key: cord-0229130-v0dn2z9u authors: Bracci, Alberto; Nadini, Matthieu; Aliapoulios, Maxwell; McCoy, Damon; Gray, Ian; Teytelboym, Alexander; Gallo, Angela; Baronchelli, Andrea title: The illicit trade of COVID-19 vaccines on the dark web date: 2021-02-10 journal: nan DOI: nan sha: 0a420ae4ed8e4c59fe6dd2f83a098f77554453c3 doc_id: 229130 cord_uid: v0dn2z9u Early analyses revealed that dark web marketplaces (DWMs) started offering COVID-19 related products (e.g., masks and COVID-19 tests) as soon as the COVID-19 pandemic started, when these goods were in shortage in the traditional economy. Here, we broaden the scope and depth of previous investigations by analysing 194 DWMs until July 2021, including the crucial period in which vaccines became available, and by considering the wider impact of the pandemic on DWMs. First, we focus on vaccines. We find 250 listings offering approved vaccines, like Pfizer/BioNTech and AstraZeneca, as well as vendors offering fabricated proofs of vaccination and COVID-19 passports. Second, we consider COVID-19 related products. We reveal that, as the regular economy has become able to satisfy the demand of these goods, DWMs have decreased their offer. Third, we analyse the profile of vendors of COVID-19 related products and vaccines. We find that most of them are specialized in a single type of listings and are willing to ship worldwide. Finally, we consider a broader set of listings mentioning COVID-19 as proxy for the general impact of the pandemic on these DWMs . Among 10,330 such listings, we show that recreational drugs are the most affected among traditional DWMs product, with COVID-19 mentions steadily increasing since March 2020. We anticipate that our effort is of interest to researchers, practitioners, and law enforcement agencies focused on the study and safeguard of public health. COVID-19 has caused a worldwide economic and public health crisis, that demanded and stimulated a global response. Hundreds of possible COVID-19 vaccines have been proposed 1 since the first officially approved vaccines in late 2020, like Sputnik 2 and Pfizer/BioNTech. [3] [4] [5] The subsequent initial scarcity and unequal distribution of COVID-19 vaccines 6 have generated concerns about illicit trade early on. Interpol warned about illicit offering of COVID-19 vaccines already on December 2, 2020, 7 while Europol confirmed the sale of fake COVID-19 vaccines on dark web marketplaces (DWMs) on December 4, 2020, 8 which "may pose a significant risk to public health". *Understanding how DWMs reacted to the demand for vaccines is therefore crucial to allow policy and public health agencies to be prepared and effectively counteract these threats in the future Interpol and Europol's concern were validated by early research showing that DWMs have been an important channel to access online illicit trade during the pandemic, with masks, COVID-19 tests, and alleged medicines consistently advertised on these platforms. In a first report, 9 222 COVID-19 related unique listings were registered on April 3rd, 2020 in 20 DWMs. In our previous work, 10 788 COVID-19 related listings were observed 9, 464 times between January 1, 2020 and November 16, 2020 in 30 DWM, showing how DWMs swiftly reacted to shortages and public attention by offering sought products like masks and hydroxychloroquine. More recent reports, carried by the Global Initiative and Europol, have suggested that the overall structure of illicit online trading has gained significant benefits from COVID- 19. 11, 12 DWMs are an ideal venue to participate in online illicit activities. They can be easily accessed via specialized browsers, e.g., Tor, 13 that hide they identity and location of their users, and offer a variety of illicit goods including drugs, firearms, credit cards, and fake IDs. 14 DWMs drew the attention of hundreds of thousands buyers and sellers over the years, with a trading volume that rapidly reached hundreds millions United States dollars (USD) per year. 15, 16 The growing popularity of DWMs has attracted the interest of the scientific community, security researchers, and law enforcement agencies. The scientific community has explored the behaviour of DWMs users through comparative analyses [17] [18] [19] [20] [21] [22] [23] and case studies. [24] [25] [26] Law enforcement agencies have successfully closed several DWMs, seizing millions of USD, and performing dozen of arrests. [27] [28] [29] [30] [31] [32] [33] However, DWMs are intrinsically resilient to these interventions, 16 also thanks to the emergence of decentralized trade around them, 34 and 2020 has been a record year for their revenue. 