Dark Web Marketplaces and COVID-19: After the vaccines
Alberto Bracci, Matthieu Nadini, Maxwell Aliapoulios, Damon McCoy, Ian Gray, Alexander Teytelboym, Angela Gallo, Andrea Baronchelli
DDark Web Marketplaces and COVID-19:The vaccines
Alberto Bracci , Matthieu Nadini , Maxwell Aliapoulios , Damon McCoy , IanGray , Alexander Teytelboym , Angela Gallo , and Andrea Baronchelli City, University of London, Department of Mathematics, London EC1V 0HB, UK The Alan Turing Institute, British Library, 96 Euston Road, London NW12DB, UK Center for Cybersecurity (CCS), New York Univ. Tandon School of Engineering, Brooklyn, NY 11201, USA Global Intelligence Team, Flashpoint. New York, NY 10003, USA Institute for New Economic Thinking, Oxford Martin School, University of Oxford, Oxford OX2 6ED, UK Department of Economics, University of Oxford, Oxford OX1 3UQ, UK Department of Finance, Cass Business School, London EC1Y 8TZ, UK UCL Centre for Blockchain Technologies, University College London, UK + Contributed equally * Corresponding author: [email protected]
Abstract
The ongoing COVID-19 vaccination campaign has so far targeted less than 3% of the world pop-ulation, and even in countries where the campaign has started many citizens will not receive theirdoses for many months. There is clear evidence that previous shortages of COVID-19 related goods(e.g., masks and COVID-19 tests) and services pushed customers, and vendors, towards illicit onlinetrade occurring on dark web marketplaces.
Is this happening also with vaccines? Here, we reporton our effort to continuously monitor 102 dark web marketplaces. By February 26, we found 33 list-ings offering a COVID-19 vaccine, seven of which offering officially approved vaccines. The numberof currently active listings is 11, including one listing selling the Pfizer/BioNTech vaccine, one listingthe AstraZeneca/Oxford vaccine, and 9 listings selling vaccines of unspecified type. Illicit trade ofuncertified COVID-19 vaccines poses a concrete threat to public health and risks to undermine publicconfidence towards vaccination.Keywords: Vaccine, COVID-19, Dark markets, Illicit products, Shadow economy, Bitcoin
Version 2. Date: Feb 26, 2021.
Introduction
COVID-19 officially became a threat to the global public health on March 11, 2020, when it was declareda pandemic by the World Health Organization. Restrictions, such as social distancing, quarantine, andtravel bans, have only partially contained the COVID-19 pandemic, which has now infected more than100 million people and caused over 2 million deaths worldwide. Several pharmaceutical companies anduniversities have been researching a COVID-19 vaccine at unprecedented speed. More than 200 possible1 a r X i v : . [ c s . C Y ] M a r OVID-19 vaccines have been proposed, with only a few currently approved and several others in latetesting phases. Russia was the first country in the world to approve a vaccine against the virus thatcauses COVID-19 on August 11, 2020. Its Sputnik V vaccine started to be available in other countriesmuch later, for instance Argentina began the vaccination campaign with this vaccine on December 29,2020. Pfizer/BioNTech was the first international pharmaceutical company to have its vaccine approvedin several countries: in the UK on December 2, 2020, in the USA on December 12, 2020, and in theEuropean Union on December 21, 2020. At the moment of writing, the availability of COVID-19 vaccines remains limited and less than 3%of the worldwide population has received the vaccine. Shortages of COVID-19 related products inthe regular economy, like masks, have encouraged customers to purchase products through illicit onlinechannels.
12, 13
A similar transition to the shadow economy is likely to happen with shortages of COVID-19 vaccines, according to reports by Interpol and Europol. Citizens currently waiting to get theirdoses may be willing to illicitly purchase them online. Also, according to a global survey, only 70%of the population is willing to take the COVID-19 vaccine; the remaining portion may decide to buy afabricated proof of vaccination to avoid taking the vaccine shot, as already happened with falsified testresults, with airlines encouraging governments to allow proofs of vaccination to become a way to safelytravel.
19, 20
Dark web marketplaces (DWMs) can be accessed via specialized browsers, like Tor and offer avariety of illicit goods including drugs, firearms, credit cards, and fake IDs. DWMs immediately drewthe attention of thousands of buyers and sellers, with a trading volume that rapidly reached hundredsmillions United States dollars (USD) per year.
23, 24
The growing popularity of DWMs has attracted theinterest of the scientific community, security researchers, and law enforcement agencies. The scientificcommunity has explored the behaviour of DWMs users through comparative analyses and casestudies.
Law enforcement agencies have successfully closed many DWMs, seizing millions of UnitedStates dollars, and performing dozen of arrests.
However, DWMs have shown resilience to theseinterventions, and 2020 has been a record year for DWMs revenue.
