandemic.
C Timeline of the COVID-19 pandemic
In this Section we aim at providing a summary of the main events related to the pandemic, focusing onthe ones cited in the main text and listed in table 6. This is by no means a complete summary of theCOVID-19 pandemic timeline.The first event to gain international attention and make the public aware of the coronavirus was thedecision from China to lockdown the city of Wuhan, first epicenter of the pandemic, on the January23 2020. The virus then found its way to Europe, where the first country to be heavily hit by thepandemic was Italy. The Italian government decided to lockdown the entire country on March 9 2020. The virus rapidly spread in Europe and internationally, with cases appearing more and more in the22nited States, leading USA’s President Donald Trump to first take a stance on the possibility of usingchloroquine to cure individuals infected from COVID on the March 18 2020. The epidemic started toheavily hit the United States, with New York City declaring the lockdown on March 22 2020, and thecases were surging almost everywhere in the world: 70 days after the lockdown of Wuhan, the worldwidecount of infections had already surpassed 1 Million cases on April 3 2020. At that point, PresidentTrump explicitly promoted the use of hydroxychloroquine on April 5 2020, before any official medicaltrial ended. In April the situation started to become asymmetric. In Europe, thanks to the manypolicies in place, the COVID-19 became less threatening and lockdowns started to be eased. USAand other countries were instead seeing a rise in cases. President Trump declared he was now takingHydroxychloroquine preventively against COVID-19 on May 18 2020 and the USA were the first toregister 100 ,
000 deaths on May 27 2020. During June 2020, Europe has maintained COVID-19 undercontrol, while the USA is having a second wave in cases related with COVID-19.Table 6: Significant COVID-19 events. We defined an acronym for each event and reported it in themain text plots. Please note that this list does not intend to be exhaustive or to establish a rankingbetween events.Date Event Acronym2020-1-23 Wuhan Lockdown Wuhan2020-3-9 Italy Lockdown Italy2020-3-18 USA’s President Trump first refers to chloroquine Trump 12020-3-22 New York City Lockdown NYC2020-4-3 1M COVID-19 cases worldwide
1M cases2020-4-5 USA’s President Trump promotes the use of Trump 2chloroquine and hydroxychloroquine against COVID-19 Europe2020-5-18 USA’s President Trump declares he is taking Trump 3hydroxychloroquine preventively against COVID-19 D Supplementary material
In this Section we provide additional material that support our main findings. In table 7 we providemore details on the 23 dark web marketplaces considered in our study. In particular we indicate the mainspecialization of the markets, i.e., the main category of products sold. If it is “Mixed”, it means thatthe marketplace is not specialised in any particular category of goods. In the description we instead putinformation on the markets, with more details where available. All this information has been researchedand compiled by the authors, with particular help given by Flashpoint Intelligence. In table 8 we provide a table reporting the different COVID-19 related medicines which were foundin the listings. The medicines were selected as they have been found or claimed to be effective againstCOVID-19. The number of listings related to each medicine is also reported, noting that some listingssell more than one medicine (e.g. listings selling both hydroxychloroquine and azitrhomycin).In figure 7 we plot the distribution of listings per vendor in log-log plot, showing a clear power-lawshape with exponent -2.0. In the inset of figure 7, we show the histogram using linear spacing, throughwhich we understand that most vendors sold very few COVID-19 specific listings, while few vendorsgoing as high as 91 different listings. We noted that 80% of the vendors had indeed less or equal than 5listings. 23n order to complement figure 5(a) and (b) in the main text and properly show the peaks of Wikipediapage visits and tweets, we create figure 8. The new representation of figure 5 does not modify the claimsmade in the main text and how major event related with COVID-19 impacted public attention.Table 7: List of all dark web marketplaces, together with their specialization and a brief description.DWM Specialization DescriptionBlack Market Guns Weapons Weapons Marketplace, now exit scammedaccording to onion.live CanadaHQ Mixed Multivendor cryptocurrency marketplaceCannabay Drugs Russian language drug marketplacefocusing on cannabisCannazon Drugs (Cannabis) Drug marketplace for cannabis products onlyConnect Mixed A social network that hosts a marketplacefor the sale of illicit goodsDarkBay/DBay Mixed Multivendor cryptocurrency marketplace sellingdigital goods, drugs, and servicesDark Market Mixed Multivendor cryptocurrency marketplace sellingdigital goods, drugs, and servicesDarkseid Weapons Weapons marketplaceElHerbolario Drugs Single-vendor shop, selling just 3 products,primarily leaning towards CannabisEmpire Mixed Alphabay-style marketplace with BTC, LTC, XMR,MultiSig, and PGP 2FAGenesis Digital goods Marketplace selling digital identities for accounttakeover activitiesHydra Drugs Russian language drug marketplaceMEGA Darknet Mixed Russian language marketplacePlati.Market Digital goods digital goods marketplaceRocketr Digital goods Marketplace for the sale of illicit digital goodsSelly Digital goods Marketplace for the sale of illicit digital goodsShoppy.gg Digital goods Marketplace for the sale of illicit digital goodsSkimmer Device Skimmer devices Marketplace selling skimmer devicesTor Market Drugs Drug-focused marketplace focused on supplyingthe drug marketplace in New ZealandVenus Anonymous Mixed Multivendor marketplace sellingdigital goods and drugsWhite House Mixed Multivendor cryptocurrency marketplaceWilhaben Mixed German language marketplace for the saleof illicit goodsYellow Brick Mixed Multivendor cryptocurrency marketplace24able 8: COVID-19 related medicines appearing in the listings, together with a brief description and thenumber of listings related to that drug.Medicine Description ListingsChloroquine Malaria medication 59Hydroxychloroquine Malaria medication 56Azitrhomycin Antibiotic often paired with hydroxychloroquine 30Favipiravir Antiviral medication used to treat influenza 5Remdesivir Antiviral medication 3Lopiravir Antiviral medication used to treat HIV 1 Listings P d f = 2.0 Listings V e n d o r s th Percentile
Figure 7: Probability distribution function (Pdf) for the number of listings per vendor. The power lawfit results in an exponent of -2.0. In inset, the histogram of the number of listings per vendor, with avertical line showing the 80 th percentile. 25 a n F e b M a r A p r M a y J u n J u l Month (2020)050001000015000 P a g e V i e w s ItalyWuhan Europe (a)
PPE J a n F e b M a r A p r M a y J u n J u l Month (2020)0100000200000300000 P a g e V i e w s Trump 1Trump 2 Trump 3 (b)
Hydroxychloroquine, Chloroquine and Azithromycin J a n F e b M a r A p r M a y J u n J u l Month (2020)0100002000030000 T w ee t s (c) ItalyWuhan Europe J a n F e b M a r A p r M a y J u n J u l Month (2020)01000020000 T w ee t s (d) Trump 1Trump 2 Trump 3
Figure 8: Wikipedia page visits for pages relative to (a)
PPE , (b) hydroxychloroquine, chloroquineand azitrhomycin. Number of tweets mentioning (c)