ArticlePDF Available

Buying drugs on a Darknet market: A better deal? Studying the online illicit drug market through the analysis of digital, physical and chemical data


Abstract and Figures

Darknet markets, also known as cryptomarkets, are websites located on the Darknet and designed to allow the trafficking of illicit products, mainly drugs. This study aims at presenting the added value of combining digital, chemical and physical information to reconstruct sellers' activities. In particular, this research focuses on Evolution, one of the most popular cryptomarkets active from January 2014 to March 2015. Evolution source code files were analysed using Python scripts based on regular expressions to extract information about listings (i.e., sales proposals) and sellers. The results revealed more than 48,000 listings and around 2700 vendors claiming to send illicit drug products from 70 countries. The most frequent categories of illicit drugs offered by vendors were cannabis-related products (around 25%) followed by ecstasy (MDA, MDMA) and stimulants (cocaine, speed). The cryptomarket was then especially studied from a Swiss point of view. Illicit drugs were purchased from three sellers located in Switzerland. The purchases were carried out to confront digital information (e.g., the type of drug, the purity, the shipping country and the concealment methods mentioned on listings) with the physical analysis of the shipment packaging and the chemical analysis of the received product (purity, cutting agents, chemical profile based on minor and major alkaloids, chemical class). The results show that digital information, such as concealment methods and shipping country, seems accurate. But the illicit drugs purity is found to be different from the information indicated on their respective listings. Moreover, chemical profiling highlighted links between cocaine sold online and specimens seized in Western Switzerland. This study highlights that (1) the forensic analysis of the received products allows the evaluation of the accuracy of digital data collected on the website, and (2) the information from digital and physical/chemical traces are complementary to evaluate the practices of the online selling of illicit drugs on cryptomarkets.
Content may be subject to copyright.
Forensic Science International
Buying drugs on a Darknet market: a better deal? Studying the
online illicit drug market through the analysis of digital, physical
and chemical data.
Rhumorbarbe Damiena, Staehli Ludovica, Broséus Juliana,
Rossy Quentina, Esseiva Pierrea
aEcole des Sciences Criminelles, University of Lausanne, Lausanne, Switzerland.
Darknet markets, also known as cryptomarkets, are websites located on the Darknet and designed to allow the trafficking of
illicit products, mainly drugs. This study aims at presenting the added value of combining digital, chemical and physical
information to reconstruct sellers’ activities. In particular, this research focuses on Evolution, one of the most popular
cryptomarkets active from January 2014 to March 2015.
Evolution source code files were analysed using Python scripts based on regular expressions to extract information about
listings (i.e., sales proposals) and sellers. The results revealed more than 48,000 listings and around 2700 vendors claiming
to send illicit drug products from 70 countries. The most frequent categories of illicit drugs offered by vendors were
cannabis-related products (around 25%) followed by ecstasy (MDA, MDMA) and stimulants (cocaine, speed). The
cryptomarket was then especially studied from a Swiss point of view. Illicit drugs were purchased from three sellers located
in Switzerland. The purchases were carried out to confront digital information (e.g., the type of drug, the purity, the shipping
country and the concealment methods mentioned on listings) with the physical analysis of the shipment packaging and the
chemical analysis of the received product (purity, cutting agents, chemical profile based on minor and major alkaloids,
chemical class). The results show that digital information, such as concealment methods and shipping country, seems
accurate. But the illicit drugs purity is found to be different from the information indicated on their respective listings.
Moreover, chemical profiling highlighted links between cocaine sold online and specimens seized in Western Switzerland.
This study highlights that (1) the forensic analysis of the received products allows the evaluation of the accuracy of digital
data collected on the website, and (2) the information from digital and physical/ chemical traces are complementary to
evaluate the practices of the online selling of illicit drugs on cryptomarkets.
Keywords: Cryptomarket ; Cocaine ; Drug profiling ; Evolution market ; Concealment techniques ; Source codes.
1 Introduction
The online trading of drugs is a criminal activity that may take various forms. For example, new psychoactive
substances are already distributed through the Web, due to the different legal status of these substances from
one country to another [1]. Prescription drugs are also sold online with consumers redirected toward online
pharmacies through massive spam campaigns [2]. Besides, online selling of traditional illicit drugs (cocaine,
Rhumorbarbe et al. / Forensic Science International (2016) 2
heroin and cannabis) became very popular with the creation Silk Road, in 2011. Markets such as Silk Road are
commonly referred to as cryptomarkets, or Darknet markets (DNM). In this context, the Darknet is a set of
networks within the Internet, based on peer-to-peer technologies as part of encryption processes [3]. A
cryptomarket is an online website, on which it is possible to trade illicit goods mainly illicit drugs while the
identity of sellers, consumers and administrators remains concealed. This anonymity is ensured because
cryptomarkets relies on several encryption features. First, cryptomarkets are hosted on the Darknet, accessing
them requires a specific communication protocol such as an onion routing. Connections are then established
through a sequence of nodes, each of them having encryption features. Some web browsers are specifically
implemented to use an onion routing. The most popular, and first to be released, is the TOR browser (The Onion
Router) [4]. However, other networks based on enhanced routing techniques are also available, such as I2P
(Invisible Internet Project) [5]. Moreover, communications between participants are encrypted as well, using
PGP (Pretty Good Privacy) cryptography, which implies the sharing of public keys on the marketplace [6-8].
Lastly, cryptocurrencies mainly bitcoins are the exclusive payment method on cryptomarkets. Transactions
in bitcoins are requested by buyers and approved collectively through the bitcoin system. For this reason, bitcoin
is not a currency centralised by a bank or guaranteed, nor controlled, by a government [9].
After Silk Road was shut down in October 2013, several other cryptomarkets rose on the Darknet [10]. One
of them, Evolution, was launched on January 14, 2014 and shut down on March 18, 2015. By the end of 2014,
Evolution was one the major active cryptomarkets, along with Agora. Their success may be explained by the
fact that they survived after Operation Onymous, an international operation held in early October 2014 aiming
at shutting down several cryptomarkets [11]. Evolution transactions were based on an escrow system, meaning
basically that, once a transaction is placed, Evolution’s administrators will hold the amount of bitcoins involved
until the buyer indicates he received the product. Besides, a feedback system was implemented, allowing
consumers to evaluate any vendor or transaction. Vendors were ranked based on their number of transactions
and the quality of the feedbacks they received (i.e. positive, negative or neutral). These features show how
important are the trust and the reputation among a cryptomarket community [12]. As a cryptomarket grows, the
number of bitcoins held in escrow may become huge and constitute a target for hackers or even administrators
themselves. This may have led to the shutting down of Evolution on March 18, 2015, since it is hypothesised
that the administrators may have “exit scammed” [13].
Ross Ulbricht’s founder of Silk Road trialled and sentenced in 2015 raised the attention of the media and
wider public for trafficking through the Darknet. However, as mentioned by Martin [14], the media’s sensational
facts are sometimes exaggerated and misleading, revealing the need for a better understanding of the
cryptomarkets structure. From an institutional point of view, the United Nations Office on Drugs and Crime
(UNODC) emphasised the need to acquire more information about transactions occurring on the Darknet,
arguing that it would grow in importance in the future [15]. So far, academic research regarding cryptomarkets
is essentially about Silk Road. Some of the studies give an insight and conceptualise the notion of cryptomarket
[16 ; 17]. Others aimed at estimating the revenue of sellers and at characterising the business model of
cryptomarkets [18 ; 19]. Soska and Christin [8] proposed a detailed analysis of cryptomarkets environment
through data obtained over a two-years monitoring period. They studied various aspects such as sales volumes,
offered products or activity of vendors and compared several cryptomarkets. Interviews of Silk Road vendors
[20] and users [21], as well as discussion threads analyses [22], were also conducted to describe interactions
within a cryptomarket community. The authors emphasised notably various discussions about shipping methods
and packaging, including measures and techniques to avoid packages interception. Subsequently, Silk Road and
Silk Road 2 a new version launched in November 2013 were compared [23]. Methodological questions
about the comparison of cryptomarkets were raised following this research publication and led to a debate
among researchers [24-26].
Rhumorbarbe et al. / Forensic Science International (2016) 3
General monitoring of Darknet marketplaces constitutes a field of research on its own. For instance,
institutions such as the National Drug & Alcohol Research Center of the University of New South Wales (see provides periodically trends about cryptomarkets, from an Australian
perspective. The Global Drug Policy Observatory of the Swansea University (see also publishes situation analysis in the field of drug policy, including Darknet
and cryptomarkets related aspects.