41, 42
Previous studies have shownthat DWMs offer several COVID-19 related products, including masks, COVID-19 tests, and COVID-19related medicines (e.g., hydroxyclorochine).
1, 2
In a first report,
222 COVID-19 related unique listingswere registered in April 3, 2020 in 20 DWMs, while, in another previous work,
788 COVID-19 relatedunique listings were observed 9 ,
464 times between January 1, 2020 and November 16, 2020 in 30 DWMs.Given that DWMs offered several COVID-19 related products, they are suitable websites where COVID-19 vaccines can be found and illicitly purchased. The availability of COVID-19 vaccines on DWMsremains an open research question.Here, we report on the monitoring of 102 DWMs between January 1, 2020 and February 26, 2021.We detected 33 unique listings offering COVID-19 vaccines. Listings related to approved vaccines wereinitially detected on the Invictus marketplace starting from November 17, 2020, almost 2 weeks beforetheir official approval. Then they have been offered on Yakuza and Cartel marketplaces as well. Also,three listings offering a fabricated proof of vaccination were registered on the Hydra marketplace sinceJanuary 15, 2021. As the deployment of the COVID-19 vaccine continues with slow pace, new vaccinelistings may appear on DWMs, calling for a constant monitoring of DWMs. To reach a large audiencebeyond academia, we released a website, where we are providing constant updates on the effect of thepandemic on DWMs.Our results confirm the concerns that several international agencies have expressed for the past2onths. Interpol released a global warning about the illicit offering of COVID-19 vaccines on December2, 2020 affirming that “ensuring the safety of the supply chain and identifying illicit websites sellingfake products will be essential”. Other local agencies in Canada, Nigeria, UK, and Europe havealso highlighted the danger of illicit fake COVID-19 vaccine listings. They stated that these listings posea real public health risk and will become more and more important with the increase of the number ofapproved vaccines and their worldwide coverage. Moreover, recent delays in production and delivery ofapproved vaccines
47, 48 could also push more people towards illicit websites like DWMs, a real danger incountries where vaccines are still not delivered. Data and methods
Our dataset was gathered by Flashpoint, a company specializing in online risk intelligence. It includedthe most popular DWMs in 2020 and 2021, such as White House, Empire, Hydra, and DarkMarket.
1, 51
Note that the landscape of active DWMs is constantly changing: Empire exit scammed on August 23,2020, while DarkMarket was shut down by Europol on January 12, 2021. The dataset was obtainedby web crawling DWMs, which consists of extracting and downloading data from these websites. To thisend, the web crawling pipeline has to overcome strong CAPTCHAs and authenticate into the DWMsof interest. Downloading content from DWMs remains a challenging task, and the objective becomeseven harder when the research study requires monitoring multiple DWMs for an extended period oftime. Previous research groups have tried establishing a web crawling pipeline through a combination ofPHP, curl, and MySQL, through the Python library Scrapy, and through an automated methodologyusing the AppleScript language. Despite these efforts, only a few open-source tools are available
54, 58 forcrawling DWMs. More often than not, researchers, companies, and federal agencies rely on commercialsoftware, like X-Byte, and specialized companies, like Flashpoint, to crawl DWMs.Overall, our dataset includes a total of 102 DWMs active between January 1, 2020 and February 26,2021. We observe a total of 22 million unique listings, and 365,000 of them belong to the DWMs offeringat least one COVID-19 vaccine. Each unique listing is observed at most once per day. Our methodfor pre-selecting the COVID-19 vaccine related listings is as follows. From the listings, we consideredtwo different text fields: the title and the body (that is, the listing’s detailed description). We thenpre-selected all listings which contained, either in the body or title, at least one word from two differentlists of keyword (case insensitive). These lists of keywords are shown in Table 1: the first list containskeywords related to vaccines; the second list contains keywords related to COVID-19 or vaccine brandslike Pfizer/BioNTech. Note that using keywords like “antibod” or “vaccin” allows to match all wordsincluding these sets of strings, that is, antibode, antibodes, vaccine, vaccines, vaccinations, and so on.We considered several different languages, such as, English, Russian, Chinese, and German. Afterwards,we manually inspected the listings to exclude false positives from the dataset, and we standardised theanalysed attributes for the analysis. For example, we converted all prices to USD at the daily exchangerate at the time of observation.While each listing had an associated url to determine its uniqueness, which allowed us to track listingover time, vendors receiving bad reviews sometimes put identical copies of the same listing online. Toovercome this issue and correctly count the number of listings, we manually inspected the listings andcreated a new identifier of unique listings. We considered two listings as unique if the same vendor wasposting almost identical listings in the same market, with small variations in the title or description. We3i) Vaccine related set of keywordsantibod, vaccin, antidot, vacun, immun, Инокул, вакцин, прививк, Ревакцин, Инокул , 疫 苗 , 反 , impfstoff, Gegenmittel(ii) COVID-19 and brands related set of keywordscovid, corona, ковид, Коронавирус, Пандеми, Вирус, Спутник V, Инфекци, Симптом , 新 冠 病 毒 , 武 汉 肺 炎 , couronne, pfizer, astrazeneca, modernaTable 1: Keywords used to pre-select COVID-19 vaccine listings from the original dataset. Words aretruncated to include different suffixes (e.g., vaccin tields to vaccine, vaccination, caccinate, etc.)also excluded listings with prices larger than 40 ,
000 USD. Vendors post listings at high price to holdsales of these relative items, with the expectation of offering it again in the future. Given that it is notpossible to obtain data of 102 DWMs on a daily basis, we consider a listing as active if it was observedat least one time in the ten days prior to the end of the monitoring period.
