1 Introduction

COVID-19 gained global attention when China suddenly quarantined the city of Wuhan on January 23, 2020 [1]. Declared a pandemic by the World Health Organization on March 11, 2020, at the moment of writing the virus has infected more than 62,000,000 people and caused over 1,450,000 deaths worldwide [2]. Measures such as social distancing, quarantine, travel restrictions, testing, and contact tracing have proven vital to containing the COVID-19 pandemic [3].

Restrictions have shaken the global economy and reshaped the demand for goods and services worldwide, with an estimated 2.5–3% world GDP loss since the crisis started [4]. Demand for many products has fallen; for example, the price of Brent crude oil decreased from 68.90 USD a barrel on January 1, 2020 to 43.52 USD as of August 2, 2020 [5, 6]. Meanwhile demand for other products, such as toilet paper [7], dramatically increased. As a result of increased demand, some products have been in short supply. Individual protective masks were sold in the United States at 7 USD on February 2, 2020 [8] and the price of alcohol disinfectant doubled on July 1, 2020 in Japan [9]. Additionally, anti-gouging regulations were introduced to control prices, which significantly affected the public attention on products related to COVID-19 [10]. As this trend has continued, further exacerbated by online misinformation, numerous customers have sought to fulfill their needs through illicit online channels [11, 12].

Dark web marketplaces (DWMs) offer access to the shadow economy via specialized browsers, like Tor [13]. DWMs offer a variety of goods including drugs, firearms, credit cards, and fake IDs [14]. The most popular currency on DWMs is Bitcoin [15], but other cryptocurrencies are accepted for payment as well. The first modern DWM was the Silk Road, launched in 2011 [16] and shut down by the FBI [17] in 2013. Since then, dozens more DWMs have sprung up and many have shut down due to police action, hacks, or scams. Today, DWMs form an ecosystem [18] that has proven extremely resilient to law-enforcement. Whenever a DWM is shut down, users swiftly migrate to alternative active DWM and the economic activity recovers within a matter of days [19].

Researchers have studied DWMs since the emergence of Silk Road [16], through a series of case studies [20–22], and comparative analyses [23–28]. Past efforts have mostly focused on specific goods, such as drugs or digital products [29]. However, these studies experienced technical difficulties in data collection preventing researchers from analysing a large and up-to-date dataset. As a result, several questions remain open, among which are:

  • how do DWMs react to sudden shocks (e.g., shortages) in the traditional economy?

  • how do DWMs respond to trends in public attention?

In this study, we address these questions by analysing a new, large, and up-to-date dataset. We studied 851,199 listings extracted from 30 DWMs between January 1, 2020 and November 16, 2020, right before the first worldwide vaccination campaign started in the United Kingdom [30]. We identify 788 COVID-19 specific listings that range from protective masks [31] to hydroxychloroquine medicine [32]. These listings were observed 9464 times during this period, allowing us to investigate their temporal evolution. We compare this COVID-19 related shadow economy with public attention measured through Twitter posts (tweets) [33] and Wikipedia page visits [34]. Finally, we inspect listings that mentioned delays in shipping or sales because of COVID-19. We significantly extend previous analyses that surveyed 222 COVID-19 specific listings extracted from 20 DWMs on a single day (April 3, 2020) [35] and, to the best of our knowledge, offer the most comprehensive overview of the DWM activity generated by the ongoing pandemic.

We found that DWMs promptly respond to signals coming from the traditional economy, increasing or decreasing the supply of goods according to their availability on regulated markets. For example, protective masks appeared in DWMs in March, when they were in short supply in the regulated economy, and became more scarce on DWMs later on when masks could be easily bought in shops. We also found that DWMs swiftly react to changes in public attention as measured through Twitter posts and Wikipedia page views. Finally, we registered spikes in the number of listings mentioning COVID-19 in correspondence with lockdown measures in March and October. Our results are of interest to different audiences: the academic community may further explore the behaviour of DWMs in relation to social changes. Policy makers can better understand the effects that new legislation have in the shadow economy. Practitioners may learn that DWMs posit additional threats to public health. A finding especially important due to the production of COVID-19 vaccines.