The purpose of this article is to provide a better understanding of the purchase process of illicit drugs on a
cryptomarket. Our first hypothesis is that the accuracy of the information available online can be evaluated
through orders. Thus, digital data extracted from the cryptomarket Evolution were analysed to draw an overview
of illicit drugs distribution and assess the most popular products offered on the market. Besides, it allows
estimating the number of active vendors and their number of transactions. Illicit drugs were then purchased on
Evolution. Shipping and packaging modus operandi were studied. Furthermore, qualitative and quantitative
analyses as well as chemical profiling of the purchased illicit drugs were performed. These results are used to
test out second hypothesis which assumes that forensic analysis of the products can be used to evaluate if
cryptomarkets are an extension of the traditional market or, on the opposite, a separate market with only a few
relationships with the later.
2 Methodology
2.1 Digital data
This research relies on data collected throughout the period Evolution was active. This data consists of the
HTML source code of Evolution pages. Parts of the platform were indeed duplicated between January 2014 and
March 2015 (115 times) by an independent researcher, named Gwern. The data used to get an overview of the
market and evaluate the position of Switzerland within this market were extracted from the raw data resulting
from Gwern’s crawling. We did not perform any crawling ourselves. Gwern compiled the entire dataset into a
single archive file and made it available online via a Reddit forum on March 19th 2015 (data downloaded on
April 30th 2015 on .
Each time Evolution was scraped, a directory was created, including all source codes structured in
subdirectories, i.e. listings (sales proposals), vendor profiles, stores, images and category. Using Python scripts,
all drugs related listings were extracted and tagged with a unique identification code. Orange Canvas, a Python-
based visual programming software specifically an add-on to this software, called ‘Textable’ [27] was used
to search source codes with regular expressions. They were designed to target listings information (i.e. listing
title, the category and price of the product, seller username and ranking, shipping country, countries available
for shipping and description). Subsequently, the extracted listings were sorted out, as some listings appeared
several times due to redundancies in scraped data. Moreover, information such as the number of transactions
and feedback were collected for each vendor from their profile pages. The listings’ description as well as the
vendors’ profile descriptions were not systematically analysed, only those related to the illicit drugs ordered for
this research were considered. This structured information was analysed and visualised using Microsoft Excel
2013 and R software [28].
Rhumorbarbe et al. / Forensic Science International (2016) 4
2.2 Illicit drugs ordering
2.2.1 Law Dependencies
Since purchasing illicit drugs is prohibited, a legal authorisation was granted by the Attorney General of the
Canton de Vaud in order to place illicit drugs orders for academic purpose. Indeed, the Swiss Federal Act on
Narcotics and Psychotropic Substances states: “Institutions involved in scientific research may be granted a
licence by the relevant cantonal authority to cultivate, acquire, store and use narcotics to the extent required for
their own needs.” (NarcA, art. 14 al. 2, in force since 1 July 2011).
Marketplace and Type of Illicit Drugs Selection
At the beginning of this study, Agora and Evolution were the two most popular marketplaces regarding the
number and diversity of illicit drugs offered and the total number of retailers [11]. Products were purchased on
Evolution since Agora required to be sponsored by an active member to be accessed.
In order to compare the results with street market seizures, cannabis related products and cocaine were
targeted. They were purchased from the few active Swiss vendors offering for sale cocaine and cannabis
products. Indeed, our authorisations specified that the purchases had to be conducted on the Swiss Territory, in
other words, bought from a Swiss vendor. Since Evolution search engine included different specifications, such
as “ship from” and “ship to” filters, it was possible to target vendors claiming to deliver products from
Switzerland to Switzerland.
2.2.2 Obtaining Bitcoins
Bitcoins were obtained through the website At the beginning of October 2014, 0.5183
BTC were bought for 200.00 CHF at a rate of 385.88 CHF/BTC. All bitcoins were transferred to an Evolution
account specially created for the purchases. At the end of November 2014, the process was repeated to acquire
0.7625 BTC (300.00 CHF) at a rate of 393.45 CHF/BTC) in order to make a second set of purchases.
2.2.3 Shipping Method and Packaging
In this study, physical analysis refers only to the description of the shipping method, packages and
concealment techniques of purchased products. This analysis is especially useful to discuss the exactitude of
the “ships from” statement and to provide information on the modus operandi of vendors.
2.2.4 Illicit Drugs Chemical Analysis and Profiling
In Western Switzerland, the chemical analysis (qualification, quantitation and chemical profiling) of illicit
drug specimens confiscated by police and customs is centralised in our laboratory, hosted by the University of
Lausanne (Switzerland).
In particular, cocaine specimens are analysed through gas chromatography-mass spectrometry (GC-MS)
using the analytical method validated in our laboratory [29]. For cannabis-related products, qualification is
performed by GC-MS while quantification of THC (9-tetrahydrocannabinol) is carried out with gas
chromatography interfaced with a flame ionisation detector (GC-FID) (see Appendix A). Seizures of cannabis-
related products are not systematically profiled in our laboratory, since the main objective of the analysis is to
discriminate between legal and illegal cannabis. Depending on the country, growing some subspecies of
Cannabis sativa for legal utilisations (e.g. production of textile, edible seeds, essential oils, etc.) is authorized,
though restricted. A distinction is possible between these plants and the drug-type varieties [30 ; 31].
Rhumorbarbe et al. / Forensic Science International (2016) 5
A deep explanation of the profiling process (e.g. the selection of target compounds, the statistical methods
for the comparison of profiles, and the interpretation of outcomes) is out of the scope of this publication.
Therefore, interested readers are kindly requested to refer to previous publications [29 ; 32 ; 33].
Chemical (purity, cutting agent, profile based on major and minor alkaloids and chemical class) and physical
information (description of the packaging and appearance) information are gathered in a dedicated database
since 2006. They result from the analysis of cocaine specimens confiscated by police and customs.
Circumstantial information (criminal case number, mass of drugs seized, date and place of the seizure) is also
collated [34-36]. In this research work, cocaine specimens purchased on Evolution were profiled and then
compared to the profiles stored in this database.
3 Results and discussion
3.1 Overview of the Swiss Market on Evolution
The extraction process applied to the digital data revealed 48’026 different listings offering illicit drugs over
the period Evolution was functioning (from January 2014 to March 2015). Table 1 shows the most frequent
countries mentioned in the “ship from” field of Evolution listings.
Country of origin Listings Percentage
United States 11,996 24.9%
United Kingdom 5,972 12.4%
Netherlands 4,764 9.9%
Germany 4,579 9.5%
Australia 3,047 6.3%
Canada 2,092 4.3%
Sweden 1,410 3.0%
China 1,142 2.7%
France 949 2.0%
Switzerland 205 0.4%
Worldwide 7’939 16.5%
Others 3931 8.1%
Table 1. Switzerland compared to the top 10 countries of origin mentioned on listings (n=48’026).
Significantly, 16.5% of studied listings do not include any origin information since “Worldwide” is indicated
in their “ship from” field. The way countries are listed in that field namely a structured list of non-misspelled
country names suggests that a pre-filled list of countries is proposed to sellers when creating their listings. A
“Worldwide” indication may be explained by a will to hide the true origin of products or a preference for another
way to display that information. Indeed, sellers alternatively may give more shipping details in their listing
descriptions or on their profile page.
Switzerland stands at the 19th position of the ranking with 205 listings. Regarding destinations toward which
illicit drugs may be delivered from Switzerland (see Table 2), around 80% of all listings may be shipped to
Rhumorbarbe et al. / Forensic Science International (2016) 6
Switzerland. Otherwise, only a list of European countries is available. Besides, listings limited by a delivery to
Switzerland represent less than 5.9% of all listings.
Switzerland only 12 5.9%
Switzerland and a selection of European countries 62 30.2%
Switzerland and rest of the world 91 44.4%
European countries excluding Switzerland 40 19.5%
Table 2. Shipping destinations available for Swiss listings (n = 205).