35, 36 Here, we report on our analysis of 194 DWMs until July 22, 2021 . Throughout the pandemic, we detected a total of 10,330 unique listings that were directly affected by COVID-19, i.e., mentioning COVID-19 either in their body or title. Among these listings, 250 were offering vaccines. It is important to note that a listing does not correspond to the sale of a unit, as sometimes happens for example on Ebay, but corresponds to the availability of multiple units of a product, similarly to what happens for example on Amazon. Listings related to approved vaccines were initially detected on the Invictus marketplace starting from November 17, 2020, almost 2 weeks before their official approval. Also, listings offering a fabricated proof of vaccination were registered on the Hydra marketplace since February 15, 2021 . These listings replaced previously identified COVID-19 related products, like PPEs, COVID-19 tests, and guides on how to illicitly obtain COVID-19 relief funds. The availability of these products have decreased with respect to previous observations, with only 187 listings detected between November 2020 and July 2021 against the 788 registered between January and November 2020. 10 Many vendors selling these products are highly specialised in only a type of product and willing to ship worldwide, thereby increasing the number of potential customers. By analysing all listings mentioning COVID-19, we assess the overall impact of COVID-19 on DWMs. We show that drugs are the only traditional DWMs product to have been indirectly, and increasingly, affected by the pandemic, with vendors mentioning both pandemic related supply issues and delays . (i) Vaccine related set of keywords antibod, vaccin, antidot, vacun, immun, Инокул, вакцин, прививк, Ревакцин, Инокул, 疫苗, 反, impfstoff, Gegenmittel (ii) COVID-19 and brands related set of keywords covid, corona, ковид, Коронавирус, Пандеми, Вирус, Спутник V, Инфекци, Симптом, 新冠病毒, 武汉肺炎, couronne, pfizer, astrazeneca, moderna Our dataset includes the most popular DWMs in 2020 and 2021, such as White House, Empire, Hydra, and DarkMarket 9, 38 and was gathered by Flashpoint, 39 a company specializing in online risk intelligence. Note that the landscape of active DWMs is constantly changing: Empire exit scammed on August 23, 2020, 40 while DarkMarket was shut down by Europol on January 12, 2021. 41 The dataset was obtained by web crawling DWMs, which consists of extracting and downloading data from these websites. To this end, the web crawling pipeline has to overcome strong CAPTCHAs 42 and authenticate into the DWMs of interest. Downloading content from DWMs remains a challenging task, and the objective becomes even harder when the research study requires monitoring multiple DWMs for an extended period of time. Previous research groups have tried establishing a web crawling pipeline through a combination of PHP, curl, and MySQL, 43 through the Python library Scrapy, 44 and through an automated methodology using the AppleScript language. 45 Despite these efforts, only a few open-source tools are available 42, 46 for crawling DWMs. Therefore researchers, companies, and federal agencies often rely on commercial software, like X-Byte, 47 and specialized companies, like Flashpoint, 39 to crawl DWMs. Our DWMs dataset is used to complement and extend the analysis we previously performed for the period between January 2020 and November 2020. 10 We increase the analysed period by adding several more months, until July 22, 2020, and observe the evolution of COVID-19 related products over the second part of the pandemic. We also add several new DWMs, increasing their number from 30 to 194, and comprehending a total of 10.8 million unique listing titles. Only 84 of these DWMs mentioned COVID-19, 20 DWMs offered COVID-19 related products, and 19 vaccines, see Table 8 . Each unique listing is observed at most once per day. During the considered period of the COVID-19 pandemic, the illicit offer of vaccines constitute d Category Keywords Guides on scamming guide, fraud, exploit, scam, loan, relief, scampage, cashout Medicines chloroquin, azithromycin, favipiravir, ritonavir, lopinavir, remdesivir, dexamethasone, ciprofloxacin, doxyciclin, oseltamivir, metronidazol, ivermectin PPE mask, glove, gown, surgical, sanitiser, sanitizer, ppe Test test kit, covid test, pcr test, antigen test, corona test, diagnostic, diagnosis Web domain https, www., http://, .com, .co.uk, .dk, .org, .info, .in, .net Table 2 : COVID-19 products related keywords. Keywords used to pre-select listings selling COVID-19 related products before their manual annotation, organised by category. one of the biggest threats for global public health. We therefore use a method to detect vaccine that ensures the highest possible coverage and accuracy. From the listings, we considered two different text fields: the title and the body (that is, the listing's detailed description). We then pre-selected all listings which contained, either in the body or title, at least one word from two different lists of keyword. These lists of keywords are shown in Table 1 : the first list contains keywords related to vaccines; the second list contains keywords related to COVID-19 or vaccine brands like Pfizer/BioNTech. Note that using keywords like "antibod" or "vaccin" allows to match all words including these sets of strings, such as, antibode, antibodes, vaccine, vaccines, vaccinations, and