Content uploaded by Quentin Rossy
Author content
All content in this area was uploaded by Quentin Rossy on Oct 06, 2017
Content may be subject to copyright.
A geographical analysis of trafficking on a popular darknet market
Julian Broséus1, Damien Rhumorbarbe1, Marie Morelato2, Ludovic Staehli1, Quentin Rossy1
1 : Ecole des Sciences Criminelles, University of Lausanne, Lausanne, Switzerland
2 : Centre for Forensic Science, University of Technology, Sydney, Broadway, NSW,
Australia
Corresponding authors :
julian.broseus@unil.ch
damien.rhumorbarbe@unil.ch
Marie.Morelato@uts.edu.au
2
5
Abstract 6
Cryptomarkets are online marketplaces, located on the darknet, that facilitate the trading of a 7
variety of illegal goods, mostly drugs. While the literature essentially focus on drugs, various 8
other goods and products related to financial or identity fraud, firearms or counterfeit goods, as 9
well as doping products are also offered on these marketplaces. 10
Through the analysis of relevant data collected on a popular marketplace in 2014-2015, 11
Evolution, this research provides an analysis of the structure of trafficking (types and proportions 12
of products, number of vendors, shipping countries). It also aims at highlighting geographical 13
patterns in the trafficking of these products (e.g. trafficking flows, specialisation of vendors, role 14
in the distribution chain). 15
The analysis of the flow of goods between countries emphasises the role of specific countries in 16
the international and domestic trafficking, potentially informing law enforcement agencies to 17
target domestic mails or international posts from specific countries. The research also highlights 18
the large proportion of licit and illicit drug listings and vendors on Evolution, followed by various 19
fraud issues (in particular, financial fraud), the sharing of knowledge (tutorials) and finally goods, 20
currencies and precious metals (principally luxury goods). Looking at the country of origin, there 21
seems to be a clear division between digital and physical products, with more specific 22
information for physical goods. This reveals that the spatial analysis of trafficking is particularly 23
meaningful in the case of physical products (such as illicit drugs) and to a lesser extent for digital 24
products. Finally, the geographical analysis reveals that spatial patterns on Evolution tend to 25
reflect the structure of the traditional illicit market. However, regarding illicit drugs, country-26
specificity have been observed and are presented in this article. 27
28
29
Keywords : cryptomarket ; digital traces ; NPS ; trafficking flows; illicit market; spatial analysis 30
3
1. Introduction 31
The Internet continues to play an important role in illegal trafficking. It acts as a facilitator, 32
providing another medium for sales and purchases, and a platform for information sharing 33
between users. Users can access both legal and illegal commodities online from anywhere around 34
the world [1]. Cryptomarkets, located on the darknet, are only the last illustration of the transition 35
from illegal markets in the real world to the virtual world [2]. Visually very similar to popular 36
merchant websites like eBay and Amazon, cryptomarkets share several structural features with 37
conventional online sales sites. Lists of products and services offered by sellers are organised into 38
categories and subcategories. Sellers - and their products - are evaluated according to the 39
feedback left by their previous customers, trust and reputation being central components of the 40
trade on cryptomarkets [3]. Unlike conventional sales sites, however, cryptomarkets facilitate 41
exchanges in a context where the anonymity of administrators and participants is protected thanks 42
to the combination of encryption features. They are the connections through relays to make them 43
anonymous (using for instance the TOR - The Onion Router - browser) [4], the automatic 44
encryption of all communications through PGP - Pretty Good Privacy - cryptography [5] and the 45
payments with decentralised cryptocurrencies, mainly bitcoins [6]. 46
Considering the perpetual evolution of crime and the importance of the Internet in illicit 47
activities, analysing any illicit market should rely on a more holistic approach and take into 48
account the physical (i.e. traditional trafficking) as well as the virtual (i.e. online trafficking) 49
dimensions of the market. This analysis would enable a deeper understanding of the structure of 50
criminal groups online and potentially draw the link between the virtual world and the physical 51
world which is not currently known. Furthermore, analysing cryptomarkets represents an 52
interesting approach to inform on trends and dynamics that may affect the offline market. A 53
geographical analysis would also fuel hypotheses to better understand the role of cryptomarkets 54
as a new distribution channel, as sellers can source as well as sell drugs online. Sellers may also 55
move their trade to sell all or part of their merchandise while producers may decide to eliminate 56
certain intermediaries and sell directly to consumers [7]. Combining geographical analysis to 57
general knowledge about the traditional market might highlight the presence of new actors (e.g. 58
producers or retailers) and clarify the role played by cryptomarkets in the distribution chain. In 59
addition, from a country-specific perspective, trends regarding different categories of product 60
4
might be detected, and eventually monitored, from both demand and supply points of view. 61
Despite the added value of a geographical analysis, only a few studies provides a country-specific 62
perspective and they are focused on drugs trafficking and the darknet market named Agora [8,9]. 63
Differences in the availability of specific substances among shipping countries were observed by 64
these research works. It was concluded that spatial specificity can be due to different factors 65
affecting countries differently, such as geographic isolation, stringent border controls, relaxed 66
laws in regards to illicit goods, high prices of goods, strict control of internet access, proximity to 67
producing countries, domestic productions of goods and relative availability of illicit goods [8]. 68
Most research on cryptomarkets has focussed on drugs to evaluate the structure of the market 69
[2,10,11], characteristics of vendors [12–14], consumers/users’ demand [15,16], the investigation of sales 70
volume [11], vendors’ activity [17], wholesale vs. retail [18] and the coherence between digital and 71
physical information [19]. In a few words, literature shows that cryptomarkets are dominated by 72
English-speaking countries (the United States, the United Kingdom, Australia) and Western 73
European countries (in particular, the Netherlands) and the main offered and purchased illicit 74
drugs are cannabis, stimulants (cocaine and amphetamines), ecstasy (MDMA) and psychedelics 75
(NPS, LSD) [8,10,16,20]. 76
Although drugs are offered and sold prolifically online; various illegal services and products 77
related to financial or identity fraud as well as counterfeit goods are also offered on the 78
cryptomarkets. To our knowledge, no information is available on the proportions these categories 79
represent on darknet markets. In this context, this study will provide information on the types and 80
frequencies of all the products offered on the cryptomarket Evolution. Geographic information 81