The manuscript is organized as follows. In the Background Section, we introduce DWMs with a brief overview of their history. In the Data Section, we explain how we obtained our DWMs, Twitter, and Wikipedia datasets. The main outcomes of our work are presented in the Results Section, while in the Discussion Section we compare them with the established technical literature. Finally, in the Conclusion Section, we highlight the contributions of our work that are relevant to different audiences as well as future research developments.

2 Background: dark web marketplaces

The online shadow economy is as old as the Internet. The first reported illegal online deal involved drugs and took place in 1972 [36]. The World Wide Web [37] facilitated the emergence of online illicit marketplaces [38, 39] but the first marketplaces could not guarantee anonymity and therefore permitted the traceability of users by law enforcement [40].

Modern DWMs originated and still operate online, but outside the World Wide Web in an encrypted part of the Internet whose contents are often not indexed by standard web search-engines [41]. Silk Road marketplace, which launched in 2011, was the first modern DWM [16]. It proposed a new way of trading drugs and other illegal products online and anonymously [23–25]. There were two key ingredients of Silk Road’s success. First, potential customers could access it using the Tor browser [13], which made their traceability difficult. Second, purchases were made in Bitcoin [15], which provided a degree of privacy to buyers and sellers [29, 42, 43]. After the FBI shut down Silk Road in 2013 [17], new DWMs quickly appeared, offering drugs, firearms, credit cards, and fake IDs [14]. These DWMs also adapted to further increase the level of privacy and security offered to users [20, 21], such as the Invisible Internet Project (I2P) [44] and escrow checkout services [45]. Tor, now available for mobile devices as well, still offers more privacy than many other popular mobile applications [46] and Bitcoin is currently the most popular cryptocurrency in DWMs [47–49].

Trade today on DWMs is worth at least several hundreds of millions of USD per year, and involves hundreds of thousands of buyers and vendors [17–19, 50–52]. As a result, law enforcement agencies have put considerable effort into combating DWMs [17, 51, 52]. Furthermore, DWMs have been targets of cybercriminal actors through use of distributed denial-of-service (DDoS) attacks and hacking attempts, while some DWMs also shut down due to administrators stealing funds from customers directly [53, 54]. However, DWMs have organised into a robust ecosystem which has proven exceptionally resilient to closures and whenever a DWM is closed, the users trading higher volumes of Bitcoins migrate to active DWMs or establish new ones [19].

The resilience and functioning operations of modern DWMs are possible partially because of numerous websites and forums where users can share their experiences. One example is Dread [55], a Reddit-like forum created in 2018 after the closure of the dedicated pages on Reddit [56]. Other ad-hoc platforms exist to monitor whether known DWMs are active or currently unavailable [57–60]. Additional mechanisms, like feedback and ratings systems [18], enhance the resilience of these DWMs and build trust towards the DWM and its vendors. In a similar way to regulated online marketplaces, DWM buyers are asked to leave feedback and a rating after a purchase. Additionally, DWM administrators often act as vendor moderators by banning vendors or specific categories of products. Some examples of this are DarkBay, where banned categories include human trafficking, contract killing and weapons [61], and Monopoly marketplace, where COVID-19 fake vaccine listings were recently banned by moderators [62].

DWMs have been used to circumvent laws and regulations. They have been the subject of many case studies [20–22] and comparative analyses [23–28]. These studies highlighted that illicit online transactions in DWMs are perceived as safer than negotiating in face-to-face drug markets [20]. They are based on the concept of “harm reduction,” where vendors prefer to sell tested and high-quality products [21]. Although DWMs form an online community, they are made unstable by their profit-based mentality of capitalism [22]. Vendors customize their products to match the specialisation of different DWMs thus creating an efficient distribution network [28], which sometimes goes beyond a base retail market [27]. While these characteristics favour the DWM economy against the offline shadow economy, DWMs sell a variety of illicit products [23–26], such as, drugs, fake IDs, “how to” manuals (for scams, bombs etc.), and weapons. One prominent category is that of digital goods [63], including ransomware, social engineering guides, and financial malware to steal credit cards and bank account credentials.