Thus, Swiss sellers do not appear to be reluctant to send their products across borders, even though it may
imply greater risks of detection. We may assume that sellers are very confident about their packaging techniques
to avoid detection. Finally, they may accept such a risk of detection at borders because the purchased quantities
are generally small. Certainly, they may favour an international expansion of their market, even if it implies
refunding a few customers when a shipment is seized [17]. Results provided in Table 2 corroborate this, since
listings from around the world are likely to be shipped worldwide rather than to a specific location. This supports
the hypothesis that sellers may join a cryptomarket community to expend their distribution area and thus
increase their incomes.
Figure 1 shows the distribution of the listings by the drug category according to the terminology used on
Figure 1. Distribution of the number of listings according to product categories for the whole market
(n = 48,026) and Switzerland (n = 205).
Rhumorbarbe et al. / Forensic Science International (2016) 7
More than 25% of the market is about cannabis related products, including marijuana, hashish, seeds, oil and
synthetic cannabinoids. Categories such as ‘Ecstasy’ (MDA, MDMA), ‘Stimulants’ (cocaine, speed, crystal
MDMA) and ‘Psychedelics’ (LSD, mushrooms) are less represented with 10 to 16% of the listings. To a lesser
extent, respectively 7% and 2%, ‘Opioids’ (heroin, opium) and dissociative products (ketamine, MXE, GHB)
are also offered. Prescription drugs such as analgesics or erectile dysfunction treatment were also offered on
Evolution, specific categories were created for substances such as benzodiazepines and weight loss products.
These medicine products represent almost 18% of all listings while steroids have a proportion fewer than 4%.
Tobacco and paraphernalia (i.e. equipment to use drugs) appear to be rather anecdotal categories. Finally, fewer
than 2% of listings were not inserted in any category or were classified as ‘Other’.
The distribution for the listings marked as shipped from Switzerland is quite similar to the whole market
except for products classified as ‘Stimulants’ and ‘Opioids’. In proportion, cannabis is also the largest illicit
drug category offered by Swiss sellers. Ecstasy products are still in the three following categories. To the
contrary, stimulants and opioids frequencies for the Swiss market 20.0% and 16.6% respectively exceed
proportions observed in the general distribution.
In regards to the hypothesis that sellers may join the cryptomarket community to expend their distribution
area and incomes (see Table 2), the type of illicit drugs sold seems influenced by its accessibility. For example,
according to the World Drug Report 2015 [37], Western and Central Europe are among the main destinations
of opiates trafficking route originating from Afghanistan, which is the main producer of opiates. This could
explain the high proportion of opiates available on the Swiss market. The demand could also explain such
differences. To address this question, other indicators such as the number of vendors or the number of
feedbacks of each listing should be studied. Finally, it seems difficult to explain more precisely the differences
observed in Figure 1 without stating to which category each listing truly belongs. Such a classification was not
performed in this study, since its purpose was to draw an overview of the Swiss market.
However, the total number of listings with a Swiss origin is quite limited to 205 listings. Furthermore,
assessing trends according to the listings’ categorisation of Evolution is not without uncertainties. Indeed,
misclassifications are possible and some products may fall into several categories (e.g. new psychoactive
substances may be classified as ‘Stimulants’, ‘Psychedelics’, sub-categories of ‘Ecstasy’ or ‘Dissociatives,
RC’). Besides, the number of listings does not equal the number of different products offered on the
cryptomarket. Actually, some vendors offer several listings with similar titles except for quantities of product
(e.g. 6 listings for 5 to 1000 g of speed paste or 5 listings for 5 to 100 g of cocaine). Aldridge and Décary-Hétu
[18] noted the same practice on Silk Road. Such observation could indicate that vendors sell different products,
or try to target different kind of customers (i.e. we may assume that consumers would be interested in low
quantities for consumption while retailers would source bulk quantities).
3.2 Vendors Information
While some other cryptomarkets only display buyers’ feedback, Evolution vendors’ profiles also include the
number of transactions completed by the corresponding seller. Considering the whole population of sellers
offering illicit drugs on Evolution (n = 2,702), the number of transactions per seller is very wide (from 1 to
more than 9,000). Thus, among the most prolific sellers, 100 of them concentrate about 40% of all transactions.
Besides, it is worth noting that, on average, 62% of the transactions are subjected to some feedback. Such result
may help to discuss studies aiming at evaluating vendors’ income based on their amount of feedbacks [8 ; 18].
These studies assume that each transaction really occurred, while sellers may generate fictitious transactions to
achieve a better ranking or a higher positive feedback rate [14].
Rhumorbarbe et al. / Forensic Science International (2016) 8
Thirteen sellers claim to send products from Switzerland and they offer between 1 and 53 listings. Figure 2
shows the progression of nine Swiss sellers according to their number of completed transactions. For the sake
of readability, only those having completed more than 50 transactions are displayed.
Figure 2. Number of transactions for sellers shipping from Switzerland (with more than 50 transactions)
from August 2014 to March 2015.
Swiss sellers started to register on Evolution in June 2014. The first transactions occurred on August 2014.
Then, their progression is quite variable, and only four of them completed more than 100 transactions. Besides,
these four sellers managed to double their number of transactions (from 100 to 200) over a few months. They
may be considered as efficient sellers, exploiting their good reputation. For example, one of them received
feedbacks including comments such as “Very Quick delivery. Best quality. Thanks! FE is OK”. Likewise,
another seller’s profile page displayed comments about his products and concealment techniques: “hash is
definitely of good quality. Shipping was fast, with reliable stealth” or “Excellent product, professional vendor”.
It is worth reminding that Operation Onymous took place in late 2014. Since Evolution has not been taken
down, sellers with a rather good reputation before the Operation may have benefited from the closing down of
other marketplaces. Indeed, only one of them used his previous experience on other marketplaces to advertise
his products. This information was displayed on a “legacy sales” page, linked to the seller profile and featured
a number of verified transactions on Silk Road, Black Market Reloaded and Agora.
Rhumorbarbe et al. / Forensic Science International (2016) 9
3.3 Online orders
Among the items offered by Swiss sellers, three of them were chosen for purchase two individual grams
of cocaine and one gram of cannabis concentrate (see Table 3). The first item was ordered a second time, after
performing the chemical analyses (see further below). For cocaine hydrochloride, price of ordered products are
higher than prices encountered on the street market around 100 USD per gram in Switzerland, according to
UNODC [38]. Similarly, the cannabis concentrate purchased on Evolution is more expensive (around 13 USD
per gram on the street market). Beyond the fact that cryptocurrencies such as bitcoin tend to be versatile, price
differences may be explained by the selling process on cryptomarkets. Indeed, compared with the street market,
the service itself may lead to an increase of the price. From the consumer point of view, buying illicit drugs on
a cryptomarket is safer (relative anonymity and no physical contact with the seller) and more discrete due to
post delivery. The later could also induce postages fees since packaging material and techniques may be
expensive and time consuming. Overall, for customers, high prices are not an obstacle to the purchase of illicit
drugs on a cryptomarket. Besides, some researchers noted that consumers may agree to spend more money for
illicit drugs bought online, as they expect a better quality consumers [22 ; 39].
Date of receipt
1 14.10.2014 16.10.2014 Cocaine ca. $135
2 14.10.2014 16.10.2014 Cannabis concentrate ca. $60
3 27.11.2014 03.12.2014 Cocaine ca. $110
not ordered 03.12.2014 MDMA
4 10.12.2014 12.12.2014 Cocaine ca. $150
Table 3. Orders details of cocaine and cannabis products. One gram of product was ordered for each
For the third order, two extra pills were also received, probably as part of a development of customer loyalty
strategy. The corresponding vendor was active during a short period of time and only performed a limited
number of transactions. Concerning the two other vendors from which purchases were made, one of them left
the market shortly after the ordered was placed, while the other was active until Evolution closed.
3.4 Shipping method and packaging analysis
Table 4 summarises the package descriptions, and concealment measures used by vendors to ensure the
delivery to the customer. Every illicit drug ordered was sent through the standard Swiss postal services. A Swiss
return address with a fictitious name was indicated on one of the sending, most likely to avoid suspicion.
Thus, according to our four purchases, these results confirm the origin claimed by the vendors. In
regards to our specimen, the ‘ship from’ digital evidence thus seems reliable information to analyse the market
based on the country of origin.
External packaging is a conventional envelope with a “professional looking” as mentioned by Christin [19].
Concealed measures e.g. vacuum sealing, a static shielding bag were used by sellers and constitute what is
* Prices converted according to the exchange rate on Evolution index page and rounded to the nearest 5 USD.