Results: Vaccine listings
DWMs have been offering several COVID-19 vaccines, with two relevant examples shown in Fig. 1. InFig. 1(a), a AstraZeneca/Oxford COVID-19 vaccine was offered at 909.8 USD on the Invictus market-place. In Fig. 1(b), a fabricated proof of COVID-19 vaccination was offered at 55 USD on the Hydramarketplace.Overall, we registered 33 unique listings offering COVID-19 vaccine and divided them in three cat-egories: approved vaccines , other vaccines , and proofs of vaccination . Listings in the approved vaccines category explicitly mentioned official vaccines, an example is given in Fig. 1(a) and another one in Fig 4.Listings in the other vaccines category referred to vaccines, either by selling alleged unapproved vaccineswell before research was completed, as shown in Table 3, or by referring to preventive cures for theimmune system, as visible in Table 4. Listings in the proofs of vaccination category offered a fabricatedcertificate of COVID-19 vaccination, as shown in Fig. 1(b) and Fig. 5 with their English translations inTable 5 and 6, respectively.The other vaccines category contained the largest amount of detected COVID-19 related listings.The price of these listings ranged from 2 to 15,000 USD. For example a $ $ a)(b) Figure 1: Screenshots of COVID-19 vaccines. (a) AstraZeneca/Oxford COVID-19 vaccine offered at909.8 USD on the Invictus marketplace. (b) Proof of vaccination offered at 4,000 rubles (55 USD)detected on the Hydra marketplace. The original language of this listing is Russian and its translationin the English language is given in Table 5. The screenshots were taken on February 6, 2021.them also selling some prescription drugs, while the other 4 specialise in selling different kinds of frauds(counterfeit items, manuals, social engineering).Listings in the approved vaccines category, which explicitly mentioned currently approved vaccines,appeared much later on November 17, 2020. The first listing in this category offered the Pfizer/BioNTechvaccine at 1,000 USD. Four other listings were offering the Pfizer/BioNTech vaccine but at different prices,which range from 300 to 2,400 USD. The only listing in this category that offered an AstraZeneca/Oxfordvaccine has set its price tag at 909.8 USD. One listing only specified that its vaccines were approved bythe World Health Organization and offered them at 500 USD. These listings were offered by six differentvendors, who posted four listings on Invictus, two on Yakuza, and one on Cartel. Vendors on Invictus donot specify the shipping information in the listing, while the remaining vendors declare that they shipfrom Germany and United States, and they are willing to ship worldwide. Five of these vendors suggeststo establish a direct contact via email, phone, or wickr, where they can provide more information. Onlyone of these vendors also sells vaccines in the other vaccines category, and they are otherwise specialisedin the selling of prescription drugs, offering from 20 to 270 other listings in this category.The three listings in proofs of vaccination category appeared in January 15, 2021, in the early stage5 ategory Uniquelistings Observation[first; last] Price (USD)[min; max] Vendors DWMs
Approved vaccines
Other vaccines
23 [Jan-29, 2020; Feb-20, 2021] [2; 15,000] 15 10
Proofs of vaccination
Table 2: COVID-19 vaccine listings detected on dark web marketplaces. Some vendors and DWMs offervaccines that belong in more than one category.of the vaccination campaign. The fabricated certificates were offered at similar prices, between 46 to 66USD on the Hydra marketplace, which notoriously operates mostly in Russia and neighbouring Easterncountries. All three vendors are specialised in the sales of different kinds of frauds and stolen items:credit card dumps, premium accounts for online services, counterfeit certificates, passports or otherkinds of identity documents. A summary of the above findings can be found in Table 2 and Fig. 2. Moreinformation about the DWMs where COVID-19 vaccines were detected are available in Table 7. D a r k B a y Y a k u z a I n v i c t u s H y d r a A S A P T e l e v e n d E m p i r e K il o s W h i t e H o u s e B a b y l o n C a r t e l A s e a n U n i q u e li s t i n g s Approved vaccinesOther vaccinesProofs of vaccination 1 2 3 4 5 6
Unique listings V e n d o r s (a) (b) Figure 2: Analysis of the unique listings related to COVID-19 vaccines. (a) Number of unique listingsoffered in each DWM. (b) Number of vendors offering a given amount of unique listings.