so on. We considered several different languages, such as, English, Russian, Chinese, and German. Afterwards, we manually inspected the listings to exclude false positives from the dataset, we categorized the listings in specific subcategories (e.g. specific brands), and we standardised the analysed attributes for the analysis. For example, we converted all prices to USD at the daily exchange rate at the time of observation. Such method is not feasible as more products are searched, because the number of listings to be manually annotated is too large. As already done in our previous work, 10 we then limit our analysis to all listings mentioning COVID-19, using one the following keywords: "corona virus", "covid", "coronavirus" either in the title or description. To analyse COVID-19 related products, we first pre-selected a subset of these listings mentioning keywords in specific categories, see Table 2 , and then manually annotated these listings. With respect to our previous effort, we find a new product category, which we call malware, while no listing in the ventilator category was found. Then, we characterize all listings mentioning COVID-19 by means of Natural Language Processing techniques. First, we apply BERT to build embeddings for the listings titles, 48 using the "paraphrase-mpnet-base-v2" implementation from the python package sentencetransformers 49 to map each title into 768-dimensional vectors. We then use the UMAP algorithm 50 to map these vectors in 2D, and cluster them using the hDBSCAN algorithm. 51 We then inspect each cluster by creating a ranking of words with tf-idf, and thus manually identify the product category each cluster refers to. While each listing had an associated url to determine its uniqueness, which allowed us to track listing over time, vendors receiving bad reviews sometimes put identical copies of the same listing online. To overcome this issue and correctly count the number of listings, we created a new identifier of unique listings. We considered two listings as unique if the same vendor was posting listings in the same market, having only small variations in the title. We also excluded listings with prices larger than 40, 000 USD. Vendors post listings at high price to hold sales of these relative items, with the expectation of offering it again in the future. 52 Our previous analysis 10 found 34 fake cures, including antidotes, vaccines, and allegedly curative recreational drug mixes. These listings were scam, since no official vaccine was approved in the considered time period. Here, we analyse COVID-19 listings since November 2020. We found 250 unique listings offering vaccines and manually categorised them in three categories: approved vaccines, unspecified vaccines and proofs of vaccination. Listings in the approved vaccines category explicitly mentioned official vaccines, an example being the Pfizer/BioNTech vaccine that was offered at 500 USD on the Invictus marketplace, see Figure 5 . Listings in the unspecified vaccines category instead referred to unbranded vaccines, for example by offering alleged unapproved vaccines well before official clinical trials were completed, as shown in Table 3 . Listings in the proofs of vaccination category offered a fabricated certificate of COVID-19 vaccination, as the fake COVID-19 passport offered at 55 USD on the Hydra marketplace, see Figure 6 with its English translation in Vendors specialization Yakuza, offer at least one listing in each of the three categories considered. The DWMs specialization can be seen in Figure 9 . Vaccine listings have a short lifetime on a DWM, with most listings that are offered for less than 25 consecutive days, see Figure 8 . Such short lifetimes may be due to platform moderation, which in some cases explicitly prohibit such listings. However, such claims are not verifiable with our current data set. Regarding the price of vaccine listings, Figure 1 A natural next step is to analyse the geography of this trade, which we can do by looking at the shipping origin/destination information advertised in the listings. Most vendors declared that they would ship anywhere in the world, a behaviour that facilitates illicit trade. Vaccine warehouses were mostly in USA, followed by Germany and UK. Also, many listings do not declare any shipping information and all general shipping statistics are visible in Figure 1 (c). In the 58% of cases where no shipping information is declared, vendors invite potential customers to a direct interaction through Whatsapp, email, or phone. Percentage of listings where vendors suggest to initiate a direct interaction varies depending on the category considered. It happens for 78 (or the 84%) of listings in the unspecified vaccine category, for 64 (or the 85%) of listings in the approved vaccine category, and for only three listing in the proofs of vaccination category. This last low number is due to Hydra marketplace, which sells 64 proofs of vaccinations but their vendors never shared their contact