Rhumorbarbe et al. / Forensic Science International (2016) 10
referred to as “stealth” methods by Martin [14] (see Appendix B for further illustrations). Indeed, these methods
seem obviously used to get through package inspection.
External packaging
Concealment measures
Padded envelope in C5 standard format
with self-adhesive label including printed
receiver address (see Fig. 3).
Heat-sealed static shielding bag containing
heat-sealed plastic bag with a Minigrip® bag
of the drug product (see Fig 4).
Paper envelope in C5 standard format with
fake printed sender address (see Fig 5.).
Heat-sealed plastic bag containing the
product on blotting paper. Plastic bag taped
to a post office sheet of paper (see Fig. 6).
3 Windowed paper envelope in C5 standard
format. DVD keep case containing heat-sealed
aluminium plastic laminated bags with a
Minigrip® bag of the drug product (see Fig.
4 Padded craft envelope in C5 standard
format with self-adhesive label including
printed receiver address (see Fig. 8).
Heat-sealed static shielding bag containing
heat-sealed plastic bag with a Minigrip® bag
of the drug product (see Fig. 9).
Table 4. Packaging descriptions (see Appendix B for Figures 3 to 9).
Overall, information about packaging displayed on the cryptomarket is consistent with the postal shipping
we received. For example, some sellers’ profile pages include a description of the external packaging often
presented as regular letters while others focus on concealment techniques (e.g. multiple sealing or special
boxing). Thus, the observations made on the packaging are overall in line with the online description. We can
infer that sellers explain their real modus operandi to reassure customers that their products have a good chance
to reach its destination. Even if our sample is limited, the physical analysis tends to confirm that the description
of packaging can be used as a relevant digital evidence to better understand sellers’ practices. A systematic
analysis of the online descriptions may thus lead to detect and follow the evolution of concealment strategies.
3.5 Chemical Analyses of the Products
Qualitative analyses confirmed the presence of the main psychoactive substance claimed to be sold for each
illicit drug purchased on Evolution. In other words, the advertised substance was present in the received
samples. Differences were, however, observed regarding the chemical composition. For instance, the purity
advertised on the listings always differed from the results of the quantitative analyses. In particular, it was lower
for every cocaine specimen (see Table 5). Lastly, composition of the ordered cocaine products did not differ
significantly from the cocaine specimen seized by law enforcement authorities in Western Switzerland in terms
of purity and cutting agents [34].
After the first set of orders in October-November 2014, a message was sent through the Evolution message
handler, to the seller who offered the first item (Order 1). The purpose of this message stating that the product
Rhumorbarbe et al. / Forensic Science International (2016) 11
quality was not as good as expected was to assess the influence of such a comment on the seller’s marketing
decision. No response to this message was ever received. However, since the corresponding listing was still
available, a second order was placed for the same product. It turned out to contain a product of similar quality
than the first one in terms of purity and cutting agents. The process was not replicated with the other sellers
since they were not active on Evolution anymore.
3.6 Chemical profiling of cocaine specimens
Cocaine products ordered in October and November 2014 (Orders 1 and 3) were not associated with any
existing chemical classes of our database. They are therefore not linked to any previously analysed cocaine
specimen. By contrast, the cocaine product ordered on December 10th (Order 4) was chemically linked to
specimens originating from three seizures confiscated in the Canton de Vaud; two seizures were performed in
May and September 2014 in Lausanne and one in May 2013 in Vevey. This chemical link based on profiling
means that the specimens were once part of the same physical unit before it was broken up for further
distribution [35].
Order Advertised product
Chemical composition
Active ingredient Average purity Cutting agents
1 1g of cocaine (≥ 95%) Cocaine HCl 33.7 ± 0.8% glucose, levamisole
2 1 g of cannabis concentrate
THC 49.6 ± 8.3% N/A
3 1g of cocaine (≥ 85%) Cocaine HCl 69.0 ± 1.2% levamisole, phenacetin
MDMA§ 26.7 ± 0.2% palmitic acid, stearic acid
4 1 g of cocaine (≥ 95%) Cocaine HCl 30.2 ± 0.1% glucose, inositol, levamisole,
Table 5. Results of the chemical analyses on ordered products.
4 General discussion and conclusion
4.1 Ethical considerations and further research
Despite the value of the information obtained through the analysis of illicit drugs bought online, such
research raises ethical questions. First, it implies encouraging illicit markets since orders and transactions are
actually carried out. Admittedly, quantities purchased are not excessive, but if further research was undertaken,
orders would need to be justified and planned to address specific questions. The fact that online purchases found
For cocaine specimen, average purity is calculated for the base form of cocaine.
§ 3,4-methylendioxy-methamphetamine.
Rhumorbarbe et al. / Forensic Science International (2016) 12
illicit activities may restrain the capacity to reproduce the experiment at a larger scale. Besides, as mentioned
by Soska and Christin [8] regarding their measurement, our study does not aim to support law enforcement
units to arrest sellers. This is the reason why we avoided identifying vendors from which the orders were placed
by mentioning their usernames in this article [40]. Finally, cryptomarkets versatility may constitute an obstacle
to a longitudinal analysis, especially if the aim is to address questions regarding sellers’ activities (e.g. chemical
links on a larger scale, stability according to vendors).
4.2 Digital Data Reliability
Crawling cryptomarkets is a challenging step. As mentioned by Dolliver [26], using a web crawler may result
in reliability issues. Hence, comparing data obtained through different crawling methods might be difficult, if
not possible. Consequently, it is worth reminding that information obtained by exploring this kind of data would
only lead to trends. Data is indeed partial, first because the crawling process is not repeated every day or the
same number of times each month. Secondly, when the crawling is performed, every single source code file is
not necessarily duplicated, as illustrated by the missing listing page for one of the orders. However, using such
data allows the estimation of the online prevalence of illicit drugs offers, as well as the number and activity of
vendors. The comparison of digital evidence with the results of the physical and chemical analysis performed
on purchased products helped to evaluate the reliability of the collected information. Since our number of
purchases is limited, our conclusions should, of course, be considered as indicative. Globally, it seems that
digital information about the type of product, the country of origin and the concealment techniques used by
sellers are accurate. The claimed quality of the products seems, however, less reliable information.
4.3 Perspectives for Forensic and Investigation Purposes
Presently, packages received in this study are made of plastic, paper or adhesive tape. Their forensic analysis
may lead to the detection of fingermarks or DNA traces. However, our legal authorization stated that our
research aimed only at studying the products sold online by purchasing illicit drugs and performing analyses.
Therefore, exploiting DNA traces or fingermarks for investigative purposes was not part of this study.
Interestingly, Van Hout and Bingham [20] pointed out, through online interviews of vendors, that many sellers
are using latex gloves and masks to avoid leaving fingermarks or DNA traces into or onto packages. The
packages of ordered products may lead to the detection of such traces for investigation purposes. Besides, in
the frame of an investigation, postal stamp notifies by which mail distribution centre a parcel went through,
providing a geographical indication of the region the sender may be located. In a multilingual country like
Switzerland, the use of additional material, such as printed paper for the second order (see Appendix B), may
provide information about the linguistic region where the seller comes from. Since they appear to be accurate,
packaging and concealment techniques descriptions should be more systematically studied. Indeed, they may
constitute an interesting lead to detect such packages while they are handled by postal services and customs for
international sales.
4.4 Drugs Quality Assessment and Profiling
Studying packaging and chemical results for the three ordered illicit drugs revealed both concordance and
discrepancies with what was advertised. As Van Hout and Bingham [20] noted, packaging is an important
component of quality assessment. The vendors from whom orders were placed used “stealth” methods
consistent with their profile pages. However, it appears not to be essential. Indeed, one of the Swiss sellers
turned out to be a rather successful vendor according to his number of transactions even though his profile
Rhumorbarbe et al. / Forensic Science International (2016) 13
page did not mention any packaging information. On the other hand, other sellers described meticulously their
products as well as their packaging, concealment techniques and refund process without achieving a
particular success on Evolution. The popularity of a seller appears to be the result of a complex process.
