Darknet Marketplaces Research Articles

Uncovering and Mitigating the Hidden Chasm: A Study on the Text-Text Domain Gap in Euphemism Identification

Euphemisms are commonly used on social media and darknet marketplaces to evade platform regulations by masking their true meanings with innocent ones. For instance, “weed” is used instead of “marijuana” for illicit transactions. Thus, euphemism identification, i.e., mapping a given euphemism (“weed”) to its specific target word (“marijuana”), is essential for improving content moderation and combating underground markets. Existing methods employ self-supervised schemes to automatically construct labeled training datasets for euphemism identification. However, they overlook the text-text domain gap caused by the discrepancy between the constructed training data and the test data, leading to performance deterioration. In this paper, we present the text-text domain gap and explain how it forms in terms of the data distribution and the cone effect. Moreover, to bridge this gap, we introduce a feature alignment network (FA-Net), which can both align the in-domain and cross-domain features, thus mitigating the domain gap from training data to test data and improving the performance of the base models for euphemism identification. We apply this FA-Net to the base models, obtaining markedly better results, and creating a state-of-the-art model which beats the large language models.

Captchas on Darknet Marketplaces: Overview and Automated Solvers

Captchas on Darknet Marketplaces: Overview and Automated Solvers

Hydra: Lessons from the world's largest darknet market

AbstractResearch SummaryWe present a comprehensive description of Hydra, the largest darknet marketplace in the world until its shutdown in April 2022. We document the main features of Hydra such as dead‐drop delivery, feedback and reputation system, escrow, and dispute resolution. Using data scraped from the platform, we quantitatively examine the scale and the structure of the marketplace. We find that it has been highly competitive, geographically covering at least 69% of the Russian population and trading a wide variety of drugs, while also allowing the wholesale trade of drugs and precursors. The dead‐drop delivery system used on Hydra was expensive, as the courier costs comprised a substantial proportion of the sale price of drugs on Hydra. We contribute to the research on drug cryptomarkets by studying an unprecedentedly large non‐Western marketplace that existed substantially longer than any other known darknet market.Policy ImplicationsThe phenomenon of Hydra shows that shut‐down policies applied to darknet marketplaces have a large effect and implicitly shape the whole drug market. Without these policies, a pervasive digitalization of the drug trade can occur. The major cost of allowing marketplaces to grow is the probable increase in the consumption of illegal drugs due to convenience for consumers and facilitated cooperation between suppliers. This cost must be weighed against the potential benefits, including a higher quality of drugs, a decrease in potential violence, and the incentives for a large marketplace to self‐regulate. The case of Hydra also suggests the relevance of financial regulation to limit the growth of darknet marketplaces.

Busting up Monopoly: Methods for modern darknet marketplace forensics

Darknet marketplaces represent the most delinquent evolution step in distributing illicit goods such as drugs, steroids, firearms, warez, or leaked personal information. On the one hand, law enforcement agencies try to catch vendors, buyers, and operators of darknet marketplaces. On the other hand, the criminals mentioned above constantly stretch the limits of overlay networks, applied cryptography, and cryptocurrency pseudonymity. This paper intends to provide relevant and up-to-date (for the year 2022) information about potential ways to deal with darknet marketplaces from the perspective of investigators. The paper outlines methods (based on periodic web scraping) that may help sworn officers to gather evidence about darknet marketplace (ab)users. The potential is demonstrated in a real-life case study of the Monopoly Market. For instance, suggested approaches seem capable: monitoring the demography and activities of darknet marketplace users, estimating the number of procurements and their value, and correlating user identities with their cryptocurrency addresses. The paper also provides an applicability analysis of proposed methods on the subset of currently trending darknet marketplaces.