will also be analysed to highlight specific patterns in the trafficking of certain substances or 82
goods and reveal specificities of the illicit market for a particular country (e.g. the specialisation 83
in the distribution of certain types of products). Such analysis will provide a comparison of the 84
distribution of physical and digital products and help to explain the relation between the origin 85
country and the type of product. In most studies, only the origin country is analysed. Here, a 86
combined analysis of shipping countries and destinations will be performed to highlight 87
trafficking flows and therefore evaluate the trafficking nature from certain countries (i.e. 88
domestic vs. international). Lastly, the structure of illicit drugs trafficking as well as its 89
geographic distribution will be investigated. The results will be confronted to knowledge 90
5
regarding the traditional market to assess the relationship between the online and offline markets. 91
The NPS will be specifically studied to evaluate which countries are at the forefront of the 92
trafficking and even their role in the distribution chain. This specific example will indicate how 93
the online trade reflect knowledge regarding the traditional trafficking. 94
95
2. Dataset and methodology 96
The cryptomarket Evolution was studied since it was a popular cryptomarket during its period of 97
activity, from January to March 20151. In particular, it was very attractive to users since it 98
survived “Operation Onymous” in late 2014 [21]. The dataset used in this study is a compilation of 99
source codes collected, gathered and released by an independent researcher named Gwern 100
Brawnen2. He performed data collection over 115 days between January 2014 and March 2015. 101
Although the data is not exhaustive as the crawling was not conducted every day and the pages 102
that presented an error were not downloaded, the crawls were frequent enough (weekly) and 103
millions of pages were downloaded by the researcher [22]. As a consequence, the dataset used in 104
this study can be considered representative for the purpose of the research. 105
This dataset has already been used in a previous research in order to provide an overview of 106
Evolution in an attempt to test the reliability of vendors’ listings by purchasing illicit drugs and 107
analysing them [19]. The present research is not only focused on drugs related listings but on all 108
goods offered on Evolution. Each listing of every category was parsed by the authors through a 109
Python script to extract its title, price and classification within the cryptomarket, as well as the 110
vendor pseudonym and the geographical information - i.e. the mentioned shipping country and 111
destination(s). Vendor username was used to evaluate the total number of vendors present on a 112
cryptomarket as well as the product category where vendors were the most present [11,17]. 113
Trafficking flows between countries were also obtained using country of origin and destination 114
country. Section 3.5 deals with the evaluation of the role of countries within the distribution 115
chain of NPS. For this purpose, the quantity and price of the offered products were investigated 116
for each listing. All information was structured to allow further analysis and to accurately study 117
1 It is assumed that the administrators of Evolution “exit scammed” (DeepDotWeb, 2015)
2 Data available on the Reddit page https://reddit.com/2zllmv
6
the trafficking structure on Evolution. A new classification of listings was carried out. Indeed, the 118
overview of the worldwide market would otherwise be uncertain and specific patterns 119
(predominance of a product category, specific spatial distribution, etc.) could also be unclear or 120
even hidden (see Appendix 1 for details about the new classification we performed), as also 121
observed by other researchers [8,9,18,22]. 122
Data analysis was performed using R [23], RStudio v. 1.0.136, Tableau Software Professional 123
Edition v. 9.3 and Microsoft Excel v. 15.31. Trafficking flows (section 3.3) were represented as 124
chord diagrams using the R library circlize3. Only for this particular analysis, listings with 125
unstated shipping destinations were removed (n = 40,851). 126
3. Results and discussion 127
128
3.1. Products offered 129
The extraction of each listing source code for every crawling date led to the identification of 130
92,980 unique sale proposals, after discarding six listings that stated unclear shipping country 131
information. A total number of 4,171 distinct vendor usernames was detected. Results show that 132
a vendor may manage one or more listings (min = one listing, max = 1,441, median = 9, mean = 133
22, standard deviation = 49). 134
Most of the sale proposals (63%) concern licit or illicit drugs and paraphernalia, in particular, 135
illicit drugs (close to 50% of all listings), as illustrated in Table 1 below. This is also the sub-136
category where vendors are the most present (close to 60% of vendors offer at least one product 137
classified as illicit drug). Specific trends concerning the distribution of illicit drugs will be 138
discussed in the section 3.5. This category also includes prescription drugs and medicines 139
(mainly benzodiazepines - 34% and synthetic opioids - 31%), performance and image enhancing 140
drugs (PIEDs, mainly steroids) as well as, to a lesser extent, laboratory supplies and 141
paraphernalia. Listings related to various fraud issues represent almost a third of the total number 142
of listings and close to half of vendors propose products classified in this category. Several 143
3 https://cran.r-project.org/web/packages/circlize/index.html
7
activities and services related to carding4 are particularly covered (listings classified as carding 144
represent close to 70% of the listings grouped in “Fraud Related”). Goods with a high probability 145
of forgeries are mainly concerned in the third category “Goods, currencies and precious metals”. 146
Indeed, luxury goods (essentially watches - 89%) and clothes and accessories (glasses - 21%, 147
bags - 18% and shirts - 14%) represent about 60% of the sale proposals in this category. 148
Interestingly, only a few vendors offer goods in these two categories. The “ID Related” category 149
includes sale proposals related to ID theft (37%), various types of licences and legitimation 150
documents such as bank statements or university diplomas (35%) and IDs (28%). ID theft mainly 151
consists in “fullz”, as advertised by vendors, that are archives containing financial information 152
(bank account logins or credit card numbers) and personal information (name, address, e-mail, 153
security social number, date of birth, mother’s maiden name, etc.). According to the listing titles, 154
the IDs subcategory includes scans of ID cards or passports, editable graphical material as well as 155
genuine or forged IDs. Lastly, about 1,000 listings were classified as “Firearms & Weapons” in 156
which a third of sale proposals concerns firearms. 157
158
Insert Table 1 159
4 Carding concerns the acquisition (through skimmers at ATMs or hacking an e-commerce, for instance) and resale
of credit cards and bank accounts as well as related activities such as money laundering (e.g. money transfer using
bitcoins, money transfer companies or acquisition of prepaid cards) or reshipping services through mules.