Specifically since assessing products quality may be a difficult task for consumers who consequently rely on
other aspects such as sellers ranking, packaging, previous comments or product appearances. Thus, as argued
by Bancroft and Scott Reid [41], quality takes a whole different meaning within a cryptomarket community
than in the chemical sense. Qualitative research also revealed the influence of the information found on
marketplaces or their related forums on consumers’ practices [21 ; 22 ; 39]. The same questions arose
regarding illicit drugs sold on the traditional market. Studies have shown the lack of knowledge of Belgian
consumers back in the 1990s [42]. While we may assume that online forums facilitated finding information and
sharing knowledge about illicit drugs more recently, the situation barely evolved. Indeed, more recently Evrard
and al. [43] highlighted that from a user perspective, the perceived quality of the cocaine depends on information
provided by the dealer and also on price. These factors continue to affect consumers after use, despite
adjustment on the actual cocaine content [43].
The chemical composition (i.e. purity, cutting agents) of cocaine purchased online is similar to specimens
confiscated by police and customs in Western Switzerland. It is worth noting that this observation is only
representative of cocaine hydrochloride sold from and to Switzerland. Generalising these results to other
shipping and destination countries is, so far, impossible. However, despite the limited number of orders, the
highlighted chemical links indicate that the products sold online and in the street share similar chemical
characteristics. On the one hand, an explanation would be that online sellers buy their products from street
dealers. On the other hand, both of them could share the same source of supply. Finally, a last hypothesis would
be that cryptomarkets allow street retailers to diversify their distribution channels. Nevertheless, as noted by
Martin [14], the limited knowledge of online distribution networks (e.g. online sellers’ position in the
distribution process) prevents a better assessment of this relationship. A recent study showed, however, that
analysing digital data might reveal important actors and distribution networks in Darknet markets [6].
Exploiting chemical information related to products sold on Darknet markets is a developing activity, mainly
for harm reduction purposes. [44]. The chemical profiling methodology we applied on the ordered substances
provide another perspective about chemical information. It constitutes an interesting tool to study distribution
networks, fuel hypotheses about sellers’ practices, show relations between traditional and online markets as
well as inform on products level within distribution channel.
5 Acknowledgements
The authors would like to thank Laetitia Gasté, from the ESC forensic laboratory, for performing the
chemical analyses and profiling of the illicit drugs.
The authors are also very grateful for Gwern’s work in the crawling process and for providing the data on
Rhumorbarbe et al. / Forensic Science International (2016) 14
6 References
[1] Meyers K, Kaynak Ö, Bresani E, Curtis B, McNamara A, Brownfield K, and al. (2015). The availability and depiction of
synthetic cathinones (bath salts) on the Internet: do online suppliers employ features to maximize purchases? International Journal of Drug
Policy, 26 (7), 670-4.
[2] Gelatti U, Pedrazzani R, Marcantoni C, Mascaretti S, Repice C, Filippucci L, and al. (2013). 'You've got m@il: fluoxetine
coming soon!': accessibility and quality of a prescription drug sold on the web. International Journal of Drug Policy, 24 (5), 392-401.
[3] Aked S, Bolan C, Brand M (2013). Determining what characteristics constitute a Darknet. Proceedings of the 11th Australian
Information Security Management Conference. Perth, Australia. 12-20.
[4] AlQahtani A, El-Alfy E (2015). Anonymous connections based on onion routing: A review and a visualization tool. Procedia
Computer Science, 52, 121-8.
[5] Zantout B, Haraty R (2011). I2P data communication system. Proceedings of the Tenth International Conference on Networks.
Sint Marteen, Netherlands Antilles. 401-9.
[6] Broséus J, Rhumorbarbe D, Mireault C, Ouellette V, Crispino F, Décary-Hétu D (2016). Studying illicit drug trafficking on
Darknet markets: structure and organisation from a Canadian perspective. Forensic Science International, 264, 7-14.
[7] Reid F, Harrigan M (2011). An analysis of anonymity in the bitcoin system. Proceedings of the International Conference on
Privacy, Security, Risk and Trust (PASSAT) and International Conference on Social Computing (SocialCom). Boston, USA. 1318-26.
[8] Soska K, Christin N (2015). Measuring the longitudinal evolution of the online anonymous marketplace ecosystem. Proceedings
of the 24th USENIX Security Symposium. Washington D.C., USA. 33-48.
[9] Böhme R, Christin N, Edelman B, Moore T (2014). Bitcoin: economics, technology, and governance. Journal of Economic
Perspectives, 29, Harvard Business School NOM Unit Working Paper No. 15-015. Available at
[10] Van Buskirk J, Roxburgh A, Bruno R, Burns L (2014). Drugs and the Internet, Issue 2. Available at
[11] Van Buskirk J, Roxburgh A, Bruno R, Burns L (2015). Drugs and the Internet, Issue 4. Available at & The Internet Issue 4.pdf (12.01.16).
[12] Tzanetakis M, Kamphausen G, Werse B, von Laufenberg R (2016). The transparency paradox. Building trust, resolving disputes
and optimising logistics on conventional and online drugs markets. International Journal of Drug Policy, (35), 58-68.
[13] Van Buskirk J, Roxburgh A, Bruno R, Burns L (2015). Drugs and the Internet, Issue 5. Available at & The Internet Issue 5.pdf (12.01.16).
[14] Martin J (2014). Drugs on the dark net - How cryptomarkets are transforming the global trade in illicit drugs. Basingstoke, UK:
Palgrave MacMillan.
[15] UNODC (2014). World Drug Report 2014. United Nations publication, Sales n° E.14.XI.7, 1-51.
[16] Phelps A, Watt A (2014). I shop online recreationally! Internet anonymity and Silk Road enabling drug use in Australia.
Digital Investigation, 11 (4), 261-72.
[17] Martin J (2014). Lost on the Silk Road: Online drug distribution and the 'cryptomarket'. Criminology & Criminal Justice, 14
(3), 351-67.
[18] Aldridge J, Décary-Hétu D (2014). Not an ‘eBay for drugs’: the cryptomarket “Silk Road” as a paradigm shifting criminal
innovation. Social Science Research Network. Available at (12.01.16).
[19] Christin N (2013). Traveling the Silk Road: a measurement analysis of a large anonymous online marketplace. Proceedings of
the 22nd International World Wide Web Conference. Rio de Janeiro, Brazil. 213-24.
[20] Van Hout MC, Bingham T (2014). Responsible vendors, intelligent consumers: Silk Road, the online revolution in drug trading.
International Journal of Drug Policy, 25 (2), 183-9.
[21] Van Hout MC, Bingham T (2013). 'Silk Road', the virtual drug marketplace: A single case study of user experiences.
International Journal of Drug Policy, 24 (5), 385-91.
Rhumorbarbe et al. / Forensic Science International (2016) 15
[22] Van Hout MC, Bingham T (2013). 'Surfing the Silk Road': A study of users' experiences. International Journal of Drug Policy,
24 (6), 524-9.
[23] Dolliver DS (2015). Evaluating drug trafficking on the Tor Network: Silk Road 2, the sequel. International Journal of Drug
Policy, 26 (11), 1113-23.
[24] Aldridge J, Décary-Hétu D (2015). A response to Dolliver's “Evaluating drug trafficking on the Tor Network: Silk Road 2, the
sequel”. International Journal of Drug Policy, 26 (11), 1124-5.
[25] Van Buskirk J, Roxburgh A, Naicker S, Burns L (2015). A response to Dolliver's “Evaluating drug trafficking on the Tor
network”. International Journal of Drug Policy, 26 (11), 1126-7.
[26] Dolliver DS (2015). A rejoinder to authors: Data collection on Tor. International Journal of Drug Policy, 26 (11), 1128-9.
[27] Xanthos A (2014). Textable: programmation visuelle pour l’analyse de données textuelles. Proceedings of the 12th international
Conference on Textual Data statistical Analysis. Paris, France. 691-703.
[28] R Core Team (2015). R: a language and environment for statistical computing. Vienna, Austria: R Foundation for Statistical
Computing. Available at
[29] Esseiva P, Gaste L, Alvarez D, Anglada F (2011). Illicit drug profiling, reflection on statistical comparisons. Forensic Science
International, 207 (1-3), 27-34.
[30] Broséus J, Anglada F, Esseiva P (2010). The differentiation of fibre- and drug type Cannabis seedlings by gas
chromatography/mass spectrometry and chemometric tools. Forensic Science International, 200 (13), 87-92.
[31] Broséus J, Vallat M, Esseiva P (2011). Multi-class differentiation of cannabis seedlings in a forensic context. Chemometrics
and Intelligent Laboratory Systems, 107 (2), 343-50.