A Preliminary Inventory of Kratom (Mitragyna Speciosa) Products and Vendors on the Darknet and Cryptomarkets

ABSTRACT In recent years, the online sale of kratom (Mitragyna speciosa), a Southeast Asian plant with both medicinal and psychoactive properties, has raised health concerns mainly due to the uncontrolled diffusion of adulterated kratom-related products. This exploratory study provides, for the first time, a snapshot of the availability of kratom products on the darknet which has been further validated by data searches on the surface web. A total of 231 listings of kratom across 23 darknet marketplaces were identified between March 2020 and October 2021. Among these, 40 were found actively sold across five markets by thirteen vendors. Listed items were mainly advertised as “safe” substitutes for medicinal products for the self-management of pain and other health conditions and offered in various forms (e.g., dry leaf powder, pills, capsules). Purchases were made using cryptocurrencies, with some vendors offering Pretty Good Privacy, and were shipped from Europe, Australia, the United States, and the United Kingdom. Goods sold by the same sellers also included illicit drugs and fraud-related products. Our study discovered a previously unknown diffusion of kratom products on the darknet mainly for self-treating a variety of medical conditions, suggesting the need for further research and immediate interventions to safeguard the well-being and health of kratom consumers.

Decoding hidden darknet networks: What we learned about the illicit fentanyl trade on AlphaBay.

The opioid epidemic, impacted from the proliferation of fentanyl, has added impetus to the need to detect fentanyl, sources of fentanyl, and places where fentanyl and drugs adulterated with fentanyl are available. Many darknet marketplaces (DNMs) have rules that ban fentanyl. However, it is unclear how these affect the fentanyl market. Using the AlphaBay DNM as a case study, we conducted mixed methods qualitative research. We scraped and analyzed data from the AlphaBay I2P website using, among other methods,content and social network analysis, to uncover hidden fentanyl networks. Our research highlights the next evolution of darknet marketplaces - the migration of DNMs from Tor to I2P and the methods that can be used identify fentanyl networks, irrespective of where sites are: I2P, Tor, or multihomed on I2P and Tor. Despite its ban in the Global AlphaBay Rules, our research revealed the sale of fentanyl on the AlphaBay DNM. Unlike previous studies, our findings predominantly revealed the covert sale of fentanyl on AlphaBay and predatory vendors selling illicit drugs, which unbeknownst to buyers, contained fentanyl. To a lesser extent, our findings identified the overt sale of fentanyl patches on AlphaBay. Although we examined only one DNM, the prevalence of the covert sale of fentanyl and the presence of predatory vendors underscores the importance of research that decodes the language of vendors who surreptitiously sell fentanyl or drugs adulterated with fentanyl or other illicit substances. The results of our research can inform strategies aimed at disrupting and dismantling DNM fentanyl networks.

Scraping and Analyzing Data of a Large Darknet Marketplace

Darknet marketplaces in the Tor network are popular places to anonymously buy and sell various kinds of illegal goods. Previous research on marketplaces ranged from analyses of type, availability and quality of goods to methods for identifying users. Although many darknet marketplaces exist, their lifespan is usually short, especially for very popular marketplaces that are in focus of law enforcement agencies. We built a data acquisition architecture to collect data from White House Market, one of the largest darknet marketplaces in 2021. In this paper we describe our architecture and the problems we had to solve, and present findings from our analysis of the collected data.

Discovering Emerging Threats in the Hacker Community: A Nonparametric Emerging Topic Detection Framework

The prevalence and rapid growth of cybercrime are largely attributed to hacker communities on the dark web, where cybercriminals extensively exchange hacking resources, share hacking knowledge, and organize cyberattacks. Such streams of hacker-generated content constitute an invaluable data source for developing threat intelligence that can inform organizations of cybersecurity risks and facilitate proactive cyber defense. Drawing upon the design science paradigm, we propose a novel nonparametric emerging topic detection (NPETD) framework for detecting emerging topics in streams of hacker-generated content. Our framework extends the state-of-the-art nonparametric topic model to inductively model topics without having to specify the number of topics a priori. Moreover, our framework features an efficient algorithm to jointly infer topics and detect topic emergence. We conducted experiments to rigorously evaluate the effectiveness and efficiency of our framework in comparison with the state-of-the-art baseline methods. Our framework outperformed the baseline methods in detecting the listings of emerging threats in darknet marketplaces on recall, F-measure, topic coherence, and processor time. The practical utility of our framework is further demonstrated in a major hacker forum, where we identified several notable emerging topics with important implications for victim companies and law enforcement. The proposed framework contributes to cybersecurity, topic detection and tracking, and design science.