It is hard to estimate how many live DWMs currently exist. Some recent reports include one from independent researcher Gwern, who identified 19 live platforms on April 22, 2020 [64], the website www.darknetstats.com, which registered 10 live “established” DWMs on May 27, 2020 [65], and one where 20 DWMs were observed one single day (April 3, 2020) [35]. Currently established DWMs at the time of writing include Hydra and White House marketplaces.

3 Data and methods

3.1 Dark web marketplaces

The listings used for our study were obtained by web crawling DWMs. Web crawling consists of extracting data from websites and is performed by specialized software. Web crawling DWMs is a challenging task because crawlers must bypass several protective layers. Most DWMs require authentication and some even require a direct invitation from a current member. Additionally, strong CAPTCHAs [66] are implemented to avoid otherwise easy and automated access to the online DWM. Several research groups tried to overcome these challenges. Some examples are, HTTrack software used in [16], a combination of PHP, the curl library, and MySQL was proposed in [67], the Python library scrapy adopted in [68], and an automated methodology using the AppleScript language utilized in [69]. There are currently very few open source tools available [66, 70] for crawling DWMs, which often leaves companies and federal agencies to rely on commercial software [71]. Downloading content from DWMs remains a challenging task, and the objective becomes even harder when the research study requires monitoring multiple DWMs for an extended period of time.

Our dataset contains listings crawled from 30 DWMs between January 1, 2020 and November 16, 2020 by Flashpoint Intelligence [72], a company specializing in online risk intelligence. It includes the most popular DWMs in 2020, such as Hydra, White House, Empire and DarkMarket [35, 65]. The crawling pipeline consists of authenticating into DWMs and downloading key attributes for each active listing, as highlighted in Fig. 1. Each DWM was crawled for at least 90 different days. We categorized the COVID-19 specific listings into PPE, medicines, guides on scamming, web domains, medical frauds, tests, fake medical records, and ventilators. Representative examples of listings relative to these categories are presented in Table 1, with specific listing examples in Appendix B.1. Only a fraction of the selected listings were actual COVID-19 specific listings, since mitigation measures to prevent COVID-19 spreading have also impacted illegal trades of other listings. For instance, a vendor might sell cocaine and mention shipping delays due to COVID-19. We included such cases in the category COVID-19 mentions. For details about data pre-processing, see Appendix A, where we explain how we select listings related to COVID-19 and how we classify them in categories. We remark that our pre-processing pipeline is biased towards the English language, and this constitutes a limitation of our work.

Figure 1
figure 1

Example of a chloroquine listing in the DarkBay/Dbay marketplace, where we highlight some of its salient attributes. Among the attributes considered in this work and shown in Table 4, “Time” and “Marketplace name” attributes are not present in this screenshot, while the “Quantity” attribute is not fixed by the vendor

Full size image
Table 1 Categories used to classify the selected COVID-19 dataset. The first five categories constitute COVID-19 specific listings, while the last one, called COVID-19 mentions, includes listings mentioning one of the keywords in Table 5 without selling actual COVID-19 specific listings
Full size table