Temporal evolution of vaccine listings
The evolution of COVID-19 vaccines on DWMs closely followed major COVID-19 related events, asshown in Fig. 3. The first COVID-19 vaccine listing appeared on January 29, 2020, just after the releaseof the complete genome sequence of COVID-19 on January 12, 2020
62, 63 and the Wuhan lockdown onJanuary 23, 2020. Multiple vaccine listings were simultaneously present on DWMs when the firstvaccination trials were undergoing, between March 16, 2020 and April 14, 2020. Toward the end of thefirst wave of contagions in Europe on June 9, 2020, no more vaccine listings were present on DWMsfrom July 1, 2020. These listings reappeared on September 16, 2020, at the beginning of the second waveof infections that started in September 2020. Up to this moment, we detected only COVID-19 listingsin the other vaccines category. The first listing in the approved vaccines category was a Pfizer/BioNTech6accine and was offered since November 17, 2020, two weeks before its first official approval (by theUK) on December 2, 2020. A similar pattern was registered for the first AstraZeneca/Oxford vaccinelisting on DWMs. It was offered on December 27, 2020, three days before the first official approval ofthis vaccine (by the UK) on December 30, 2020. On January 15, 2021, in the middle of the earlyvaccination phase, we registered the first proofs of vaccination on DWMs. As of February 26, we detect11 unique listings as active: seven in the other vaccines category, two in the approved vaccines category,and all three listings in the proofs of vaccination category. These listings are sold on ASAP, Hydra,Invictus, Televend, and Yakuza.
Dark web marketplacesCOVID-19 related events
SARS-CoV-2 is sequenced Jan-12Wuhan lockdown Jan-23 First vaccinations trials begin Mar-16 End first wave Jun-9 Start second wave Sep-7 Oxford/AstraZeneca vaccine approved in UK Dec-30Pfizer/BioNTech vaccine approved in UK Dec-2First vaccine listing Jan-29 Multiple vaccine listings appear Mar-20 No more vaccine listings Jul-1 Vaccine listings reappear Sep-16 First Pfizer/BioNTech vaccine listing Nov-17First AstraZeneca/Oxford vaccine listing Dec-27First proof of vaccination Jan-152020 2021
Figure 3: Timeline of the availability of listings offering COVID-19 vaccines on dark web marketplaces(top), together with main COVID-19 related events of the vaccination campaign (bottom).
Discussions and conclusion
We have been monitoring the presence of COVID-19 vaccine listings in 102 DWMs since the onset ofthe COVID-19 pandemic. We have identified a total of 33 unique listings related to COVID-19 vaccines.Nine of these listings were offered on DarkBay, which has more listings categories than other DWMs. Seven of the 33 detected listings offered currently approved vaccines. They were offered on Invictus,Yakuza, and Cartel marketplaces. The Invictus marketplace started to operate in September 2020. Itsadministrators claim to start a new era for DWMs by offering an intuitive control panel, experiencedstaff, and innovative features. Yakuza is also a recently established marketplace, opened in April 2020and famous for his open tolerance of firearms sale. Cartel instead opened in July 2020, openly modelledafter the now defunct TradeRoute market. We also detected three fabricated proofs of vaccination onthe Hydra marketplace, the largest DWM in Russia that allows shipping only within that country andneighbouring Eastern countries. A key contribution of the present work is the constant monitoring of DWMs to detect the presenceof COVID-19 vaccines. This work is similar to a previous study which observed that the evolution oflistings related to COVID-19 vaccines is correlated with major COVID-19 related events. This study7etected a number of COVID-19 vaccines during the first and second wave of contagions, however therewere no listings between the contagion waves. We also observed seven listings explicitly mentioning thePfizer/BioNTech, AstraZeneca/Oxford, and other approved vaccines. These listings appeared aroundthe time of the official approval of these vaccines, reflecting the claims of other mass media news. Two of these listings are active as of February 26, 2021.A limitation of the present work is that, while the number of DWMs simultaneously monitored overtime is greater than most previous studies, we cannot ensure that all DWMs were surveyed. In fact,the number of active DWMs is constantly changing due to closures or new openings and obtainingfull coverage is challenging due to the active efforts of DMWs to obstruct research studies and lawenforcement investigations.The unregulated diffusion of illicit vaccines on DWMs constitutes a major threat to public health, andcould undermine the ongoing COVID-19 mass vaccination campaign. By highlighting how COVID-19vaccines appear on DWMs, our analysis may help raise awareness of the phenomenon and support theeffort of law enforcement agencies to contain it by repeating past successful approaches .