8
160
Table 1. Listings’ and vendors’ proportions for the different categories of products. Listing/Vendor percentages are 161
calculated as the ratio between the respective number of listings/vendors for each product main categories and the 162
respective total number of listings/vendors in the whole market (n = 92,980 listings and 4,171 vendors). 163
* : Since a same vendor account may manage listings classified in different (sub-)categories, the number of vendors 164
may be higher than the total number of vendors calculated according to their usernames. 165
✭ : Listing/Vendor percentages of subcategories are calculated as the ratio between the respective number of 166
listings/vendors for each subcategory and the total number of listings/vendors of the main category. 167
ATS : Amphetamine Type Substances (Amphetamine and Methamphetamine) 168
9
3.2. Shipping countries 169
On Evolution, vendors may inform on the shipping country and destination(s) of their products 170
by selecting countries/regions from a preset list. According to our dataset, 93 shipping countries 171
and 164 shipping destinations have been mentioned (see Appendix 2 Table B1). On a given sale 172
proposal, vendors always mentioned one shipping country only, while a list of destination 173
countries was sometimes stated. Vendors may manage several listings. A combined study of 174
vendor usernames and shipping countries shows that vendors may state different shipping 175
countries between their sale proposals, even though they mostly mention only one shipping 176
country (see Figure 1). 177
Insert Figure 1 178
179
Figure 1. Number of vendors mentioning one or more shipping countries in their sale proposals 180
181
182
10
An analysis of the frequency of shipping countries indicates that “Worldwide” was mentioned by 183
close to 50% of all vendors and stated in close to 40% of all listings. The predominance of this 184
statement may be seen as a limitation for a valid assessment of the trafficking magnitude of 185
specific countries when analysing the global market. Indeed, this high proportion implies that we 186
may underestimate the position of a specific country in the market. However, we may also 187
assume that vendors from any country may choose to indicate “Worldwide”. In this case, the 188
proportions may be quite accurate. Interestingly, stating “Worldwide” depends on the nature of 189
the product proposed by vendors, as shown in Table 2. There is a clear division between digital 190
and physical products. For instance, hacking services or material related to financial fraud 191
(“Fraud related” category), manuals (“Guides and tutorials”) and scans of IDs or legitimation 192
documents (“ID related”) are digital products. Instead, counterfeit goods (“Goods, currencies 193
and precious metals”), chemicals (“Lab supplies and paraphernalia”) or any type of drugs 194
(“Prescription drugs and medicines, PIED and Illicit drugs”) are physical. The origin country 195
does not represent a meaningful information for digital goods that are sent through the Internet, 196
which may explain the high proportion of vendors selecting “Worldwide” as the shipping 197
country. To the contrary, the delivery mode of physical material makes it possible to check the 198
coherence between the origin country stated online and that written down on the postal parcel. 199
Therefore, vendors may not have interest to provide incorrect information since customers may 200
leave negative feedbacks in the case of inaccurate data [8]. This would explain why vendors 201
mainly provide a meaningful shipping country when offering physical products and do not utilise 202
the “Worldwide” statement. Vendors still stating their physical products as shipped from 203
“Worldwide” may like to conceal the true origin of their merchandise or they prefer to provide 204
details in the description part of the listing. Thus, the spatial analysis of trafficking on 205
cryptomarkets is particularly meaningful in the case of physical products and to a lesser extent for 206
digital products. 207
208
11
209
Table 2. Listings and vendors’ proportions where “Worldwide” was mentioned as the origin country for each 210
product category 211
212
Without considering “Worldwide”, the analysis of the stated origin countries shows the dominant 213
position of English speaking countries (the United States, the United Kingdom and Australia) and 214
Western European countries (Germany and Netherlands) which was also observed in [20] (see 215
Table 3). Although since 2013, several non-English language markets have appeared, English 216
seems to remain the dominant language. This might be a result of the central position of English-217
speaking countries in online trades or the fact that English is usually the trading language which 218
might deter non-English vendors from offering goods [20]. It is worth noting that while some 219
countries have similar proportions of both listings and vendors (the United Kingdom, Germany or 220
Sweden, for instance), the listing proportions of China & Hong Kong are three times higher than 221
their respective vendor proportions. This clearly reveals a specificity of their market structure: a 222
few vendors are involved but they manage a large number of listings. Since each listing may be 223
purchased several times by customers, this result may indicate that vendors have stock and thus 224
have access to a steady long-term supply of the products they offer. The small number of Chinese 225
vendors may be explained by the very strict control of China’s Internet traffic [24]. In addition, 226
trafficking on online darknet platforms might not be considered as effective for Chinese vendors 227
for various reasons. Indeed, the registration process on the darknet markets (e.g. fees, access 228
constraints, etc.) may be considered by Chinese vendors as too restrictive, urging them to adopt 229
other ways of distribution such as dedicated websites on the clear web. Thus, the clear web may 230
12
be the main reason explaining the relatively minor position of the Chinese market on the darknet, 231
since it represents an efficient method for the distribution of products in which Chinese vendors 232
specialise, as it will be discussed further below (see sections 3.4 to 3.6). 233
234
Insert Table 3 235
236
Table 3. Proportion of listings and vendors for the shipping countries having at least 1% of the total number of 237
listings 238
* : Since vendors may mention different shipping countries between their listings, the sum of percentages is higher 239
than 100% 240
241
242
243
244
245
246
13
3.3. Trafficking flows 247
A combined analysis of shipping countries and destinations was performed to evaluate the nature 248
of trafficking for the main countries (see Figure 2). First, Figure 2 clearly shows the distinction 249
between physical (e.g. illicit drugs) and digital (e.g. ID related) goods discussed above. The 250
“Worldwide” origin is much more mentioned for ID related goods than for illicit drugs (see Table 251
2 and Figure 2). 252
In addition, such analysis reveals the behaviour of vendors and the market dynamics for each 253
country, and reciprocally. Interestingly, the flow of illicit drugs is essentially domestic in 254
Australia (i.e. Australian sellers only propose products to customers living within the country) or 255
mainly in the United States. The domestic pattern may be explained by the intent of both 256
customers and vendors to reduce their risks (such as parcel loss, interception by authorities or 257
arrest) by selling or purchasing only within their country of residence [25]. Accordingly, Kruithof 258
et al. [20] mentioned that many vendors appear to be reluctant to ship to countries with stricter law 259
enforcement and border controls such as Finland, Australia, the United States and Canada. By 260
contrast, Germany, Canada and the Netherlands mainly export internationally. This may be 261
related to the role of these countries in the production of synthetic drugs, such as Ecstasy & 262
MDMA and amphetamines (see section 3.5) [26,27]. In the same line, a relative easy access to illicit 263
drugs in the domestic market would not stimulate local users to purchase substances on 264
cryptomarkets and would motivate sellers to export to foreign customers [25]. A more competitive 265
domestic market from vendors’ point of view would have the same consequence. The analysis of 266
trafficking flows also helps to understand and explain the offer patterns. For instance, if a 267
domestic market is observed, we may expect good correlation between the types and frequencies 268
of products offered and the prevalence data of the local population (or at least, the sub-population 269
sourcing drugs on cryptomarkets) (see section 3.5). 270
In an intelligence perspective, the identification of an important domestic market such as the one 271
in Australia or the United States may encourage a tighter control of mails inside the country. The 272
determination of the main countries that export internationally (e.g. China, the Netherlands or 273
Germany) may help to target posts from these specific countries. Furthermore, combining the 274
trafficking flows information to the types of good and the concealment methods indicated by 275
sellers online, which tends to match that of the delivered packages [19], may be of added value and 276
14
could help targeting specific types of packages from specific countries. 277
278
279
280
Figure 2. Structure of trafficking considering the whole market (left) and two categories of physical (top right) and 281
virtual products (bottom right). The circular plot shows the directional flows (origin and destination) of products for 282
the most frequent couples of origin and destination countries (i.e. couples having a frequency of at least 1% in 283
relation to the total number of existing combinations) 5 284
285
286
287
288
5 The origins and destinations of products are represented by the circle’s segments. A specific color is assigned to the
flows and circle’s segments of a particular country. The size of the flow is indicated by the width of the link and its
basis. The direction of the flow is encoded both by the origin color and by the gap between link and circle segment at
the destination. The direction goes from a non-gap to a gap. Listings with unstated shipping destinations were
removed from the analysis (n = 40,851).