Drugs on the Web, Crime in the Streets. The Impact of Shutdowns of Dark Net Marketplaces on Street Crime

The Dark Net has changed the way drugs are traded globally by shifting trade away from the streets and onto the web. In this paper, I study whether the shutdown of Dark Net marketplaces has an impact on the amount of drugs traded in the streets and on crimes that are normally associated to street drug dealing. To identify a causal effect, I use daily data from the US and exploit unexpected shutdowns of large online drug trading platforms. In a regression discontinuity design, I compare crime levels in days after the shutdowns to those immediately preceding them. I find that shutting down Dark Net marketplaces leads to a significant increase in drug trade in the streets. However, the effect is short-lived. In the days immediately following shutdowns, marijuana-related crimes increase by around five percent but revert to pre-shutdown levels within eighteen days. I find no impact of shutdowns of Dark Net marketplaces on thefts, assaults, homicides and prostitution.

SoK: Assumptions Underlying Cryptocurrency Deanonymizations

In recent years, cryptocurrencies have increasingly been used in cybercrime and have become the key means of payment in darknet marketplaces, partly due to their alleged anonymity. Furthermore, the research attacking the anonymity of even those cryptocurrencies that claim to offer anonymity by design is growing and is being applied by law enforcement agencies in the fight against cybercrime. Their investigative measures require a certain degree of suspicion and it is unclear whether findings resulting from attacks on cryptocurrencies’ anonymity can indeed establish that required degree of suspicion. The reason for this is that these attacks are partly based upon uncertain assumptions which are often not properly addressed in the corresponding papers. To close this gap, we extract the assumptions in papers that are attacking Bitcoin, Monero and Zcash, major cryptocurrencies used in darknet markets which have also received the most attention from researchers. We develop a taxonomy to capture the different nature of those assumptions in order to help investigators to better assess whether the required degree of suspicion for specific investigative measures could be established. We found that assumptions based on user behaviour are in general the most unreliable and thus any findings of attacks based on them might not allow for intense investigative measures such as pre-trial detention. We hope to raise awareness of the problem so that in the future there will be fewer unlawful investigations based upon uncertain assumptions and thus fewer human rights violations.

Risk Avoidance Behavior on Darknet Marketplaces

The current study employs a quasi-experimental design to test the efficacy of situational crime prevention (SCP) in understanding risk avoidance behavior in a darknet environment. Specifically, we deployed a web scraper to extract data from a popular darknet market. We then used these data to assess change in vendors and customers’ behavior following the deliverance of a warning message from the market administrator regarding the former market administrator’s intention to scam market participants. In the one-month following the message, vendors posted fewer advertisements and customers spent less and made fewer transactions on the marketplace. These findings expand the scope of SCP and provide evidence for Hutchings and Holt’s notion that darknet markets can be disrupted by means of gossip.

Similarity Analysis of Single-Vendor Marketplaces in the Tor-Network

Single-vendor shops are darknet marketplaces where individuals offer their own goods or services on their own darknet website. There are many single-vendor shops with a wide range of offers in the Tor-network. This paper presents a method to find similarities between these vendor websites to discover possible operational structures between them. In order to achieve this, similarity values between the darknet websites are determined by combining different features from the categories content, structure and metadata. Our results show that the features HTML-Tag, HTML-Class, HTML-DOM-Tree as well as File-Content, Open Ports and Links-To proved to be particularly important and very effective in revealing commonalities between darknet websites. Using the similarity detection method, it was found that only 49% of the 258 single-vendor marketplaces were unique, meaning that there were no similar websites. In addition, 20% of all vendor shops are duplicates. 31% of all single-vendor marketplaces can be sorted into seven similarity groups.