information. Do these vendors sell multiple kind of products related to vaccines? Or do they focus on a single category? Figure 1 (d) shows that vendors offering proofs of vaccination were specialised, with only one vendor also offering approved vaccines and two unspecified vaccines. On the contrary, 12 vendors were offering both vaccines and unspecified vaccines. We did not observe any vendor offering listings in all three categories. Moreover, most vendors offer only one COVID-19 listing and trade in only one DWM, with the notable exception of a vendor, who had twelve listings in eleven different DWMs, as detailed in Figure 10 . The evolution of vaccines on DWMs closely followed major COVID-19 related events, as shown in are not part of our analysis. Since listings in the unspecified vaccines category continued to be observed until July 2021, we speculate that vendors were starting to have multiple vaccine brands, and they did not specify anymore which one are selling. For more details, see Figure 12 (a). Listings in the proofs of vaccination category emerged on February 15, 2021, when airlines were encouraging governments to allow certificates of vaccinations to become a way to safely travel. 57 Finally, we looked at the temporal evolution of the average price of these listings. The three categories followed different trends, as visible in Figure 2 (b). The price of unspecified vaccines was high between March and May 2020, when DWMs vendors likely tried to profit from the initial lack of COVID-19 medications. 10 Afterwards, their mean price has gradually decreased, meaning that the new listings appearing on DWMs were offered at progressively lower prices. However, the average price rose back to March levels in January, when vaccinations campaigns around the world were starting. The availability of officially tested vaccines led to the emergence of relative listings on DWMs since November 2020. The average price of these listings have floated over time between a few hundreds USD to more than a thousand. For more details, see Figure 12 DWMs have been a venue for the sale of other licit and illicit COVID-19 related products, like PPEs, tests, or medicines, as reported for the period from January to November 2020. 10 Here, we monitor COVID-19 related products in the second part of the pandemic, between November 2020 and July 2021, see tests had also increased, with tests increasingly being required for travel or work. We also found 4 listings advertising malware to illicitly access official systems to record test results or even vaccinations. As previously done in our first analysis, 10 confirming what's already been independently shown for the first phase of the pandemic. 60 Finally, sale mentions show larger fluctuations between as low as 15% to even 80%. In particular, we can observe peaks related to the pandemic at the beginning of key COVID-19 related events: lockdowns in March/April 2020, in Summer 2020 coincidentally with openings in the western world, in October 2020 when the second wave started hitting Europe, and in February 2021 when the Delta variant started spreading in the world. By looking at mentions of these themes across all listings in our dataset, we find that overall mentions of lockdown, sales, and delay, have decreased since the beginning of the pandemic, validating our finding that drugs-related listings are the product most impacted by COVID-19, see Figure 14 . Automatic keyword search has allowed us to uncover macroscopic trends, but it fails to capture finer details which can only be uncovered by in-depth looks at the texts of the listings. We therefore resort to a qualitative analysis of their descriptions. First, we already noticed that mention of delays in drug listings are still frequent, amounting to 56 % of the listings. While vendors generally preemptively mention possible delays due to COVID-19, we find numerous mentions of USA based vendors blaming UPS for these, as shown in one example reported in In this paper, we have extended previous analyses 9, 10 A key contribution of the present work is the study of the interplay between DWMs and the COVID-19 pandemic, after the official approval of vaccines. It was previously shown that, when a product is in shortage in the regular economy, or public attention is focused on it, listings advertising its sale appear on DWMs. For instance, this is what happened for PPE and hydroxychloroquine during the first phase of the pandemic. Since in the observed period these products were easily available on regulated markets, we coherently detect that these products disappeared in the second phase of the pandemic. In late 2020, The diffusion of illicit vaccines on DWMs, the simultaneous decrease of PPEs and medicines, confirms the link between product shortages, public attention and listings on DWMs. This phenomenon has the potential to pose a serious public health threat, as DWMs have become increasingly easier to access, resilient to police closures 16 and shown to be a catalyst for decentralized peer to peer trading between buyers and sellers of illicit items. 