15
3.4. Spatial specificity 289
To evaluate the specialisation of vendors from any country and their respective importance in the 290
trafficking of products, the distribution of listings and vendors for every country was analysed 291
(Figures 3 and 4) as well as their contribution to the total number of listings for each product 292
category (Figure 5). For instance, Figure 3 indicates that illicit drugs and prescription drugs 293
represent respectively 66.3% and 18.5% of all listings (when worldwide is excluded). We also 294
observe that 64% and 6.5% of the listings “from” respectively American and Indian vendors 295
concern illicit drugs. They are respectively managed by 710 and 8 vendors (see Figure 4). Lastly, 296
the analysis of Figure 5 shows that the United States accounts for 30% of all sale proposals on 297
Evolution (worldwide excluded). Moreover, vendors from the United States - in line with their 298
number (see Figure 4) - are the main contributors on Evolution since they dominate the 299
distribution of illicit drugs (29.2% of listings classified in the category are managed by 300
“American” vendors), prescription drugs (41.6%), fraud related (30.4%), lab supplies (48.1%) 301
and ID Related (59.1%). 302
303
304
Figure 3. Distribution of listings in product categories for every shipping country (without considering the 305
worldwide statement). * Country with less than 1% of the total number of listings 306
307
16
308
Figure 4. Number of vendors for each shipping country and product categories. 309
* Country with less than 1% of the total number of listings 310
311
312
Figure 5. Contribution (in terms of listing proportions) of each shipping country in product categories (without 313
considering the worldwide statement). * Country with less than 1% of the total number of listings 314
315
Figures 3 and 4 highlight the specialisation in prescription and illicit drugs of vendors from the 316
Netherlands (98% of listings and 93% of vendors), Canada (97% each), Spain (96% and 94%) or 317
Sweden (94% each). The specialisation of ‘Dutch vendors’ has also been observed by a study 318
based on more recent datasets that concluded that they use cryptomarkets almost exclusively for 319
drug sales and particularly ecstasy-type drugs and stimulants [20]. The specialisation of Indian 320
17
vendors in the distribution of prescription drugs (see Figure 3) is also worth to be highlighted, 321
especially when considering the small number of vendors they represent, compared to that of the 322
other countries present in the category (see Figures 4 and 5). This was also observed on the 323
cryptomarket Agora [9]. By contrast, sellers ‘from’ Australia, Germany, the United Kingdom or 324
the United States seem to diversify their activities. In line with their number of vendors (see 325
Table 3) they are predominant in each of all categories (Figure 4), which is also corroborated by 326
the study of the origin of listings for each category (Figure 5). In fact, these four countries 327
together dominate the distribution of products in the majority of categories, such as illicit drugs 328
(about 77% relative to the total number of listings of the category), prescription drugs (73%), 329
PIEDs (63%), fraud related (77%), lab supplies (86%), firearms (71%) and ID related (86%). 330
‘Guides and Tutorials’ and “Goods, currencies and precious metals” are the only two categories 331
where vendors from these countries are not predominant. “Guides and Tutorials” has been 332
flooded by one Belgian vendor who is responsible of 68% of listings in the category. The 333
“Goods, currencies and precious metals” category seems to be controlled by Chinese vendors 334
(71.8% of the listings, see Figure 5), while their number (13) is lower than other countries present 335
in the category such as the United States (67), the United Kingdom (31), Germany (17) and 336
Australia (16) (see Figure 4). In particular, they manage almost 99% of all listings classified as 337
“Luxury goods”, which mainly consist in watches & jewellery, and 85% of that classified as 338
“Clothes and accessories”. Most of the listing titles mention luxury brands, contain the term 339
“replica” and are sold at cheap prices. For instance, concerning watches (n = 1’347 listings), 340
Rolex is the most proposed brand (n = 314) followed by Omega (n = 217), Emporio Armani (n = 341
197), Breitling (n = 172) and Audemars Piguet (n = 149) and their prices range from 50 to 200 342
USD. Overall, all watch brands but one (Emporio Armani collection of the Giorgio Armani 343
industry) are affiliated to the Federation of the Swiss Watch Industry (FH), according to its 344
official website6. These results are consistent with the few sources of information regarding the 345
trafficking of luxury goods [28]. 346
347
6 http://www.fhs.ch/fre/watch_brands.html
18
The evaluation of the impact of countries in the trafficking of specific products as well as their 348
role in the distribution chain was found to be particularly relevant in the case of illicit drugs and 349
is therefore developed in the following section. Indeed, they represent the main good offered (see 350
Table 1) as well as the category where Worldwide is less stated (see Table 2 and Figure 2). 351
352
3.5. Illicit drugs 353
As mentioned in the introduction, English-speaking countries (e.g. the United States, the United 354
Kingdom, Australia) and Western European countries (e.g. the Netherlands) dominates the 355
trafficking of illicit drugs on cryptomarkets while cannabis, stimulants (cocaine and 356
amphetamines), ecstasy (MDMA) and psychedelics (NPS, LSD) are the main drugs offered on 357
cryptomarkets. In addition, compared to the traditional market, the relative low offer and 358
purchase of substances such as cocaine and heroin was noted by Kruithof et al. (2016). This may 359
be the consequence of the predominance of recreational consumers or psychonauts on 360
cryptomarkets [14,29,30]. The elements of planning and having to wait for delivery which 361
characterised cryptomarkets might deter excessive consumers or the ones not able to plan their 362
consumption [12,20]. This may be the case of regular cocaine and heroin consumers, which may 363
have timely access to their substances through traditional means of supply (street dealer, 364
contacts). These observations are further emphasised in our study (see Figures 6-8). 365
Similarly to the previous section, Figures 6, 7 and 8 provide information about the distribution of 366
illicit drug listings and vendors for every country (Figures 6 and 7) and their contribution to the 367
total number of listings for each category of illicit drugs (Figure 8). 368
369
19
370
Figure 6. Distribution of illicit drug listings for every shipping country (without considering the worldwide 371
statement). * Country with less than 2% of the total number of illicit drugs listings 372
373 Figure 7. Number of vendors for each shipping country and categories of illicit drugs. 374
* Country with less than 2% of the total number of listings 375
376
20
377
Figure 8. Contribution (in terms of listing proportions) of each shipping country in illicit drug categories (without 378
considering the worldwide statement). * Country with less than 2% of the total number of illicit drugs listings 379
380
Most countries propose cannabis related products which is also the illicit drug mainly offered 381
(38.6%) of all illicit drug listings (see Figures 6 and 7). In addition to the adaptation to the 382
customer demand, the predominance of cannabis may be explained by the easy access to 383