“You only do it with people you know”: A case study of acquisition strategies by cannabis engagers in Riga, Latvia

This paper explores the cannabis market dynamics in a country that is not known for generating its own novel evidence-base or policies, using 27 in-depth semistructured interviews with primary cannabis engagers in Riga, Latvia. Primary cannabis engagers are defined as those with first-hand cannabis experience (e.g. use, production or distribution). Recent studies from other nations demonstrate the importance of information and communication technology (ICT) in unregulated substance markets. While darknet marketplaces or social media applications are increasingly positioned as alternatives to the offline market, this study finds that digital tools are seldom used for purchasing cannabis in Riga’s sample. Offline social networks and social supply play a vital role in the acquisition of cannabis and mediate access to commercial dealers. Both ICT and social networks are, however, used for learning about strategies for cannabis harm reduction.

Carfentanil on the darknet: Potential scam or alarming public health threat?

BackgroundIn an age of global insecurity, highly potent synthetic drugs have become a major public health issue. Their online advertisement and sale are facilitated by surface web, darknet markets and social media fuelling substance abuse and addiction, as well as various types of new criminal activities and their growth in sophistication. This study presents a systematic analysis of the darknet sale of one of the most potent synthetic opioids: Carfentanil. With an equianalgesic potency of 10.000 times a unit of morphine, its toxicity is comparable to traditional nerve agents, and it has been previously used as a chemical weapon, causing human fatalities. MethodsDigital trace data was collected retrospectively from all the darknet marketplaces, which have been active in the past five years. Data on vendors offering Carfentanil on Agartha, Empire and Yakuza marketplaces were analysed with regard to items sold and sellers’ features as these were the only active markets at the time of search. Searches were carried out in the English language only. Results63 Cartfentanil vendors operating on 19 darknet marketplaces were identified. Contacts and payments were facilitated with end-to-end encryption messaging mobile applications and content-expiring messages. Although it is known that Agartha is a scam market, and no operative sellers were found on Yakuza, several sellers promoting Carfentanil sales were active in the Empire marketplace with a number of transaction ranging from 4 to 1223. ConclusionThe availability of highly potent drugs such as Carfentanil on the darknet requires the urgent development of novel scientific methods and tools able to monitor and to predict such new threats, while informing policymaking and protecting the health and the security of citizens.

Drugs, brands and consumer culture: the sign-value of the products sold on the darknet marketplaces

Purpose The purpose of this study is to explore drug consumption from a cultural perspective, in the context of the consumer culture. It aims to identify if, through the branding process, cryptomarket vendors are attaching a sign-value to their products to facilitate the process by which consumers will recognize and appreciate it. Design/methodology/approach The study was done by performing a qualitative content analysis loosely inspired from semiotics on a sample of 40 seller pages from the Dream Market and samples of their listings, collected in 2018. The vendors who had over 1,000 successful transactions were selected, as they were considered to be the ones who have gained a certain level of trust on the cryptomarket and were considered to having to compete by differentiating their services through their brands of choice. Findings The results have shown that the sign-value attached to the drugs sold by the vendors from this sample can be divided in two different types of sign-systems: the popular culture and the drug cultures. The popular culture includes sign-value borrowed from established brands, popular media and media representations of crime worlds. The drug cultures include values from three types of subcultural systems: cannabis, party and psychonaut subculture. Originality/value The study is trying to stir the discussions around the regulation of the drug markets by looking at the market forces within them as rather a product of consumer capitalism and not as processes that happen outside the postmodern cultural and societal trends.