[32] Esseiva P, Ioset S, Anglada F, Gasté L, Ribaux O, Margot P, and al. (2007). Forensic drug Intelligence: An important tool in
law enforcement. Forensic Science International, 167 (2-3), 247-54.
[33] Ioset S, Esseiva P, Ribaux O, Weyermann C, Anglada F, Lociciro S, and al. (2005). Establishment of an operational system for
drug profiling: a Swiss experience. Bulletin on narcotics of United Nations Office on Drugs and Crime, 57 (1-2), 121-47.
[34] Broséus J, Gentile N, Bonadio Pont F, Garcia Gongora JM, Gasté L, Esseiva P (2015). Qualitative, quantitative and temporal
study of cutting agents for cocaine and heroin over 9 years. Forensic Science International, 257, 307-13.
[35] Broséus J, Huhtala S, Esseiva P (2015). First systematic chemical profiling of cocaine police seizures in Finland in the
framework of an intelligence-led approach. Forensic Science International, 251, 87-94.
[36] Broséus J, Baechler S, Gaste L, Bonadio Pont F, Garcia Gongora JM, Gentile G, and al. (2016). Chemical Profiling: a tool to
decipher the structure and organisation of illicit drugs markets. An 8-year study in Western Switzerland. Forensic Science International,
266, 18-28.
[37] UNODC (2015). World Drug Report 2015. United Nations publication, Sales n° E.15.XI.6, 41-56.
[38] UNODC. UNODC Statistics - Drug prices repoort (cocaine-type in Switzerland). 2012.
[39] Barratt MJ, Ferris JA, Winstock AR (2014). Use of Silk Road, the online drug marketplace, in the United Kingdom, Australia
and the United States. Addiction, 109 (5), 774-83.
[40] Markham A, Buchanan E (2012). Ethical decision-making and Internet research - recommendations from the AoIR Ethics
Working Committee. Association of Internet Researchers. Available at (12.01.16).
[41] Bancroft A, Scott Reid P (2016). Concepts of illicit drug quality among darknet market users: Purity, embodied experience,
craft and chemical knowledge. International Journal of Drug Policy, 35, 42-9.
[42] Decorte T (2001). Quality control by cocaine users: Underdeveloped harm reduction strategies. European Addiction Research,
7 (4), 161-75.
[43] Evrard I, Legleye S, Cadet-Taïrou A (2010). Composition, purity and perceived quality of street cocaine in France. International
Journal of Drug Policy, 21 (5), 399-406.
[44] Caudevilla F (2016). The emergence of deep web marketplaces: a health perspective. The internet and drugs market (European
Monitoring Center for Drugs and Drug Addiction). Luxembourg: Publications Office of the European Union.
Rhumorbarbe et al. / Forensic Science International (2016) 16
Appendix A
6.1.1 GC-FID analysis methods
Cannabis analysis
MDMA analysis
GC Agilent 7891A
GC Agilent 7891A
Agilent 19091s-101: 1
HP-5MS 20m x 200µm x 0.33µm
Agilent 19091S-101: 1
HP-5MS 20m x 200µm x 0.33µm
Split 68:1 at 250°C
Splitless at 250°C
Carrier gas
100°C for 0 min
60°C/min to 280°C for 3 min
70°C for 0.203 min
39.465°C/min to 300°C for 2.027 min
Run time
6 min
8.0579 min
Flame ionisation detector
Flame ionisation detector
H2 flow
30 mL/min
30 mL/min
Air flow
400 mL/min
400 mL/min
Makeup flow
22 mL/min
24.028 mL/min
Appendix B
6.1.2 Order 1 Cocaine hydrochloride Seller_7
Figure 4. External packaging
Figure 5. Internal parcel containing cocaine
hydrochloride in different bags
Rhumorbarbe et al. / Forensic Science International (2016) 17
6.1.3 Order 2 Cannabis concentrate Seller_5
Figure 6. External packaging
Figure 7. Internal parcel containing cannabis
concentrate taped on a piece of paper
6.1.4 Order 3 Cocaine hydrochloride Seller_10
Figure 8. DVD keep case containing cocaine and MDMA pills in two different bags
Rhumorbarbe et al. / Forensic Science International (2016) 18
6.1.5 Order 4 Cocaine hydrochloride Seller_7
Figure 9. External packaging
Figure 10. Internal parcel containing cocaine
hydrochloride in different bags
... In particular, the top four product listing were for drugs, as were 90 percent of the top 10 listings and 16 of the top 20 product offerings. Across multiple cryptomarkets, cannabis, MDMA, and LSD consistently rank as the most frequently listed drugs on offer (Barratt et al., 2016a;Christin, 2013;Dolliver, 2015;Rhumorbarbe et al., 2016;Soska & Christin, 2015;Van Buskirk et al., 2016;Van Buskirk et al., 2013;Van Buskirk et al., 2014). ...
... The Agora cryptomarket, which ran from 2013 until 2015, had 867 vendors peddling their wares in its last year of operation (Van Buskirk et al., 2016). Evolution, another cryptomarket in operation until its administrators absconded with user funds in 2015, had around 2,700 vendors from 70 countries (Rhumorbarbe et al., 2016). In 2016, AlphaBay had some 1,582 vendors, with 25,395 cumulative drug listings and evidence of 153,331 sales as measured by customer feedback entries (Paquet-Clouston et al., 2018). ...
... Vendors (or vendor conglomerates), for their part, start this stage of the script by packaging the ordered product for delivery. Vendors who aim to maintain or build their reputations as well as minimize potential interception of the product in transit will likely package the drugs using a variety of stealth shipping techniques (Aldridge & Askew, 2017;Rhumorbarbe et al., 2016). While law enforcement manuals on drug interdiction are widely shared on Darknet forums (Martin, 2014a), online discussion of the specifics of vendor stealth practices tends to be discouraged by forum participants out of fear that law enforcement is watching (Smith & Frank, 2020 Heat sealed bags Plastic packaging melted together to produce an airtight seal. ...
Darknet drug market participants must complete a distinct cybercrime script if they are to successfully procure illicit substances online. This paper details the four generic stages (i.e. Informational Accumulation; Account Formation; Market Exchange; Delivery/Receipt) of a novel cybercrime script for Darknet drug markets. It also presents vignette examples of known law enforcement interventions that have effectively targeted each stage of the script to reduce usage of these marketplaces. While law enforcement interventions to close specific Darknet markets tend to have only short-lived effects on levels of illicit activity, the lens of the cryptomarket crime script highlights numerous additional steps beyond closure that law enforcement can effectively undertake to reduce use of these platforms.
... In addition to the above methods, the analysis of web page text is also a commonly used research method [16]. It can adopt methods of data mining and machine learning to analyze the data in hacker forums and Darknet markets and quickly screen out relevant threat intelligence [17][18][19]. ...
... ., wl[len1]) � text.split('') (18) ...
Full-text available
With the increase of data in the network, the load of servers and communication links becomes heavier and heavier. Edge computing can alleviate this problem. Due to a sea of malicious contents in Darknet, it is of high research value to combine edge computing with content detection and analysis. Therefore, this paper illustrates an intelligent classification system based on machine learning and Scrapy that can detect and judge fleetly categories of services with malicious contents. Because of the nondisclosure and short survival time of Tor Darknet domain names, obtaining uniform resource locators (URLs) and resources of the network is challenging. In this paper, we focus on a network based on the Onion Router (tor) anonymous communication system. We designed a crawler program to obtain the contents of the Tor network and label them into six classes. We also construct a dataset which contains URLs, categories, and keywords. Edge computing is used to judge the category of websites. The accuracy of the classifier based on a machine learning algorithm is as high as 89%. The classifier will be used in an operational system which can help researchers quickly obtain malicious contents and categorize hidden services.
... Packaging can easily be the cause of a delivery drawing unwanted attention, and getting intercepted by LEAs. For this reason, discussions on forums, along with previous research on the subject [28], point to certain practices, that are utilized to avoid detection, through eliminating smell and DNA traces, that could be left on the package. These practices are air-vacuuming the item at least once, use of heat-sealed bags/Moisture Barrier Bags (MBBs) and Mylar paper, printed labels, use of decoys for external packaging, in which the item can be hidden, and cleaning the packaging with alcohol. ...