Competing interests
The authors declare that they have no competing interests.
Author’s contributions
A.Ba. coordinated the project. All authors designed the research. M.A. and I.G. provided the data.A.Br., M.N., M.A. and I.G. pre-processed and analysed the data. All authors analysed the results andwrote the manuscript. All authors read and commented on the manuscript.
Acknowledgements
A.Br., M.N., A.T., A.G and A.Ba. were supported by ESRC - Economic and Social Research Councilas part of UK Research and Innovation’s rapid response to COVID-19, through grant ES/V00400X/1.M.A and D.M., acknowledge support from the U.S. National Science Foundation grant 1717062.
Correspondence
Correspondence should be addressed toAndrea Baronchelli: [email protected].
References [1] Roderic Broadhurst, Matthew Ball, Chuxuan Jessie Jiang, et al. Availability of COVID-19 relatedproducts on Tor darknet markets.
Australasian Policing , 12(3):8, 2020.82] Alberto Bracci, Matthieu Nadini, Maxwell Aliapoulios, Damon McCoy, Ian Gray, Alexander Teytel-boym, Angela Gallo, and Andrea Baronchelli. Dark web marketplaces and COVID-19: before thevaccine.
EPJ Data Science , 10, 2021.[3] WHO. Coronavirus disease (COVID-2019) situation reports.
Accessed January 23, 2021, 2020. WorldHealth Organization.[4] Moritz UG Kraemer, Chia-Hung Yang, Bernardo Gutierrez, Chieh-Hsi Wu, Brennan Klein, David MPigott, Louis Du Plessis, Nuno R Faria, Ruoran Li, William P Hanage, et al. The effect of humanmobility and control measures on the COVID-19 epidemic in China.
Science , 368(6490):493–497,2020.[5] The COVID-19 candidate vaccine landscape.
Accessed January 21, 2021, 2021. WHO.[6] Talha Khan Burki. The russian vaccine for COVID-19.
The Lancet Respiratory Medicine , 8(11):e85–e86, 2020.[7] Argentina begins covid-19 vaccination with russiaˆa €™ s sputnik v vaccine. https://tass.com/world/1240965 Accessed February 6, 2021, 2020. Russian News Agency.[8] Heidi Ledford, David Cyranoski, and Richard Van Noorden. The UK has approved a COVIDvaccine-here’s what scientists now want to know.
Nature , 588(7837):205–206, 2020.[9] Janice Hopkins Tanne. COVID-19: FDA panel votes to authorise Pfizer Biontech vaccine.
BMJ ,371, 2020.[10] Roberts Michelle. COVID: Pfizer-Biontech vaccine approved for eu states.
Accessed January 22, 2021, 2020. BBC.[11] Coronavirus (covid-19) vaccinations. https://ourworldindata.org/covid-vaccinations
Ac-cessed January 26, 2021, 2021. Our World In Data.[12] GIATOC. CovidCrimeWatch: crime and contagion: the impact of a pandemic on organized crime. https://globalinitiative.net/crime-contagion-impact-covid-crime/
Accessed January 23,2021, 2020.[13] Europol and EMCDDA. EU drug markets impact of COVID-19.
Accessed January 23, 2021, 2020.[14] Interpol warns of organized crime threat to COVID-19 vac-cines.
Accessed January22, 2021, 2020. Interpol.[15] Europol predictions correct for fake COVID-19 vaccines.
Accessed Jan-uary 22, 2021, 2020. EUROPOL. 916] Stephanie Ip. COVID-19: Online attempts to buy vaccine tripled in January.
Accessed January 26, 2021, 2021. Brave New Coin.[17] Jeffrey V Lazarus, Scott C Ratzan, Adam Palayew, Lawrence O Gostin, Heidi J Larson, KennethRabin, Spencer Kimball, and Ayman El-Mohandes. A global survey of potential acceptance of aCOVID-19 vaccine.
Nature Medicine , pages 1–4, 2020.[18] Jon Emont. In covid-era travel scam, fraudsters offer fake test results.
Accessed February 10, 2021, 2021. Wall Street Jorunal.[19] Aliss Higham. Will i need proof of a coronavirus vaccine if i want to go onholiday this summer?
AccessedJanuary 26, 2021, 2021. Express.[20] Helen Johnson. Passport stamps or certificates to show proof of covid vaccination couldbecome law for travellers.
Accessed January 26, 2021, 2021. Yorkshire Evening Post.[21] Roger Dingledine, Nick Mathewson, and Paul Syverson. Tor: the second-generation onion router.Technical report, Naval Research Lab Washington DC, 2004.[22] Gwern. Darknet market mortality risks.
Accessed January23, 2021, 2019.[23] WHO. World drug report 2019.