Out of control? Using STAMP to model the control and feedback mechanisms surrounding identity crime in darknet marketplaces

Darknet marketplaces have emerged as a facilitator of identity crime and trading. This study aimed to (1) understand the entities and control and feedback mechanisms that influence identity crime prevention and occurrence on the darknet in the Australian system and to (2) comprehensively identify the implications of control failures across all system levels. The Systems-Theoretic Accident Model and Processes (STAMP) was used to develop an identity crime control structure in consultation with subject matter experts and then the Systems-Theoretic Process Analysis (STPA) was applied. The STPA identified 310 risk states, resulting from control failures and which were associated with the range of agencies, organisations, and individuals present across system levels. As darknet marketplaces rapidly evolve, alignment between these entities is necessary to enable agile system responses. STAMP and STPA have promise in understanding the potential for intervention across all system levels in preventing societal issues such as identity crime.

Semi-Supervised Cyber Threat Identification in Dark Net Markets: A Transductive and Deep Learning Approach

ABSTRACT Dark Net Marketplaces (DNMs), online selling platforms on the dark web, constitute a major component of the underground economy. Due to the anonymity and increasing accessibility of these platforms, they are rich sources of cyber threats such as hacking tools, data breaches, and personal account information. As the number of products offered on DNMs increases, researchers have begun to develop automated machine learning-based threat identification approaches. A major challenge in adopting such an approach is that the task typically requires manually labeled training data, which is expensive and impractical. We propose a novel semi-supervised labeling technique for leveraging unlabeled data based on the lexical and structural characteristics of DNMs using transductive learning. Empirical results show that the proposed approach leads to an approximately 3-5% increase in classification performance measured by F1-score, while increasing both precision and recall. To further improve the identification performance, we adopt Long Short-Term Memory (LSTM) as a deep learning structure on top of the proposed labeling method. The results are evaluated against a large collection of 79K product listings obtained from the most popular DNMs. Our method outperforms the state-of-the-art methods in threat identification and is considered as an important step toward lowering the human supervision cost in realizing automated threat detection within cyber threat intelligence organizations.

The Ransomware-as-a-Service economy within the darknet

Ransomware is an epidemic that adversely affects the lives of both individuals and large companies, where criminals demand payments to release infected digital assets. In the wake of the ransomware success, Ransomware-as-a-Service (RaaS) has become a franchise offered through darknet marketplaces, allowing aspiring cybercriminals to take part in this dubious economy. We have studied contemporary darknet markets and forums over a period of two years using a netnographic research approach. Our findings show that RaaS currently seems like a modest threat relative to popular opinion. Compared to other types of illegal digital goods, there are rather few RaaS items offered for sale in darknet marketplaces, often with questionable authenticity. From our data we have created a value chain and descriptions of the actors involved in this economy.

Breaking bad systems with Human Factors and Ergonomics: Using Work Domain Analysis to identify strategies to disrupt trading in dark net marketplaces

The trading of illicit goods in dark net marketplaces is a significant and growing global problem. This paper describes the findings from a study which involved the use of Work Domain Analysis in conjunction with a node breaking process to identify interventions designed to disrupt trading in dark net marketplaces. The analysis identified a series of critical disruption points and opportunities for disrupting dark net trading, including strategies to disrupt critical functions such as marketplace administration, reputation management, and product management. The analysis also showcases the potential use of Human Factors and Ergonomics for disrupting, as well as optimising, complex sociotechnical systems. The benefits of using Human Factors and Ergonomics to disrupt complex systems, as well as optimise them, are discussed along with potential application areas.

A Prototype Design for a Framework to Analyse the Traffic Flow in Darknet

The malicious activities in the darknet are an emerging threat to the cyber space. Darknet sites operate using TOR(The Onion Router) hidden services which provides the feature of disguising the users of the transaction in the darknet market place. Hence identifying and monitoring such illegal activities in the marketplace has become a tedious task for the cyber and law enforcement officials. This paper presents a prototype for a framework which analyse the traffic flow in the darknet as finding the exact sender and receiver is almost impossible as the TOR is increasing the layers of security to the maximum extent making it impossible to track the users in the transactions. Here we give a methodology using webcrawlers and extract the data from the darknet sites to find the domain of the traffic flow through which the broad area of traffic can be sorted out which would be beneficial for the cyber and law enforcement agencies to find the illicit trade in the darknet market places