... We also focus more on in-depth insight on the individual properties and practices of these platforms, as well as the reputation element, which is arguably a vital factor of this framework's successful operation, creating trust between vendors, buyers and marketplaces. Lastly, there has also been research targeting specific product types, such as drugs [28], [34], [35], firearms [29], [30], [36], as well as COVID-19 vaccines and proofs of vaccination [2], [15], contributing towards investigating the different characteristics associated with each type of illegal trading. ...
Conference Paper
Full-text available
Darkweb marketplaces have evolved greatly since the rise of the Silk Road in 2011, the first platform of its kind, and have become a highly profitable underground trading ecosystem, which provides anonymity for both buyers and sellers. Law enforcement along with researchers, have been successful in taking down marketplaces over the years. However, the combination of mechanisms implemented by these platforms (e.g. payment mechanisms, cryptocurrencies, trust systems), along with the success of the Tor network's anonymity properties, have made marketplaces much more enticing to users, while providing ease of access and use, as well as resilience against hostile actions. Through qualitative methods, this paper presents a mapping of darkweb marketplaces. We systematically investigate the operation of 41 marketplaces, along with more than 30 vendor shops, and gather information about the mechanisms and features implemented. Additionally, to acquire real world information, we explore the marketplaces' integrated forums, as well as 4 popular independent ones, focusing on discussions between vendors, buyers and marketplace owners, on topics related to illegal trading. We believe that gaining an up-to-date and deep understanding of the framework that marketplaces are built upon, is the first step towards discovering its weaker spots, with their exploitation being the ultimate goal.
... However, there have also been qualitative approaches, with the goal of documenting the various elements that darkweb marketplaces are composed of and map their operation, such as the work of Georgoulias et al. [11] and Kermitsis et al. [16]. Additionally, there has also been research focusing on speciic types of products and services, such as digital products [12], drugs [9,17,29], and irearms [5,7,21]. ...
Full-text available
COVID-19 vaccines have been rolled out in many countries and with them a number of vaccination certificates. For instance, the EU is utilizing a digital certificate in the form of a QR-code that is digitally signed and can be easily validated throughout all EU countries. In this article, we document the current state of the COVID-19 vaccination certificate market in the darkweb with a focus on the EU Digital Green Certificate (DGC). We investigate 17 marketplaces and 10 vendor shops that include vaccination certificates in their listings, and discover that a multitude of sellers in both types of platforms are advertising forging capabilities. According to their claims, it is possible to buy fake vaccination certificates issued in many countries worldwide. We demonstrate some examples of such sellers, including how they advertise their services, and we develop a taxonomy of EU COVID-19 certificate forging capabilities, describing the potential methods that the vendors are utilizing to generate certificates. We highlight two particular cases of vendor shops, with one of them showing an elevated degree of professionalism, showcasing forged valid certificates, the validity of which we verify using two different national mobile COVID-19 applications.
...  Купуване ⇒ забелязва се тенденция за доставки по домовете и електронно плащане, поради незаконната търговия с ПАВ чрез Darknet [24]. ...
Full-text available
Substance addiction is biopsychosocial disorder which occurs with health‐threatening behaviors that determine the development of co‐morbid somatic diseases. The patients are a vulnerable group in pandemic of the Coronavirus disease 2019 (COVID‐19) caused by the new Severe Acute Respiratory Syndrome Coronavirus 2 (SARS‐CoV‐2). The accompanying somatic problems and the characteristic substance‐seeking behavior are a prerequisite for a severe course and poor prognosis of COVID‐19 among patients suffering from substance use disorders. Objectives: Due to the social isolation and reduced resource of health services in the context of a pandemic, access to many of the key therapeutic elements in the treatment of addictions has been reduced. This led to an increase in the need for hospital care and necessitated the development of an Inpatient Treatment Algorithm at the State Psychiatric Hospital for Treatment of Drug Addiction and Alcoholism during the COVID‐19 pandemic. Materials and methods: For the period from 26.03.2020 to 26.11.2020, 143 patients with substance use disorders were hospitalized in the State Psychiatric Hospital for Treatment of Drug Addiction and Alcoholism. During this process, all the recommendations of the World Health Organization and the restrictive measures imposed by the Ministry of Health were followed. Each patient underwent a PCR test and followed isolation measures were applied until the results were obtained. Cross‐education was conducted among the hospital staff and specialized medical teams were formed, providing continuous care for new patients. Results: We have developed 3 Algorithms for inpatient admission, in accordance with the current epidemic conditions and the relevant legal provisions. The three models have proven feasibility and effectiveness, both in meeting the needs of people suffering from substance use disorders and in the prevention of COVID‐19 infection among medical staff and already hospitalized patients. Conclusion: In the conditions of a pandemic, it is necessary to introduce innovative strategies to deal with the increased needs for medical care of addicts. We propose the hypothesis that the Algorithms developed by the State Psychiatric Hospital for Treatment of Drug Addiction and Alcoholism have the potential to be applied to any risk contingent of patients in the conditions of global crisis. © 2021, Bulgarian Psychiatric Association (BPA). All rights reserved.
... instances, there is global competition among suppliers (Albridge and Askew 2017;Rhumorbarbe et al. 2016). This can lead to lower prices in the long run.Large technological changes also occur through the identification of more powerful intoxicants, such as the introduction around 2013 of fentanyl as an adulterant to heroin, or through an innovative form that can increase potency per dose, such as the development of crack out of powder cocaine. ...
... The pink liquid contained in a bottle which the patient informed as pentobarbitone, was not tested because it had been discarded prematurely, but it looked visually similar to a pentobarbitone solution described in a previous report [6]. A darknet marketplace is a dark web site designed as a source for discussion and for purchasing illicit substances from many countries [10]. This patient confirmed after he was awake that he had obtained pentobarbitone from the Internet for the purpose of suicide; he believed that the pentobarbitone was called "Do Lethall", and it had been shipped from Mexico similar to previous case reports [2,3,6]. ...
Full-text available
Deaths caused by barbiturate overdoses have increased in the past decade, especially as a result of suicide attempts. Pentobarbitone is a central nervous system depressant used for sedation and euthanasia in veterinary medicine. However, pentobarbitone analysis is not commonly available in the hospital setting; hence, its occurrence in overdoses is under-reported. Herein we describe a patient who ingested pentobarbitone obtained from the Internet with the purpose of ending his life. He became comatose and required ventilation for 6 days. While critically ill, the drug and a barbiturate test kit were found in his room at his residence. Toxicological analysis of the patient’s blood determined the presence of pentobarbitone at levels of 91, 56, and 19 mg/L at 11, 59, and 107 h after ingestion, respectively. With supportive care, the patient made a full recovery. He stated that he believed the liquid was to be pentobarbitone, and that he had received advice on its use from an online forum that he had found on a dark web marketplace. In this report, we highlight the process by which we facilitated pentobarbitone analysis with a rapid turnaround time, which helped to inform clinical management and raise awareness among clinicians. The access was made through the Prescription, Recreational and Illicit Substance Evaluation (PRISE) programme, which is a collaborative network among the New South Wales (NSW) Ministry of Health, NSW Poisons Information Centre (PIC), and NSW Health Pathology Forensic & Analytical Science Service (FASS). Key points • We report a patient with confirmed severe pentobarbitone toxicity who developed coma, respiratory failure, barbiturate related skin and vascular manifestations who required intensive care for 6 days. • • The diagnosis of pentobarbitone poisoning can be missed as it is not routinely included in Australian standard hospital urine drug screens, and it may not cross-react with phenobarbitone testing which may be more readily available. • • Timely access to comprehensive toxicology testing with rapid turnaround time assists diagnosis for unknown toxicity, and enhances case management and public health interventions. • • The PRISE programme in Australia is a collaboration between multiple health functional units in NSW, Australia that provides timely access to extensive toxicology testing for severe and unusual toxicity from drugs or substance-related toxicities.
... The consumption of illicit drugs, and thus, the criminal activities associated with their production and marketing, continue to grow each year [1]. As a result, there is an increasing demand for analytical methodologies applicable to a variety of contexts such as the investigation of consumption habits, the monitoring of rehabilitation treatments or the characterization of seizures, among others [1,2]. The analytical strategy to be applied depends on the intended purpose of the analysis, and a variety of approaches are in current use, from those involving highly sophisticated chromatographic equipment coupled to spectrometers and/or chemometric data treatment [3][4][5] to simple chemical spot tests [6,7]. ...