Overall, our dataset includes a total of 851,199 unique listings, which were observed a total of 8,538,593 times between January 1, 2020 and November 16, 2020. In Table 2 we report the breakdown of the number of unique listings and their total observations in each of the 30 DWMs. We did not find any mention of COVID-19 on 12 DWMs (Atshop, Black Market Guns, Cannabay, Darkseid, ElHerbolario, Exchange, Genesis, Mouse in Box, Rocketr, Selly, Skimmer Device and Venus Anonymous). This makes sense as these DWMs are primarily focused on specific goods with a pre-defined listing text structure. A brief description of each DWM together with its specialization can be found in Table 7. On the remaining 18 DWMs, there were a total of 10,455 unique listings related to COVID-19, which constitutes less than 1% of the entire dataset. These listings were mostly composed of drugs that reported discounts or delays in shipping due to COVID-19. Listings concerning more specific COVID-19 goods such as masks, ventilators, and tests were available on 13 DWMs (Connect, Cypher, DarkBay/DBay, DarkMarket, Empire, Hydra, MagBO, Monopoly, Plati.market, Torrez, CanadaHQ, White House, and Yellow Brick). There were 788 COVID-19 specific listings in these DWMs which were observed 9464 times during the analysed time period.

Table 2 This Table reports the number of days each DWM was crawled, the number of unique listings, all and COVID-19 specific, and the number of listing observations, all and COVID-19 specific. CanadaHQ indicates The Canadian HeadQuarters marketplace
Full size table

3.2 Twitter

We sampled tweets related to COVID-19 using a freely available dataset introduced in Chen et al [33]. We downloaded the tweets ID from the public GitHub repository and then used the provided script to recover the original tweets through the Python library twarc. We studied the temporal evolution of the number of tweets mentioning selected keywords, such as “chloroquine”. In line with our dataset of DWM listings, most of the considered tweets were written in English and the time period considered ranges from January 21, 2020 to November 13, 2020.

3.3 Wikipedia

We used the publicly available Wikipedia API [34] to collect data about the number of visits at specific pages related with COVID-19, such as chloroquine. The Wikipedia search engine was case-sensitive and we considered strings with the first letter uppercase, while the others lowercase. We looked for the number Wikipedia page visits in the English language from January 1, 2020 to November 16, 2020.

4 Results

We assessed the impact of COVID-19 on online illicit trade along three main criteria. First, we focused on the 13 DWMs containing at least one COVID-19 specific listing, analysing their offers in terms of the categories PPE, medicines, guides on scamming, web domains, medical frauds, tests, fake medical records, and ventilators, as introduced in Table 1. Second, we considered the 18 DWMs that included at least one listing in one of the categories in Table 1, thus adding listings to the COVID-19 mentions category in our analysis. We investigated the relationship between major COVID-19 events, public attention, and the time evolution of the number of active listings. Third, we quantified the indirect impact that COVID-19 had on all 30 DWMs under consideration by tracking the percentage of listings mentioning the themes of lockdown, delays, and sales. We linked their frequency to major COVID-19 events.

4.1 Categories of listings

Here, we focus on the 788 COVID-19 specific listings present in our dataset, observed 9464 times in the considered time window. PPE is the most represented category, with 355 unique listings (45.1% of COVID-19 specific listings) observed 5660 times (59.8% of observations of COVID-19 specific listings). The second most represented category is medicines, with 228 (28.9%) unique listings observed 1917 (20.3% of all) times. Some medicines listings, which are often sold together, included 38 chloroquine listings, 65 hydroxychloroquine listings, 51 azythromicin listings and 45 Amoxicillin listings. Other medicines included 2 remdesivir listings, one of the drugs used to treat USA’s president Trump [73]. A breakdown of the medicines category together with a brief description of the specific drugs can be found in Table 8, and multiple medicines are sometimes sold in the same listing. Another prominent category was guides on scamming, with 99 unique listings (12.6%). It includes manuals on how to earn money exploiting flaws in COVID-19 related government relief funds, and others on how to exploit alleged pandemic related security weaknesses (e.g. online banking, delivery systems). A breakdown of the different kinds of guides can be found in Table 9. One DWM (MagBO) was specialised in selling web domains, like “coronavirusmasks.in,” with 50 unique listings (6.3%). Additionally, we classified 34 (4.3%) unique listings as medical frauds, which are listings that promised immunity from COVID-19 (no such product exists, at the moment of writing), or supposed devices able to detect COVID-19 in the air. These listings also included illicit drug mixes sold as cures. We also registered 17 test (2.2% of COVID-19 specific listings), 3 fake medical records (0.4%) and 2 ICU ventilator (0.3%) listings. More details on these listings together with some examples are reported in Appendix B. There were a total of 252 vendors selling COVID-19 specific listings. Additionally, sellers posted multiple unique listings. In fact, 88 of them sold PPE (34.9%), 106 sold medicines (42.1%), 40 sold guides on scamming (15.9%), 15 web domains (6.0%), 23 sold medical frauds (9.1%), 13 sold tests (5.2%), 3 sold fake medical records (1.2%), and 2 sold ventilators (0.8%). The information in this paragraph is summarized in Table 3.