cannabis. Indeed, cannabis is not only the most consumed drug worldwide, it also represents the 384
most widely cultivated drug crop according to the UNODC [26]. Among the main stated countries, 385
Australia, China and the Netherlands are the only ones that do not mainly propose cannabis. For 386
instance, vendors from Australia propose at similar frequencies Ecstasy & MDMA, cannabis and 387
methamphetamine, which is tightly related to the indicators of the traditional market (arrests, 388
seizures and prevalence data) according to the Australian Intelligence Crime Commission [31]. We 389
may reasonably assume that such trend is the consequence of the domestic pattern observed for 390
the Australian illicit drug trafficking (see Figure 2). Lastly, the high proportions of listings of 391
Ecstasy & MDMA and amphetamine from Dutch vendors, and to a lesser extent from German 392
vendors (see Figure 6), can be explained by the main role these countries play in the production 393
of such drugs [27]. As shown in Figure 8, together they cover more than half of the sale proposals 394
of both Ecstasy & MDMA (50.7% of all listings in the category) and amphetamine (56.8%). 395
Concerning Ecstasy & MDMA, while production is now global, Europe, in particular the 396
Netherlands, is considered as the world’s leading source of the drug [32]. Clear spatial specificity 397
can be observed for amphetamines, which are mainly proposed by Germany, the Netherlands and 398
21
even Sweden (Figure 6) and methamphetamine, which is mainly offered by Australia and the 399
United States. Amphetamine is still mainly produced in Europe while methamphetamine 400
production is limited to the Baltic region and Central European countries. Moreover, the use of 401
methamphetamine in Europe is limited compared to that of amphetamine and is restricted to a 402
group of geographically close countries [33]. By contrast, as noted in the last World Drug Report 403
[26], « although methamphetamine is a feature of ATS markets worldwide, it is particularly 404
dominant in East and South-East Asia and North America ». In Australia, methamphetamine 405
remains the main drug produced in clandestine laboratories detected [31]. Finally, the United 406
States are responsible for the main proportion of illicit drug listings (29%), concentrate the 407
largest number of vendors (more than twice that of the United Kingdom) and is the lead country 408
of a wide number of illicit drug categories (see Figure 8). For instance, its leadership in the 409
opioids category may be explained by the increase in heroin use in North America in the past 410
decade (high prevalence compared to the worldwide mean). In contrast, Western and Central 411
Europe have seen stable or declining long-term trends of heroin consumption since the late 1990s 412
[26]. Finally, Chinese vendors, while five times fewer in number than Americans, lead the NPS 413
category (27.7% of NPS listings). As further developed below, they specialise in the distribution 414
of NPS (see also Figures 6 and 7), in which they play a strategic role. Another interesting 415
observation is the non-existence of cocaine and heroin producing countries (e.g. South American 416
countries or Middle East/South East/South West Asia). In general, these countries do not have 417
access to the same technological infrastructure (e.g. the Internet, secure mail system) as 418
westernised countries [7,18]. Furthermore, cryptomarkets may not represent a relevant distribution 419
channel between producers and retailers in the case of cocaine and heroin. 420
421
3.6. A specific analysis of New Psychoactive Substances 422
Regarding the worldwide market, 363 vendors manage 3,936 listings classified in NPS (all three 423
NPS related categories grouped). This represents almost 11% of the illicit drugs category (see 424
Figure 8). As shown in Table 3, listings about illicit drugs shipped from China and Hong Kong 425
represent about 4% of the total number of listings proposed on Evolution. However, the majority 426
of their illicit drug listings concern new psychoactive substances (93% precisely, see Figure 6). 427
22
They cover almost 28% of all the NPS listings proposed on Evolution with only 22 vendors, 428
which makes it the lead country, followed by the United States (26.5% - 115 vendors) and the 429
United Kingdom (13.9% - 83 vendors) (see Figure 8). 430
The combined analysis of masses and prices of the NPS proposed reveals geographical 431
differences between the shipping countries (see Figure 8). Most countries are characterised by a 432
majority of listings offering small quantities of NPS (less than one gram or less than ten grams). 433
However, vendors from China and Hong Kong offer larger quantities of NPS, between 10g and 434
100g, or even more. Thus, we may assume that vendors from China have the capacity to provide 435
bulk quantities. Indeed, typical quantities for NPS consumption are usually very low, suggesting 436
that quantities over 100g may already be considered as bulk. Price ranges also corroborate this 437
finding. Listings offered for sale from China and Hong Kong show a median price lower than 10 438
USD per gram, while median prices are relatively higher for every other country. Of course, 439
vendors usually propose products at prices decreasing gradually when quantity increases. 440
However, Chinese vendors are able to offer a lot of listings at high quantities at competitive 441
prices in comparison to vendors from other countries. In conclusion, these results may indicate 442
that Chinese vendors have easily access to these products or even may be involved in their 443
production which would be in agreement with Smith & Garlich (2013) who stated that China 444
played an active role in the domestic production of NPS [34]. Furthermore, this analysis 445
corroborates the statements of vendors on their profiles concerning their ability to offer both 446
small and very large quantities of NPS at lower prices. 447
448
23
449
Insert Figure 8 450
451
Figure 8. Proportions of listings (%) and median prices per gram (USD) according to the shipping country and the 452
quantity proposed. The global median price per gram is mentioned into brackets along with the number of listings for 453
each shipping country. Only the main shipping countries proposing NPS are represented. 454
24
The importance of Chinese sellers in NPS production or distribution does not seem to be 455
cryptomarket specific. Indeed, recent researches studying country specific differences in 456
substance availability on the Agora cryptomarket found that China, despite a small number of 457
sellers, was overrepresented in NPS. Using only the number of listings and sellers to draw their 458
conclusions, the authors mentioned that China was probably involved in the production of NPS 459
[8,9]. Another study, investigating wholesale activity on cryptomarkets, found that wholesale 460
transactions were especially concentrated in China. According to the authors, this may be related 461
to the role of China in the production of these substances [18]. 462
Regarding NPS in general, or more specifically synthetic cannabinoids, China has always been 463
suspected of being the place where these products are synthesised since the first appearance of 464
“spice” products in 2004 [34–37]. It was also suggested that some substances are sent to Europe, or 465
even North America, and then reconditioned for retail shipping [35]. On the clear web, China was 466
also mentioned as the country of origin of websites offering MT-45, an opioid-like substance 467