Full-text available
Due to their simplicity, speed and low cost, chemical spot tests are increasingly demanded for the presumptive identification of illicit drugs in a variety of contexts such as point-of-care assistance or prosecution of drug trafficking. However, most of the colorimetric reactions used in these tests are, at best, drug class selective. Therefore, the development of tests based on chemical reactions with improved discrimination power is of great interest. In this work, we propose a new colorimetric assay for amphetamine (AMP) based on its reaction with solutions of alkaline gold bromide to form an insoluble yellow–orange derivative. The resulting suspensions are then filtered onto nylon membranes and the precipitate collected is used for the visual identification of AMP. The measurement of the absorbance of the membranes by diffuse reflectance spectroscopy also allows the quantification of AMP in a simple and rapid way, as demonstrated for different synthetic and drug street samples. On the basis of the results obtained, it was concluded that the proposed procedure is highly selective towards AMP, as this compound could be easily differentiated from other common drugs such as methamphetamine (MET), ephedrine (EPH), scopolamine (SCP) and cocaine (COC).
Background The expansion of online drugs markets has widened opportunities to purchase drugs, for both personal use and wider distribution, thus creating new potential public health risks. However, there is little research on the motivation of online drug purchasers or the level of risk that such transactions pose to different communities. Greater insights into the intended use of drug parcels arriving by post, and how this varies across communities could help law enforcement and health services develop more effective policies and better allocate resources to reduce drug-related harms. Methods We use Scottish administrative data about illegal drug parcels seized by the UK Border Force to create a new classification of ‘buyer motivation’ (based on type of drug, estimated number of doses purchased, and patterns of drug consumption). We identify three potential types of buyer motivation: personal consumption, heavy use or social dealing, and wholesale dealing; and examine the extent to which each type is associated with a range of drug-related community risk factors, thereby identifying potential variation in levels of public health risk. Results Communities to which drug parcels were destined differed significantly from the Scottish average across a range of factors; however, this varied by buyer motivation. Parcels thought to be purchased for heavy use or social dealing appeared to pose a greater risk within communities characterised by general deprivation, but especially health-related deprivation, with a high youth population but low unemployment rates; whereas those purchased for wholesale dealing appear most likely to pose a risk in communities with higher crime and unemployment rates. Conclusions Administrative data about intercepted drug parcels could be helpful in classifying the motivation of online drug purchasers and monitoring patterns of variation in potential public health risks at a community level. This could support law enforcement and public health agencies to develop more targeted drug-harm reduction strategies.
Conference Paper
Full-text available
We perform a comprehensive measurement analysis of Silk Road, an anonymous, international online marketplace that operates as a Tor hidden service and uses Bitcoin as its exchange currency. We gather and analyze data over eight months between the end of 2011 and 2012, including daily crawls of the marketplace for nearly six months in 2012. We obtain a detailed picture of the type of goods sold on Silk Road, and of the revenues made both by sellers and Silk Road operators. Through examining over 24,400 separate items sold on the site, we show that Silk Road is overwhelmingly used as a market for controlled substances and narcotics, and that most items sold are available for less than three weeks. The majority of sellers disappears within roughly three months of their arrival, but a core of 112 sellers has been present throughout our measurement interval. We evaluate the total revenue made by all sellers, from public listings, to slightly over USD 1.2 million per month; this corresponds to about USD 92,000 per month in commissions for the Silk Road operators. We further show that the marketplace has been operating steadily, with daily sales and number of sellers overall increasing over our measurement interval. We discuss economic and policy implications of our analysis and results, including ethical considerations for future research in this area.
Full-text available
Cryptomarkets are online marketplaces that are part of the Dark Web and mainly devoted to the sale of illicit drugs. They combine tools to ensure anonymity of participants with the delivery of products by mail to enable the development of illicit drug trafficking. Using data collected on eight cryptomarkets, this study provides an overview of the Canadian illicit drug market. It seeks to inform about the most prevalent illicit drugs vendors offer for sale and preferred destination countries. Moreover, the research gives an insight into the structure and organisation of distribution networks existing online. In particular, we provide information about how vendors are diversifying and replicating across marketplaces. We inform on the number of listings each vendor manages, the number of cryptomarkets they are active on and the products they offer. This research demonstrates the importance of online marketplaces in the context of illicit drug trafficking. It shows how the analysis of data available online may elicit knowledge on criminal activities. Such knowledge is mandatory to design efficient policy for monitoring or repressive purposes against anonymous marketplaces. Nevertheless, trafficking on Dark Net markets is difficult to analyse based only on digital data. A more holistic approach for investigating this crime problem should be developed. This should rely on a combined use and interpretation of digital and physical data within a single collaborative intelligence model.
Full-text available
Background: In recent years, marketplaces in the darknet emerged where vendors and customers can exchange illicit drugs and other goods on digital platforms by using hidden internet services. The main thesis of this paper is that in an online environment, different practices for building trust and reputation emerge that stabilise market processes. Methods: Qualitative and quantitative data from a recent German project on conventional (offline) small-scale drug dealing as well as qualitative case studies on four online vendors operating on Agora market are used to explore alternative practices for building trust and reputation. They also explore the use of violence and logistics established on cryptomarkets in comparison to traditional dealing. To analyse the data we applied qualitative content analyses. Results: For conventional commercial illicit drug dealing on various kinds of markets, trust between buyer and seller is a crucial issue, often emphasized by restricting deals to well-known persons. While this typically includes face-to-face contact, the opposite is true with online drug trading. It is characteristic of cryptomarkets that the parties involved in a transaction know neither the personal identity nor the physical location of one another. This is realised by using aliases, anonymising software, and cryptocurrencies for payments. Violence typically only plays a role in traditional drug dealing, but mostly, if at all, just as a latent threat for potential rule-breakers. Processing a transaction anonymously includes escrow services for the buyers, which makes trading more reliable, although they cannot completely prevent scamming. Furthermore, online drug marketplaces usually offer a customer feedback system that allows customers to rate vendors and review products. A positive vendor feedback helps building reputation and trust in such an online environment. With regard to logistics, most conventional small-scale dealers restrict their acts of selling to private surroundings to avoid encounters with law enforcement. In cryptomarkets, the purchased drugs are delivered by traditional postal services, sometimes to false addresses or to someone else's name to conceal the identity and address of the buyer. Conclusion: On virtual drug markets practices of building trust, conflict resolution and logistics is constantly evolving. They offer improved security solutions on the one hand while on the other hand scamming and fraud seem to be widely used on both online and conventional drug markets.
This study explores the rapidly expanding world of online illicit drug trading. Since the fall of the infamous Silk Road, a new generation of cryptomarkets can be found thriving on the dark net. Martin explores how these websites defy powerful law enforcement agencies and represent the new digital front in the 'war on drugs'.
Illicit drug analyses usually focus on the identification and quantitation of questioned material to support the judicial process. In parallel, more and more laboratories develop physical and chemical profiling methods in a forensic intelligence perspective. The analysis of large databases resulting from this approach enables not only to draw tactical and operational intelligence, but may also contribute to the strategic overview of drugs markets. In Western Switzerland, the chemical analysis of illicit drug seizures is centralised in a laboratory hosted by the University of Lausanne. For over 8 years, this laboratory has analysed 5875 cocaine and 2728 heroin specimens, coming from respectively 1138 and 614 seizures operated by police and border guards or customs. Chemical (major and minor alkaloids, purity, cutting agents, chemical class), physical (packaging and appearance) as well as circumstantial (criminal case number, mass of drug seized, date and place of seizure) information are collated in a dedicated database for each specimen. The study capitalises on this extended database and defines several indicators to characterise the structure of drugs markets, to follow-up on their evolution and to compare cocaine and heroin markets. Relational, spatial, temporal and quantitative analyses of data reveal the emergence and importance of distribution networks. They enable to evaluate the cross-jurisdictional character of drug trafficking and the observation time of drug batches, as well as the quantity of drugs entering the market every year. Results highlight the stable nature of drugs markets over the years despite the very dynamic flows of distribution and consumption. This research work illustrates how the systematic analysis of forensic data may elicit knowledge on criminal activities at a strategic level. In combination with information from other sources, such knowledge can help to devise intelligence-based preventive and repressive measures and to discuss the impact of countermeasures.