Table 3 Summary statistics for the considered categories of listings. For each category, we included the number of unique listings, observations, and vendors. If the same vendor sold listings in different categories, we counted it as one unique vendor
Full size table

It is important to note that vendors often do not provide complete information on their listings but rather invite direct communication to facilitate sales. In 391 (49.6%) unique listings, the vendor invited potential customers to communicate via email or messaging applications such as WhatsApp, Wickr Me, and Snapchat. Thus, 511 (64.8%) COVID-19 specific listings contained no information about the offered amount of goods, 579 (73.5%) did not provide shipping information, and 16 (2.0%) did not disclose the listing price.

PPE and web domains were the least expensive products with a median price of 5 USD. Followed by medicines with 33 USD, guides on scamming with 75 USD, fake medical records with 130 USD, tests with 250 USD, medical frauds with 275 USD, and ventilators with 1400 USD. The distribution of prices for these categories can be found in Fig. 2(a). It shows that many listings had a low price of around a few USD or less and only few listings exceeded thousands or more USD. The cumulative value of the detected unique listings was \(563\mbox{,}202\) USD, where we excluded listings with prices larger than \(40\mbox{,}000\) USD using manual inspection. When vendors post listings at high price this typically indicates they have halted sales of an item with the expectation of selling it again in the future. We remove these anomalously high priced listings since they would largely overestimate the sales price of actually active listings [18]. The shipping information declared in the analysed listings involved a total of 18 countries or regions. Most of the vendors are willing to ship worldwide. Shipping from different continents appears possible because some vendors explicitly declare in listing descriptions that they have multiple warehouses across the globe, while shipping to any continent is done through specialized delivery services. The United States is the second largest exporter and shipping destination. The United Kingdom is the third largest exporter and importer, and no vendors explicitly mentioned Germany as a shipping destination even thought it is the fourth largest exporter. Complete shipping information is available in Fig. 2(b). Some examples of the COVID-19 specific listings are available in the Appendix B.1.

Figure 2
figure 2

(a) Box plot of the distribution of listing prices for each COVID-19 category. The box ranges from the lower to the upper quartile, with the horizontal line indicating the median. The whiskers extend up to the 5th and 95th percentiles respectively. The dots represent outliers. (b) Shipping information in COVID-19 specific listings. Note that 545 (or 71.1%) of these listings did not provide any shipping information

Full size image

Figure 3(a) presents a word cloud built from the titles of the selected COVID-19 specific listings. The word cloud was built from 1-grams, meaning single words, excluding common English words and stop words. The COVID-19 pandemic was referred to as either “coronavirus,” “corona,” “covid,” or “covid19”. Among COVID-19 medicines, “hydroxychloroquine,” and “chloroquine” were the most popular ones, with fewer mentions of “azithromycin,” “medicated,” and “medical” products in general.