United Nations publication, Sales No. E , 19, 2019.[24] Abeer ElBahrawy, Laura Alessandretti, Leonid Rusnac, Daniel Goldsmith, Alexander Teytelboym,and Andrea Baronchelli. Collective dynamics of dark web marketplaces.
Scientific reports , 10(1):1–8,2020.[25] Monica J Barratt, Jason A Ferris, and Adam R Winstock. Use of Silk Road, the online drugmarketplace, in the United Kingdom, Australia and the United States.
Addiction , 109(5):774–783,2014.[26] James Martin. Lost on the Silk Road: online drug distribution and the cryptomarket.
Criminology& Criminal Justice , 14(3):351–367, 2014.[27] Judith Aldridge and David D´ecary-H´etu. Not an Ebay for drugs: the cryptomarket Silk Road as aparadigm shifting criminal innovation.
Available at SSRN 2436643 , 2014.[28] Diana S Dolliver and Katherine L Love. Criminogenic asymmetries in cyberspace: a comparativeanalysis of two Tor marketplaces.
Journal of Globalization Studies , 6(2):75–96, 2015.[29] Diana S Dolliver. Evaluating drug trafficking on the Tor network: Silk Road 2, the sequel.
Inter-national Journal of Drug Policy , 26(11):1113–1123, 2015.1030] Julian Bros´eus, Damien Rhumorbarbe, Caroline Mireault, Vincent Ouellette, Frank Crispino, andDavid D´ecary-H´etu. Studying illicit drug trafficking on darknet markets: structure and organisationfrom a Canadian perspective.
Forensic Science International , 264:7–14, 2016.[31] Marie Claire Van Hout and Tim Bingham. Silk Road, the virtual drug marketplace: a single casestudy of user experiences.
International Journal of Drug Policy , 24(5):385–391, 2013.[32] Marie Claire Van Hout and Tim Bingham. Responsible vendors, intelligent consumers: Silk Road,the online revolution in drug trading.
International Journal of Drug Policy , 25(2):183–189, 2014.[33] Wesley Lacson and Beata Jones. The 21st century darknet market: Lessons from the fall of SilkRoad.
International Journal of Cyber Criminology , 10(1), 2016.[34] Europol.
Accessed February 10, 2021, 2014.[35] Darknet takedown: authorities shutter online criminal market AlphaBay.
Accessed January 23, 2021, 2017. FBI.[36] Ionut Ilascu. Dark webˆa €™ s Wall Street market and valhallaseized, six arrested. Accessed January 23,2021, 2019. Bleeping Computer.[37] Pierluigi Paganini. Italian police shut down darkweb berlusconi market and arrested admins. https://securityaffairs.co/wordpress/93603/cyber-crime/berlusconi-market-darkweb.html
Accessed January 4, 2021, 2019. Security Affairs.[38] Chris Isidore. Feds seize 1 billion in bitcoins they say were stolen from Silk Road. https://edition.cnn.com/2020/11/06/business/bitcoin-seized-silk-road-ulbricht/index.html
Accessed January 4, 2021, 2020. CNN.[39] Catalin Cimpanu. FBI and Interpol disrupt Joker’s Stash, the internet’slargest carding marketplace.
Accessed January 24, 2021, 2020. Zero Day.[40] Gerard E. Lynch. United States of America : Vs. Ross William Ulbricht. https://caselaw.findlaw.com/us-2nd-circuit/1862572.html
Accessed January 23, 2021, 2017. United StatesCourt of Appeals.[41] Covid is causing shipping issues, but natural competitive forces are causing darknet market con-solidation. https://blog.chainalysis.com/reports/darknet-markets-cryptocurrency-2020
Accessed February 9, 2021, 2021. Chainalysis.[42] Matthew Leising. Darknet market had a record 2020, led by rus-sian bazaar hydra.
Accessed February 9, 2021, 2021. Bloomberg.1143] Alberto Bracci, Matthieu Nadini, Alex Teytelboym, Angela Gallo, and Andrea Baronchelli. Wemonitor the effects of COVID-19 on illicit online trade by analysing dozens of dark web marketplaces. https://darkmarkets.live/
Accessed March 3, 2021, 2020.[44] Ahmar Khan. Health canada warning: Do not buy coun-terfeit covid-19 vaccines. https://uk.finance.yahoo.com/news/vaccine-counterfeit-health-canada-185959810.html?guccounter=1&guce_referrer=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbS8&guce_referrer_sig=AQAAALX6GlWRXqsDdqI3Oz_Y9UB5IYAyEjHzBqI9oKomBcH4G7DEckfbtyZKnQTpXPRRqpL0CJ8zkX0SvgpyRv8yDBG3F6_YSpJnUqyDpubVDTgLPMN2a-bx4pa0JQdCH0nMRu3HYrXgYTgYnGH-Q59S4ey_NsKs2zDCO00Qwa3-jQeh
Accessed January 25, 2021, 2021. Yahoo Financer.[45] Chukwuma Muanya and Adaku Onyenucheya. Nafdac raises alarmover fake covid-19 vaccine in nigeria. https://guardian.ng/news/nafdac-raises-alarm-over-fake-covid-19-vaccine-in-nigeria/
Accessed January 25,2021, 2021. The Guardian, Nigeria.[46] Thomas Moore. Coronavirus: Any uk vaccine to be made in britain’for fear us will take it’, scientists say. https://news.sky.com/story/coronavirus-any-uk-vaccine-to-be-made-in-britain-for-fear-us-will-take-it-scientists-say-12030691
Accessed January 25, 2021, 2021. Sky News.[47] Covid: Oxford/astrazeneca vaccine delivery to eu to be cut by 60
Accessed January 25, 2021, 2021. The Guardian.[48] Nadeem Badshah. Uk to face delay in delivery of pfizer covid vaccine.