34 The purchase of unregulated, and possibly fraudulent, health related items on DWMs poses a concrete health risk for the buyers. Moreover, the availability of fake vaccination or testing record risks to undermine public health measures implemented by numerous countries worldwide, and calls for more investigation of this phenomenon for the current and future pandemics. By highlighting how vaccines appear on DWMs, our analysis may help raise awareness of the phenomenon and support the effort of law enforcement agencies to contain it by repeating past successful approaches. [27] [28] [29] [30] [31] [32] [33] Furthermore, our results call for more investigation of DWMs to anticipate such dangers in future public health crisis. The authors declare that they have no competing interests. Figure 6 : Proof of vaccination offered on Hydra. Proof of vaccination offered at 4,000 rubles (55 USD) detected on the Hydra marketplace. The original language of this listing is Russian and its translation in the English language is given in Table 4 . The screenshots were taken on February 6, 2021. Table 4 : Translation of the proof of vaccination offered on a Hydra. English translation of the listing in Figure 6 (b). We use Google Translator to translate the text from Russian to English. Hello Friend! The coronavirus has made adjustments to everyone's life. And more than once many of us will face its consequences. One of them is the provision of a COVID-19 vaccination certificate, which can be presented at work, at the place of study and in any other place where it is required. To order, you need to indicate your full name, date of birth, date of the issued document. If you need a non-Moscow institution, you will need to pay extra for the production of the necessary seals. Production time is 2-7 days. Delivery when sent by courier will have to be paid for upon receipt. It is possible to send by registered or regular mail, then we will take on this heavy burden. An ordinary letter has no track, therefore, until we receive the letter, we will remain in the dark about its fate. Shipping from/to Vendor ##### DWM Hydra Title black diamond og sfv og shake popcorn thc Body thank you so much for shopping with us we are confident you'll love your order while your here take a moment to browse through our vendor page to see the many great strains bulk orders and emeraldgallipot promotional offers we have to offer what we offer fast communication all msg are answered within hrs fast delivery product will be shipped on the next business day after order confirmation via usps priority mail stealth packaging vacuum sealed odorless sterile packaging package tracking available upon request three days after order confirmation full refund replacement if tracking confirms package seized lost what we ask please provide your full address immediately in pgp format in buyer's note use your full name and double check your address deliveries that tracking confirms lost because of errors in provided information are not available for refund or replacement all shipping addresses must be in the following format name john doe address nameless ln city state zip city xx please finalize asap upon receiving package please leave a positive rating if you are unhappy with your order please tell us we are happy to work with you to satisfy your needs strain highlights black diamond og indica dominant hybrid backberry kush diamond og thc flavor aroma a cross between blackberry and diamond og its flowers have a glittery trichome covering and purple coloring that make it a beautiful gem to look at the strains aroma is musky and earthy almost like a deep red wine euphoric effects black diamond is known to cause fits of giggles and is a great strain for hanging out with friends and creative expression medical benefits ideal for patients who need strong medication but still want to be active and sociable this strain tends to make consumers extremely hungry making it a good choice for those looking to increase their appetite just make sure you have some snacks on hand san fernando valley og sativa og kush direct thc flavor aroma sfv og by cali connection is a sativa dominant hybrid that is as the name indicates this og kush relative originates from californias san fernando valley although their names are barely distinguishable sfv og kush is actually the afghani crossed child to sfv og leading with aromatic notes of earthy pine and lemon euphoric effects creates a long lasting head haze and full body effect that leaves you feeling happy and relaxed without damping your energy medical benefits great for patients who need strong pain relief but dont want to be stuck on the couch note we here at the emeraldgallipot take our customers safety as our highest priority and to help protect you against the spread of the coronavirus all packages we send are being thoroughly sterilized with a mild disinfectant and bleach solution prior to shipping for your protection