Figure 3
figure 3

(a) Word cloud for “Listing title” in COVID-19 specific listings. (b) Category breakdown of COVID-19 specific listings in the DWM that offered them. (c) Fraction of vendors selling at least one COVID-19 specific listing. (d) Vendor specialisation. Most vendors responsible for at least one COVID-19 specific listing also sell other listings, and in greater number

Full size image

DarkBay/DBay marketplace contained the majority of the COVID-19 specific listings in our dataset, amounting to 425 (54.0%). The most available unique listings in DarkBay/DBay were PPE, which totaled 293. We also found 105 medicines, 24 medical frauds, 2 ventilators, and 1 tests. The number of listings available in the other DWMs was: 94 in Empire (which shut down in August 2020), 50 in MagBO, 49 in DarkMarket, 48 in The Canadian Headquarters, 42 in White House, and 35 in Yellow Brick. These numbers together with statistics of the less represented DWMs are as shown in Table 2. The entire breakdown of the number of COVID-19 specific listings detected in each category is available in Fig. 3(b).

In Fig. 3(c), we ranked the DWMs by their share of vendors selling COVID-19 specific listings. The total number of vendors behind COVID-19 specific listings in our dataset is 252. Most vendors sold only one COVID-19 specific listing, while few of them sold more than ten different unique COVID-19 specific listings. In Appendix D, we analysed the distribution of COVID-19 specific listings for each vendor. We found that it was heterogeneous according to a power-law with an exponent equal to −2.3 and 80% of the vendors had fewer than 5 unique listings, as shown in Fig. 7. This may imply that vendors of COVID-19 related products have a focus on a specific product category, or are just creating one-off listings to try to make quick money. In DarkBay/DBay, more than 15% of the vendors were selling COVID-19 specific listings, while in MagBO, The Canadian HeadQuarters, and Cypher this fraction was around 5% (with almost all other DWMs around 1%). This shows that law enforcement or intelligence intervention should not necessarily be approached evenly across marketplaces but instead focused on select marketplaces first with a higher concentration of COVID-19 specific listings. Finally, Fig. 3(d) shows that essentially no vendors specialised on COVID-19 products, with only 7 vendors selling more COVID-19 specific listings than unrelated ones, 4 of which actually sold just one or two COVID-19 specific listings overall in our dataset.

4.2 Time evolution of DWM listings and public attention

The number of active unique listings evolved over time, as shown in Fig. 4(a). The first COVID-19 specific listing in our dataset appeared on January 28, 2020, following the Wuhan lockdown [1]. In March, lockdowns in many countries [74, 75] corresponded to an increase in the number of these listings, whose number kept increasing until May. In June and July, when quarantine restrictions in the northern hemisphere started to ease [76], we observed a decreasing trend in the selected COVID-19 specific listings, which continued until November. COVID-19 mentions followed the same trend with two notable exceptions. We observed two sudden increases in COVID-19 in correspondence of the second wave of contagions in Europe in September [77] and new lockdown measures in November [78]. Figure 4(b) shows the evolution of the total number of observed PPE and medicines, the two most available COVID-19 specific listings in our dataset (see Table 3). PPE followed a trend compatible with the overall observations shown in Fig. 4(a), with a peak in May and a sudden decrease after July, as PPE have gradually become more available worldwide with respect to the shortage in the beginning of the pandemic. COVID-19 medicines remained approximately stable throughout these months, with a peak after USA president Donald Trump first referred to chloroquine [79]. A different trend was found for COVID-19 guides on scamming, which saw spikes in the number of listings in correspondence to event related to relief program measures [80–82]. More details can be found in Appendix D, Fig. 8.