Accessed January 25, 2021, 2021. The Guardian.[49] ˆa € ˜catastrophic moral failureˆa €™ : Who warns over vaccine distribution. Accessed January 25, 2021, 2021. Aljazeera.[50] Flashpoint intelligence.
Accessed January 23, 2021, 2020.[51] Dark net markets comparison chart.
Accessed January 23, 2021, 2020. Darknet Stats.[52] Jamie Redman. After empire’s exit scam, darknet market pa-trons scramble to find alternatives. https://news.bitcoin.com/after-empires-exit-scam-darknet-market-patrons-scramble-to-find-alternatives/
Accessed February 6, 2021, 2020. Bitcoin.com.[53] Kevin Helms. Darknet giant darkmarket shut down, alleged operator arrested. https://news.bitcoin.com/darknet-darkmarket-shut-down-operator-arrested/
AccessedFebruary 6, 2021, 2021. Bitcoin.com. 1254] Matthew Ball, Roderic Broadhurst, Alexander Niven, and Harshit Trivedi. Data capture and anal-ysis of darknet markets.
Available at SSRN 3344936 , 2019.[55] Andres Baravalle, Mauro Sanchez Lopez, and Sin Wee Lee. Mining the dark web: drugs and fakeids. In , pages350–356. IEEE, 2016.[56] Alessandro Celestini, Gianluigi Me, and Mara Mignone. Tor marketplaces exploratory data analysis:the drugs case. In
International Conference on Global Security, Safety, and Sustainability , pages218–229. Springer, 2017.[57] Darren R Hayes, Francesco Cappa, and James Cardon. A framework for more effective dark webmarketplace investigations.
Information , 9(8):186, 2018.[58] D D´ecary-H´etu and J Aldridge. Datacrypto: the dark net crawler and scraper.
Software Program ,2013.[59] X-byte enterprise crawling.
Ac-cessed January 23, 2021.[60] Kyle Soska and Nicolas Christin. Measuring the longitudinal evolution of the online anonymousmarketplace ecosystem. In { USENIX } security symposium ( { USENIX } security 15) , pages33–48, 2015.[61] Alex Lielacher and Andy Pickering. Will hydraˆa €™ s darknet mar-ket tentacles reach the west? https://bravenewcoin.com/insights/russian-darknet-marketplace-hydra-launches-dubious-ico Accessed January 26, 2021,2021. Msn.[62] Wuhan seafood market pneumonia virus isolate Wuhan-Hu-1, complete genome.
Accessed January 23, 2021, 2020. GenBank:MN908947.1.[63] Fan Wu, Su Zhao, Bin Yu, Yan-Mei Chen, Wen Wang, Zhi-Gang Song, Yi Hu, Zhao-Wu Tao, Jun-Hua Tian, Yuan-Yuan Pei, et al. A new coronavirus associated with human respiratory disease inChina.
Nature , 579(7798):265–269, 2020.[64] Derrick Bryson Taylor. A timeline of the coronavirus pandemic.
Accessed January 23, 2021, 2020. The New York Times.[65] Lisa A Jackson, Evan J Anderson, Nadine G Rouphael, Paul C Roberts, Mamodikoe Makhene,Rhea N Coler, Michele P McCullough, James D Chappell, Mark R Denison, Laura J Stevens, et al.An mrna vaccine against SARS-CoV-2ˆa € ”preliminary report. New England Journal of Medicine ,2020.[66] Marc Santora. The world reopens, despite skyrocketing coronavirus cases.
Accessed January 24, 2021, 2020. TheNew York Times.[67] Sam Jones, Kim Willsher, and Natalie Grover. Spain is first country in western Europeto record half a million COVID cases. pain-set-to-record-half-a-million-covid-cases Accessed January 24, 2021, 2020. TheGuardian.[68] Oxford University/AstraZeneca COVID-19 vaccine approved.