often referred to as a NPS [38]. However, this was not investigated further, for example by 468
performing controlled purchases. Meyers and al. [39] also noted the accessibility of purchasing 469
cathinones (a major class of NPS) on the clear web. They highlighted United States, together 470
with Germany and the United Kingdom, as the three main countries where retailing websites 471
were hosted. Concerning NPS shipments confiscated at borders, most cathinones seizures in 2009 472
in New Zealand originated from the United Kingdom or directly from China [40]. In Australia, in 473
the period 2013 – 2014, NPS in kilogram quantities came primarily from China [41]. Thus, 474
although based on only one cryptomarket, the results obtained through our study support various 475
assumptions regarding the position of China within the NPS market. 476
477
478
479
480
25
4. General discussion and conclusion 481
Through the analysis of a dataset containing information on 4,171 vendors and 92,980 sale 482
proposals, this study aimed first at investigating the type and proportions of products offered for 483
sale on Evolution, a popular darknet marketplace in 2014-2015. Then, this article studied the 484
trafficking flows and geographical specificities in the trafficking of the different types of 485
products, in particular illicit drugs. Finally, NPS were especially studied to show how digital data 486
can inform on the role of specific countries in the distribution chain of products. 487
The results illustrate that the trafficking on Evolution is mainly devoted to the trade of illicit 488
drugs. These substances represent 46% of all listings and 57% of vendors offer for sale at least 489
one product classified as illicit drugs. Nevertheless, a wide range of other illicit products or 490
services are offered as well. In particular, sale proposals related to various fraud issues (carding, 491
ID theft, counterfeit goods, etc.) represent almost a third of the total number of listings and close 492
to half of vendors propose products classified in this category. The spatial analysis we performed 493
showed that English-speaking countries (especially the United States but also the United 494
Kingdom and Australia) and Western European countries (the Netherlands, Germany) dominate 495
the market, which is in line with past and more recent studies carried out on other cryptomarkets 496
[8,10,11,16,20]. The study of trafficking flows reveals the domestic (e.g. Australia) and international 497
(e.g. the Netherlands, Germany and China) nature of the trade of some countries. The spatial 498
analysis also shows the specialisation of vendors and which countries are at the forefront of the 499
distribution of specific types of products. For instance, vendors from the Netherlands and Canada 500
specialise in trafficking prescription and illicit drugs, Indian vendors in prescription drugs, 501
Chinese vendors specialise in luxury goods and NPS, while vendors from the United States 502
dominate in a wide range of product categories. The combination of our results and other sources 503
of information shows that geographical trends in the trafficking of specific type of illicit drugs 504
tend to reflect the structure of the traditional market (e.g. prevalence data and role in the 505
production of synthetic drugs). This may corroborate that sellers use cryptomarkets as a new 506
distribution channel to sell all or part of their merchandise. 507
Nevertheless, the analysis of the number of vendors and sale proposals performed provides only 508
information on the supply side of the market. To properly evaluate the role of countries on 509
Evolution, as well as that of cryptomarkets in the distribution chain, it would be interesting to get 510
26
an insight into the volume of sales of each country using the feedbacks left by past customers 511
[2,11]. This would also better inform on the availability of the products offered for sale [18]. 512
Unfortunately, the way data on Evolution were collected did not make possible such analysis. 513
The data collected online, and used by researchers to evaluate different aspects of the trade on 514
cryptomarkets - such as the vendor name, type of product, quantity, price, shipping country and 515
destination(s) - are uncertain. Indeed, they depend on what the sellers state on their sale proposals 516
and profiles. The only viable way to verify the accuracy of the online information is to purchase 517
and evaluate a product [19,42]. However, an incoherence between the stated online information and 518
that of the physical product shipped by post could have a negative impact on the reputation of the 519
seller and consequently on his revenue [8]. A previous study showed that sellers seem to describe 520
accurately their sale proposals, in particular their origin country and products offered for sale [14]. 521
Indeed, customers can easily verify the country of origin of the purchased product, when they 522
received it by mail since it is stated on mails shipped internationally [8]. Thus, even if the 523
possibility exists that sellers do not provide accurate information, it seems unlikely that they do 524
so in regards to the shipping country and the products offered for sale [8,18,25]. In addition, the 525
stated origin country tends to be accurate, as evidenced by studies based on darknet orders [19], 526
seizures of postal parcels at the borders [43] and coherence between online information and 527
knowledge regarding the offline market [8,9]. 528
In conclusion, the analysis of cryptomarkets should be integrated in a more global approach that 529
aims to improve the knowledge of illicit market structures and trafficking, which is in line with a 530
forensic intelligence approach. Developing strategies to monitor Internet activities on 531
cryptomarkets and on dedicated forums are powerful means to observe and detect global and 532
specific trends for different categories of products on the illicit market. This research 533
demonstrates the importance of analysing all the data available on a cryptomarket to inform on 534
the structure (e.g. type and frequencies of products, number of vendors, shipping countries and 535
destinations, etc.) and dynamics (e.g. trafficking flows, emerging substances, specific trends, etc.) 536
of the trade as well as on the role of certain countries in the trafficking and even specificities of 537
their illicit market. In addition, our observations validate the hypothesis that the use of the 538
shipping country statement truly inform on the origin of the products offered for sale. Performing 539
a geographical analysis of trafficking on darknet marketplaces based on such statement can 540
27
therefore be considered as appropriate. Since monitoring cryptomarkets may reveal country-541
specific trends, it could be seen as a new data source that would inform from a different 542
perspective on the characteristics of the illicit market within the domestic context of particular 543
countries. This would be particularly meaningful in the case of physical products such as (illicit) 544
drugs. The knowledge obtained through this analysis could then be used at a tactical and 545
operational level (e.g. to support specific operations) or at a strategic level (e.g. to obtain an 546
understanding of the criminal activity) [44]. 547
548
549
550
28
5. References 551
552
[1] EUROPOL. Internet Organised Crime Threat Assessment (IOCTA), The Hague, The 553
Netherlands, 2016. 554
[2] J. Aldridge, D. Décary-Hétu. Not an “Ebay for Drugs”: The Cryptomarket “Silk Road” as 555