Figure 4
figure 4

Longitudinal analysis of DWM activity. (a) Seven-days rolling average of active listings mentioning COVID-19 and COVID-19 specific listings. (b) Seven-days rolling average of the observed COVID-19 specific listings in the medicines and PPE categories. Black dashed vertical lines in panels (a) and (b) corresponded to significant COVID-19 world events, see Appendix C. (c) Seven-days median price with 95% confidence interval for COVID-19 specific listings. (d) Seven-days median price with 95% confidence interval for active COVID-19 specific listings in the PPE and medicines categories

Full size image

The time evolution of the listing prices followed a different pattern. We considered the median price and its 95% confidence interval of active COVID-19 specific listings in Fig. 4(c), and of active PPE and medicines, in Fig. 4(d). Until March, the only COVID-19 specific listings concerned medicines, which influenced the overall median price. Afterwards, when PPE listings started to appear, they led the variation in the overall median price. In fact, over the entire time window, the median price of medicines listings was reasonably stable. PPE listings, instead, had a high price for March and most of April, possibly due to speculation. Interestingly, at the end of April, a vendor named “optimus,” active on DarkBay, started selling large quantities of PPE at 1 USD, putting many online listings at the same time, thus drastically reducing the median price, which remained low until July. Overall, “optimus” had 91 PPE listings during the registered period. PPE median price then increased back to the March level in July, when general worldwide availability of masks for the general population decreased the demand for small quantities of products. We report an analysis of the listings price for COVID-19 guides on scamming in Fig. 8 of Appendix D.

We also considered tweets and Wikipedia page visits as proxies for public attention, as already done in prior studies analysing the COVID-19 pandemic [83–85]. We compared trends in public attention with temporal variations in the number of active COVID-19 specific listings on DWMs. We focused our analysis on the PPE category and on relevant medicines in our dataset: hydroxychloroquine, chloroquine, and azitrhomycin. Figure 5(a) shows that a first peak in public attention on PPE was reached in late January following the Wuhan lockdown [1]. A second peak occurred in March [84] when PPE listings started to appear in DWMs. The number of PPE listings reached their maximum in May. After May, PPE listings steadily decreased along with public attention. It is worth noting that May also marked the end of the first wave of contagion in many European countries [86]. PPE listings virtually disappeared in July, as products became more accessible in legal shops. On the contrary Twitter saw a huge spike in June, when many states decided to gradually lift lockdown measures [76], causing a public debates on mask wearing which increased the twitter signal to stable high levels until November.

Figure 5
figure 5

DWMs and public attention. (a)-(c) Seven-days rolling average of active listings selling PPE, together with the time evolution of the number of tweets referring to masks and of visits in the relative Wikipedia page visits. (b)-(d) Similar comparison as in panels (a)-(c) but considering active listings of hydroxychloroquine, chloroquine, and azithromycin. Black dashed vertical lines in panels (a) and (b) mark significant events related with COVID-19, see Appendix C. See Appendix D for panels (a) and (b) with a linear y-axis

Full size image

A similar relationship between mass media news, public attention, and DWMs was registered for the listings regarding the three considered medicines, as shown in Figs. 5(b) and (d). Four peaks in public attention were detected after four declarations from President Trump about these medicines [79, 87–89]. The number of active medicines listings closely followed. However, a closer look reveals the different shapes of Wikipedia page visits, tweets, and DWM active listings curves. Wikipedia page visits saw a very high peak of page visits after the first declaration from President Trump [79], and smaller peaks in correspondence in the following declarations. Tweets instead saw peaks of attention of increasing height. DWM listings on the contrary were much steadier in time and with little variation in the number of active listings throughout the first wave of the pandemic, while decreasing to a lower steady availability from the summer.

4.3 Impact of COVID-19 on other listings

We considered the indirect impact of COVID-19 on all the 30 DWMs in our dataset. We analyzed all listings in these DWMs (COVID-19 related and beyond), and looked at listings mentioning: lockdown, using keywords “lockdown” or “quarantine,” delay, using “delay” or “shipping problem,” and sales, using “sale,” “discount,” or “special offer.” Examples of listings reporting these keywords are available in Appendix B.2.