Accessed January 24, 2021,2020. UK press release.[69] DNStats: Darkbay. https://dnstats.net/site/darkbay
Accessed January 23, 2021, 2020.[70] Invictus market. https://darknetlive.com/markets/invictus/
Accessed January 22, 2021, 2021.Darknetlive.[71] Yakuza market.
Accessed February 26, 2021,2021. SearchLight Security.[72] Cartel market.
Accessed February 26, 2021,2021. DarknetStats.[73] Grace Kay. COVID-19 vaccines are selling on the dark web for as much as $ https://uk.news.yahoo.com/online-scammers-trying-sell-covid-160008180.html AccessedJanuary 24, 2021, 2021. Business Insider.[74] Pieter Arntz. Buying COVID-19 vaccines from the dark web? No thanks! https://blog.malwarebytes.com/scams/2020/12/buying-covid-19-vaccines-from-the-darkweb/
Ac-cessed January 24, 2021, 2020. Malwarebytes.[75] Isobel Asher Hamilton. Dark web vendors are selling shady coronavirus ‘vaccines’ for $ Accessed January 24, 2021, 2021. Business Insider.[76] Thomas Moore. Coronavirus: Any UK vaccine to be made in Britain‘for fear us will take it’, scientists say. https://news.sky.com/story/coronavirus-any-uk-vaccine-to-be-made-in-britain-for-fear-us-will-take-it-scientists-say-12030691
Accessed January 24, 2021, 2020. 14 xamples of listings offering COVID-19 vaccines
Figure 4: Screenshots of a listing in the approved vaccines category offering the Pfizer/BioNTech vaccineon the Invictus marketplace. We removed the contact information of the vendor, who invites the potentialcustomer to have a direct contact. The screenshot was taken on February 6, 2021.Table 3: Example of a listing in the other vaccines category offering a generic COVID-19 vaccine, whichdoes not specify the producer.Title
COVID-19 antidote from china. selling at 15k USD
Body the covid-19 current massacre is supposed to have ended by now. while the who is trying tobe selfish with human life, we are trying to save the lives. the real virus is the leaders. thisvaccine should be used just once on one person and basically the giveaway price i put here isnothing compare your life. get your vaccine now in time. you can buy from me and resell atyour price. contact me for more details. email:
Price
Shipping from/to
N.A.
Vendor
DWM
DarkBay other vaccines category offering a COVID-19 cure based on a cocktailof drugs.Title
20 caps protect yourself from the corona virus
Body
The corona virus is developing into one of the most dangerous viruses in the history of mankind... millions of people in asia are isolated and the virus continues unchecked... there is nomedicine against it only your own body can it heal... the incubation period is 14 days thatmeans there are probably hundreds of thousands of infected people spread all over the worldalready... to help your immune system and endocanabinoid system you should take one of ourthc capsules daily... they are full to bursting with activated marijuana (black jack) and thusready for consumption they help your body in shortest time your immune system and to rampup the endocannabinoid system and give you a better chance of recovery... please act fast wehave started to produce these capsules day and night since yesterday ... but dont know whatson us...so... unfortunately, we have to say they are only available while stocks last... you canfind these capsules in our shop...take care of yourself ...
Price
Shipping from/to
Spain/Worldwide
Vendor
DWM
Asean
Table 5: English translation of the listing in Fig. 1(b). We use Google Translator to translate the textfrom Russian to English.Title
Coronavirus / Covid / Corona vaccination certificates
Body
Hello Friend! The coronavirus has made adjustments to everyone’s life. And more than oncemany of us will face its consequences. One of them is the provision of a COVID-19 vaccinationcertificate, which can be presented at work, at the place of study and in any other place whereit is required. To order, you need to indicate your full name, date of birth, date of the issueddocument. If you need a non-Moscow institution, you will need to pay extra for the productionof the necessary seals. Production time is 2-7 days. Delivery when sent by courier will have tobe paid for upon receipt. It is possible to send by registered or regular mail, then we will takeon this heavy burden. An ordinary letter has no track, therefore, until we receive the letter, wewill remain in the dark about its fate.
Price
55 USD
Shipping from/to
Russia and neighbouring Eastern countries/Russia and neighbouring Eastern countries
Vendor
DWM
Hydra proof of vaccination category. It offered a fabricated certificateat 5,000 rubles (66 USD) on the Hydra marketplace. The original language of this listing is Russianand the relative translation in the English language is given in Table 6. The screenshot was taken onFebruary 6, 2021.Table 6: English translation of the listing in Fig. 5. We use Google Translator to translate the text fromRussian to English.Title
Certificate (reference) of vaccination against COVID-19 (Coronavirus) / Covid
Body
COVID-19 vaccination certificate, which can be presented at work, school and anywhere elsewhere it is required.
Price
66 USD
Shipping from/to
Russia and neighbouring Eastern countries/Russia and neighbouring Eastern countries
Vendor
DWM