a Paradigm Shifting Criminal Innovation. Soc. Sci. Res. Netw., 2014. 556
[3] M. Tzanetakis, G. Kamphausen, B. Werse, R. Von Laufenberg. The transparency paradox. 557
Building trust, resolving disputes and optimising logistics on conventional and online 558
drugs markets. Int. J. Drug Policy, 2016, 35, 58–68. 559
[4] A. AlQahtani, E. El-Alfy. Anonymous connections based on onion routing: a review and a 560
visualization tool. Procedia Comput. Sci., 2015, 52, 121–128. 561
[5] F. Reid, M. Harrigan. An analysis of anonymity in the bitcoin system, in Proc. Int. Conf. 562
Privacy, Secur. Risk Trust Int. Conf. Soc. Comput., Boston, USA, 2011, pp. 1318–1326. 563
[6] J. Cox. Staying in the shadows: the use of bitcoin and encryption in cryptomarkets. 2016, 564
The internet and drug markets, 41–47. 565
[7] J. Martin. Lost on the Silk Road: Online drug distribution and the “cryptomarket.” 566
Criminol. Crim. Justice, 2014, 14, 351–367. 567
[8] J. Van Buskirk, S. Naicker, A. Roxburgh, R. Bruno, L. Burns. Who sells what? Country 568
specific differences in substance availability on the Agora cryptomarket. Int. J. Drug 569
Policy, 2016, 35, 16–23. 570
[9] D. S. Dolliver, S. P. Ericson, K. L. Love. A Geographic Analysis of Drug Trafficking 571
Patterns on the TOR Network. Geogr. Rev., 2016, 1–24. 572
[10] N. Christin. Traveling the Silk Road: A measurement analysis of a large anonymous online 573
marketplace. Proc. 22nd Int. World Wide Web Conf., 2012, Rio de Janeiro, Brazil. 574
[11] K. Soska, N. Christin. Measuring the Longitudinal Evolution of the Online Anonymous 575
Marketplace Ecosystem, in Proc. 22nd USENIX Secur. Symp. (USENIX Secur. 2015), 576
Washington, DC., 2015, pp. 33–48. 577
[12] M. C. Van Hout, T. Bingham. “Surfing the Silk Road”: A study of users’ experiences. Int. 578
J. Drug Policy, 2013, 24, 524–529. 579
580
29
[13] M. C. Van Hout, T. Bingham. “Silk Road”, the virtual drug marketplace: A single case 581
study of user experiences. Int. J. Drug Policy, 2013, 24, 385–391. 582
[14] M. C. Van Hout, T. Bingham. Responsible vendors, intelligent consumers: Silk Road, the 583
online revolution in drug trading. Int. J. Drug Policy, 2014, 25, 183–189. 584
[15] M. J. Barratt, J. A. Ferris, A. R. Winstock. Use of Silk Road, the online drug marketplace, 585
in the United Kingdom, Australia and the United States. Addiction, 2014, 109, 774–783. 586
[16] M. J. Barratt, J. A. Ferris, A. R. Winstock. Safer scoring? Cryptomarkets, social supply 587
and drug market violence. Int. J. Drug Policy, 2016, 35, 24–31. 588
[17] J. Broséus, D. Rhumorbarbe, C. Mireault, V. Ouellette, F. Crispino, D. Décary-Hétu. 589
Studying illicit drug trafficking on Darknet markets: Structure and organisation from a 590
Canadian perspective. Forensic Sci. Int., 2016, 264, DOI 10.1016/j.forsciint.2016.02.045. 591
[18] J. Aldridge, D. Décary-Hétu. Hidden wholesale: The drug diffusing capacity of online 592
drug cryptomarkets. Int. J. Drug Policy, 2016, 35, 7–15. 593
[19] D. Rhumorbarbe, L. Staehli, J. Broséus, Q. Rossy, P. Esseiva. Buying drugs on a Darknet 594
market: A better deal? Studying the online illicit drug market through the analysis of 595
digital, physical and chemical data. Forensic Sci. Int., 2016, 267, DOI 596
10.1016/j.forsciint.2016.08.032. 597
[20] K. Kruithof, J. Aldridge, D. Décary-Hétu, M. Sim, E. Dujso, S. Hoorens. Internet-598
Facilitated Drugs Trade: An Analysis of the Size, Scope and the Role of the Netherlands. 599
RAND EUROPE, 2016. 600
[21] J. Van Buskirk, A. Roxburgh, R. Bruno, L. Burns. Drugs and the Internet, 2015. 601
[22] J. Demant, R. Munksgaard, E. Houborg. Personal use, social supply or redistribution? 602
cryptomarket demand on Silk Road 2 and Agora. Trends Organ. Crime, 2016, 1–20. 603
[23] R-Core-Team. R: A language and environment for statistical computing. R Found. Stat. 604
Comput., 2016. 605
[24] R. Ensafi, P. Winter, A. Mueen, J. R. Crandall. Analyzing the Great Firewall of China 606
Over Space and Time. Proc. Priv. Enhancing Technol., 2015, 2015, 61–76. 607
[25] D. Décary-Hétu, M. Paquet-Clouston, J. Aldridge. Going international? Risk taking by 608
cryptomarket drug vendors. Int. J. Drug Policy, 2016, 35, 69–76. 609
[26] UNODC. World Drug Report, United Nations Office On Drugs And Crime, Vienna, 2016. 610
30
[27] EMCDDA. Rapport Sur Les Marchés Des Drogues Dans l’UE: Synthèse, Publications 611
Conjointes de l’EMCDDA et d’Europol, Office Des Publications de l’Union Européenne, 612
Luxembourg., 2016. 613
[28] Europol and the Office for Harmonization in the Internal Market. Situation Report on 614
Counterfeiting in the European Union, 2015. 615
[29] E. Ormsby. Silk Road: insights from interviews with users and vendors. In “The Internet 616
and drug markets,” (Ed: EMCDDA), Publications Office Of The European Union, 617
Lisbonne, Portugal, 2016. 618
[30] M. J. Barratt. Silk Road : eBay for Drugs. Addiction, 2012, 107, 683. 619
[31] ACIC. Report, 2014-2015 Illicit Drug Data, 2016. 620
[32] UNODC. Ecstasy and Amphetamines Global Survey, Vienna, 2003. 621
[33] EMCDDA, EUROPOL. EU Drugs Market Report : A Strategic Analysis, European 622
Monitoring Centre For Drugs And Drug AddictionEuropean Police Office, Luxembourg, 623
2013. 624
[34] S. Smith, F. Garlich. Availability and supply of novel psychoactive substances, in Nov. 625
Psychoact. Subst., (Eds: P. Dargan, D.M. Wood), Elsevier Academic Press, Amsterdam, 626
Netherlands, 2013. 627
[35] EMCDDA. New Psychoactive Substances in Europe. An Update from the EU Early 628
Warning System (March 2015)., Publications Office Of The European Union, 629
Luxembourg, 2015. 630
[36] I. Bigdeli, O. Corazza, Z. Aslanpour, F. Schifano. Novel Psychoactive Substances (NPS): 631
a study on Persian language websites. Iran J. Public Heal., 2013, 42, 511–515. 632
[37] ACMD. Consideration of the Novel Psychoactive Substances (’Legal Highs’), Home 633
Office, Londres, 2011. 634
[38] S. Siddiqi, C. Verney, P. Dargan, D. M. Wood. Understanding the availability, prevalence 635
of use, desired effects, acute toxicity and dependence potential of the novel opioid MT-45. 636
Clin. Toxicol., 2015, 53, 54–59. 637
[39] K. Meyers, Ö. Kaynak, E. Bresani, B. Curtis, A. McNamara, K. Brownfield, K. Kirby. The 638
availability and depiction of synthetic cathinones (bath salts) on the Internet: do online 639
suppliers employ features to maximize purchases? Int. J. Drug Policy, 2015, 26, 670–674. 640
31
[40] INCB. Report of the International Narcotics Control Board for 2010., International 641
Narcotics Control Board (INCB). 2011, United Nations, New York, NY, 2011. 642
[41] ACIC. 2013-2014 Illicit Drug Data Report, Australian Intelligence Crime Commission. 643
2014, Canberra, Australia, 2015. 644
[42] F. Caudevilla, M. Ventura, I. Fornís, M. J. Barratt, C. Vidal, C. G. Lladanosa, P. Quintana, 645
A. Muñoz, N. Calzada. Results of an international drug testing service for cryptomarket 646
users. Int. J. Drug Policy, 2016, 35, 38–41. 647
[43] N. Horne, K. Edmondson, M. Harrison, B. Scott. The applied use of forensic intelligence 648
for community and organised crime. Aust. J. Forensic Sci., 2015, 47, 72–82. 649
[44] M. Morelato, S. Baechler, O. Ribaux, A. Beavis, M. Tahtouh, P. Kirkbride, C. Roux, P. 650
Margot. Forensic intelligence framework-Part I: Induction of a transversal model by 651
comparing illicit drugs and false identity documents monitoring. Forensic Sci. Int., 2014, 652
236, 181–190. 653
[45] L. A. King. Legal classification of novel psychoactive substances - An international 654
comparison , in Nov. Psychoact. Subst. Classif. Pharmacol. Toxicol., (Eds: P.I. Dargan, 655