stay safe out there When you place an order you agree with our conditions! Offer: 5 Grams Speed Paste Normal Quality This product is made from high grade washed A-Oil Purity: 45% up to 55% Approximately 20% of the weight is lost during the drying process For any questions feel free to contact us, we are happy to help you! -------------------------------Welcome to #### The best speed (amphetamine) products on the market! We sell from the normal quality till the highest quality you can get! Our sending fits every mailbox! We ship from Monday till Friday! We ship from Germany and we know how to ship! It is important for us that all orders arrive in all safety! SHIPPING TIME Europe: 2 to 7 Business days Worldwide: 4 to 20 Business days REFUND and RESHIP If orders not arrive please send us a message and we find a solution. In case of non-arrival, we will reship 50% or a 50% refund. Mistakes made in the address-format we will never reship or refund. New buyers without any order history we never refund or reship. Please give us some great feedback if you are happy with us! AmphetamineCowboys The COVID-19 candidate vaccine landscape The russian vaccine for COVID-19 The UK has approved a COVID vaccine-here's what scientists now want to know COVID-19: FDA panel votes to authorise Pfizer Biontech vaccine COVID: Pfizer-Biontech vaccine approved for eu states INTERPOL-warns-of-organized-crime-threat-to-COVID-19-vaccines Accessed Europol predictions correct for fake COVID-19 vaccines Availability of COVID-19 related products on Tor darknet markets Dark web marketplaces and COVID-19: before the vaccine EU drug markets impact of COVID-19 Tor: the second-generation onion router Darknet market mortality risks Collective dynamics of dark web marketplaces Use of Silk Road, the online drug marketplace, in the United Kingdom, Australia and the United States Lost on the Silk Road: online drug distribution and the cryptomarket Not an Ebay for drugs: the cryptomarket Silk Road as a paradigm shifting criminal innovation Criminogenic asymmetries in cyberspace: a comparative analysis of two Tor marketplaces Evaluating drug trafficking on the Tor network: Silk Road 2, the sequel Studying illicit drug trafficking on darknet markets: structure and organisation from a Canadian perspective Macroscopic properties of buyer-seller networks in online marketplaces Silk Road, the virtual drug marketplace: a single case study of user experiences Responsible vendors, intelligent consumers: Silk Road, the online revolution in drug trading The 21st century darknet market: lessons from the fall of Silk Road United States of America Emergence and structure of decentralised trade networks around dark web marketplaces Covid is causing shipping issues, but natural competitive forces are causing darknet market consolidation after-empires-exit-scam-darknet-market-patrons-scramble-to-find-alternatives/ Accessed Darknet giant darkmarket shut down Data capture and analysis of darknet markets Mining the dark web: drugs and fake ids Tor marketplaces exploratory data analysis: the drugs case A framework for more effective dark web marketplace investigations Datacrypto: the dark net crawler and scraper Pre-training of deep bidirectional transformers for language understanding Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing Umap: Uniform manifold approximation and projection for dimension reduction hdbscan: Hierarchical density based clustering Measuring the longitudinal evolution of the online anonymous marketplace ecosystem, in: 24th {USENIX} security symposium ({USENIX} security 15 An mrna vaccine against SARS-CoV-2â€"preliminary report The world reopens, despite skyrocketing coronavirus cases Spain is first country in western Europe to record half a million COVID cases Will i need proof of a coronavirus vaccine if i want to go on holiday this summer? Will-I-need-proof-of-coronavirus-vaccine-to-go-on-holiday-summer-2021-EVG Accessed Passport to freedom? immunity passports for covid-19 Ema advises against use of ivermectin for the prevention or treatment of covid-19 outside randomised clinical trials Preliminary findings of the impact of covid-19 on drugs crypto markets 2020 united states postal service crisis COVID-19 vaccines are selling on the dark web for as much as $ 1,000 in Bitcoin COVID-19 vaccines The canadian headquarters, Torrez, Versus, White house, Yakuza COVID-19 mentions 0day.today, 24HoursPPC Correspondence should be addressed to Andrea Baronchelli: abaronchelli@turing.ac.uk. operations/operation-onymous Accessed February 10, 2021 February 10, (2014 [30] P. Paganini, Italian police shut down darkweb berlusconi market and arrested admins, https://securityaffairs.co/wordpress/93603/cyber-crime/berlusconi-market-darkweb.html Accessed January 4, 2021, security Affairs (2019).[31] C. Isidore, Feds seize 1 billion in bitcoins they say were stolen from Silk Road, https://edition. cnn.com/2020/11/06/business/bitcoin-seized-silk-road-ulbricht/index.html Accessed January 4, 2021, cNN (2020).[32] C.