D.M. Wood), Elsevier/Academic Press, London ; Waltham, MA, 2013, pp. 3–27. 656
[46] I. Vardakou, C. Pistos, C. Spiliopoulou. Spice drugs as a new trend: Mode of action, 657
identification and legislation. Toxicol. Lett., 2010, 197, 157–162. 658
659
660
661
32
662
6. Appendix 663
Appendix 1 664
On Evolution, product categories are typically self-selected by vendors from an existing list when 665
creating a sale proposal, which is a source of uncertainty. Indeed, category names administrators 666
had chosen did not inform on the type of products that was actually proposed. For instance, most 667
of the illicit drugs or medicines categories were not defined according to the chemical structure of 668
the products but instead to their effects. Moreover, it was not rare that vendors misclassified their 669
listings. Furthermore, categories that were defined by administrators were not necessarily 670
coherent considering the diversity in the type of products they contained. Lastly, it was possible 671
to merge in the same category several listings spread into different categories since they 672
concerned the same type of fraud issue or illicit activity (see Figures A1 and A2). Thus, sale 673
proposals were semi-automatically classified according to a list of keywords that we defined after 674
a thorough analysis of all the listing titles. The new classification was performed according to the 675
type of products offered for sale or to the nature of the illicit activity involved and included three 676
main categories, in particular “Illicit drugs, drugs and paraphernalia”, “Various fraud issues” 677
and “Other”. In a few words, listings originally classified in “Drugs” were reorganised in a 678
number of categories in “Illicit drugs, drugs and paraphernalia” according to the general type of 679
licit or illicit drug or equipment offered. In particular, apart from the usual illicit drugs (e.g. 680
cannabis, cocaine, opioids, ecstasy, LSD), the products known as new psychoactive substances 681
(NPS) were distributed between three subcategories. The four major classes - phenethylamines, 682
cathinones, piperazines and tryptamines [45] - were listed as “NPS”. Their classification is based 683
on the general chemical structure, shared by every substance of each category. Synthetic 684
cannabinoids were classified separately since they may include herbal components and synthetic 685
substances [46]. Substances not included in the two previous subcategories – due to a complex or 686
anecdotal chemical characterization – were classified as “NPS - Other”. It includes for example 687
benzofurans (e.g. 5-APB, 6-EAPB) or aminoindane analogues (e.g. MDAI) (see Figure A2). 688
Ketamine was classified in “Other”. In the “Various fraud issues” category, a significant 689
proportion of the listings are part of the “Fraud Related” category. The latter mainly concerns 690
33
listings on financial fraud and hacking services. In particular, most of the listings are related to 691
carding. We also defined the “Goods, currencies and precious metals” category, which 692
especially contains “Luxury goods” (mostly watches followed by jewellery and perfumes) and 693
“Clothes and accessories” (mainly glasses, shirts, jackets and bags). These two categories 694
contain products with a high probability of forgeries, as will be discussed below. The “Various 695
fraud issues” also includes sale proposals about material related to identity theft such as false or 696
stolen ID documents as well as data related to identity (“ID Related”). Moreover, a variety of 697
electronic documents explaining how to perform some hacking or fraud related activities were 698
listed as “Guides & Tutorials”. To a lesser extent, a number of sale proposals concern “Firearms 699
& Weapons”, which is essentially constituted by the original “Weapons” category. Lastly, 700
customers may request a specific listing from a vendor through private messaging [10]. A listing 701
specifically designed for the customer will then be created, without necessarily stating the 702
concerned product. They were classified in the “Custom listings” category if their title did not 703
include any relevant keyword that may be used for classification in one aforementioned category 704
(see Figure A2). 705
706
707
708
709
710
711
712
713
714
715
34
716
Appendix 1 Figure A1. Categories of products as created by administrators of Evolution 717
35
718
719
720
721
Appendix 1 Figure A2. Classification of sale proposals performed by the authors 722
723
724
36
725
Appendix 2 726
727
Information
Occurrence
Countries & regions mentioned
Shipping
country
93
Afghanistan, Albania, Andorra, Argentina, Aruba, Australia,
Austria, Azerbaijan, Bangladesh, Belgium, Bolivia, Bosnia and
Herzegovina, Brazil, Bulgaria, Cambodia, Canada, Cayman
Islands, Central African Republic, Chile, China, Christmas Island,
Colombia, Czech Republic, Denmark, Dominican Republic, Egypt,
El Salvador, Estonia, Ethiopia, Fiji, Finland, France, Gabon,
Gambia, Georgia, Germany, Ghana, Greece, Guatemala, Guernsey,
Hong Kong SAR China, Hungary, India, Ireland, Italy, Jamaica,
Kenya, Latvia, Libya, Lithuania, Luxembourg, Malaysia, Mexico,
Netherlands, Netherlands Antilles, New Zealand, North Korea,
Norway, Pakistan, Peru, Philippines, Poland, Portugal, Romania,
Russia, Saint Kitts and Nevis, Sao Tome and Principe, Saudi
Arabia, Serbia, Singapore, Slovakia, Slovenia, South Africa, Spain,
Sri Lanka, Svalbard and Jan Mayen, Swaziland, Sweden,
Switzerland, Taiwan, Tanzania, Thailand, Timor-Leste, Togo,
Uganda, Ukraine, United Kingdom, United States, Uruguay,
Western Sahara, Worldwide, Yemen, Zimbabwe.
37
Shipping
destination
164
Afghanistan, Albania, Algeria, American Samoa, Andorra, Angola,
Anguilla, Antarctica, Antigua and Barbuda, Argentina, Armenia,
Aruba, Australia, Austria, Azerbaijan, Bahamas, Bahrain,
Bangladesh, Barbados, Belarus, Belgium, Belize, Benin, Bermuda,
Bhutan, Bolivia, Bosnia and Herzegovina, Botswana, Bouvet
Island, Brazil, Brunei, Bulgaria, Burkina Faso, Burundi, Cambodia,
Cameroon, Canada, Canton and Enderbury Islands, Cape Verde,
Cayman Islands, Central African Republic, Chad, Chile, China,
Christmas Island, Cocos [Keeling] Islands, Colombia, Comoros,
Congo - Brazzaville, Congo - Kinshasa, Cook Islands, Costa Rica,
Cote d'Ivoire, Croatia, Cuba, Cyprus, Czech Republic, Denmark,
Djibouti, Dominica, Dominican Republic, Dronning Maud Land,
Ecuador, Egypt, El Salvador, Equatorial Guinea, Eritrea, Estonia,
Ethiopia, Falkland Islands, Faroe Islands, Fiji, Finland, France,
French Guiana, French Polynesia, Gabon, Gambia, Georgia,
Germany, Ghana, Gibraltar, Greece, Greenland, Grenada,
Guadeloupe, Guam, Guatemala, Guernsey, Hong Kong SAR
China, Hungary, Iceland, India, Indonesia, Ireland, Isle of Man,
Israel, Italy, Japan, Latvia, Lebanon, Lesotho, Liechtenstein,
Lithuania, Luxembourg, Macau SAR China, Macedonia,
Madagascar, Malaysia, Malta, Mauritius, Metropolitan France,
Mexico, Moldova, Monaco, Montenegro, Morocco, Netherlands,
Netherlands Antilles, New Zealand, North Korea, Norway,
Panama, Paraguay, Peru, Philippines, Poland, Portugal, Puerto
Rico, Romania, Russia, Saint Lucia, San Marino, Sao Tome and
Principe, Senegal, Serbia, Serbia and Montenegro, Singapore,
Slovakia, Slovenia, Somalia, South Africa, South Korea, Spain, Sri
Lanka, Svalbard and Jan Mayen, Swaziland, Sweden, Switzerland,
Taiwan, Thailand, Trinidad and Tobago, Tunisia, Turkey, Tuvalu,
Ukraine, United Kingdom, United States, Uruguay, Vatican City,
Venezuela, Vietnam, Worldwide, Zimbabwe.
Appendix 2 Table B1. Shipping countries and destinations mentioned by vendors 728