Figure 6(a)-(b)-(c) shows the percentage of all listings mentioning these themes over time. The percentage of all listings in the 30 DWMs mentioning lockdown never exceeded 1%, as illustrated in Fig. 6(a). It reached its maximum in November, when Europe started new lockdown measures [78]. Other peaks occurred in April and September, when nations first started to implement these measures [1, 74, 75] and at the beginning of the second wave of contagion in Europe [77], respectively. Delay mentions reached local peaks in March and May. These peaks occurred after major COVID-19 events, such as lockdowns [74, 75] and the situation in Europe starting to improve [86], respectively. Two global peaks, instead, were reached in September and November, when cases started to surge again in Europe [77] and when Europe started new lockdown measures [78], as shown in Fig. 6(b). A similar pattern was visible for the percentage of all listings mentioning sales. In addition, we observed that sales had a first peak corresponding to the New Year, which is a common practice of many offline regulated shops, as displayed in Fig. 6(c). Despite observing that the increase in the percentage of all listings mentioning sales, delays, and lockdown followed major events related to the pandemic, not all of these listings also mentioned COVID-19. We further researched this by plotting which percentage of the relative listings also mentioned COVID-19 in Fig. 6(d). The percentage of listings mentioning that current sales were due to COVID-19 was less than 1%, while mentions of delays reached up to 40%. For lockdown it was close to 100% until July, as one can expect since lockdowns exist because of COVID-19. In the three selected cases, the percentages of listings mentioning COVID-19 followed the global awareness about the current pandemic: increasing trends from January to the July [1, 74, 75, 90], less attention during the summer [86], and a returning increase in September and November [77, 78].

Figure 6
figure 6

Percentage of all active listings mentioning the themes lockdown, delay and sales in panels (a), (b), (c), respectively. (d) Percentage of active listings in panels (a), (b), (c) that mentioned also COVID-19 in their listings. Black dashed vertical lines in panels (a), (b), and (c) corresponded to major COVID-19 events, see Appendix C

Full size image

5 Discussion

We investigated the presence of listings related to COVID-19 in 30 DWMs, monitored over a ten-months period in 2020. We considered COVID-19 specific listings and COVID-19 mentions, found them in 13 and 18 DWMs, respectively. COVID-19 specific listings totaled 788 unique products and represented less than 1% of our dataset. The majority of COVID-19 specific listings offered PPE (45.1%), followed by medicines (28.9%), guides on scamming (12.6%), web domains (6.3%), medical frauds (4.3%), tests (2.2%), fake medical records (0.4%) and ventilators (0.3%). Most COVID-19 specific listings did not report the quantity sold (64.8%) or shipping information (73.5%). Almost half of these listings invited potential customers to communicate via email or messaging applications, like WhatsApp (49.6%). Although direct communication fosters a trustworthy vendor-buyer relationship and may lay the ground for future transactions outside DWMs, it also exposes users to higher risk of being traced by law enforcement [91].

In our dataset, DarkBay/DBay is featured prominently among DWMs offering COVID-19 specific listings. Ranking in the top 100 sites in the entire dark web [92], DarkBay/DBay is regarded as the eBay of the dark web because it offers more listings categories than other DWMs [93]. It was also frequently accessible during the period of time monitored during this research, with an uptime of 80%, higher from the 77% uptime of Empire, the largest global DWM at the time of writing [94].

Our work corroborates previous findings and expands them in several ways. To the best of our knowledge, the most extensive report to date examined the presence of COVID-19 specific listings in 20 DWMs on one single day (April 3, 2020) [35]. Despite only a subset of overlapping DWMs between that report and our study, (Cypher, DarkBay/DBay, DarkMarket, Empire, Monopoly, Venus Anonymous, White House, and Yellow Brick) we both assessed that COVID-19 specific listings constituted less than 1% of the total listings in the DWMs ecosystem. These listings were mostly PPE, followed by medicines and they were found in only a few DWMs, while non COVID-19 specific listings were widespread.

An important novelty of the present study is the analysis of the temporal evolution of DWM behaviour and its relationship to public attention, as quantified through tweets and Wikipedia page visits. Following the Wuhan lockdown [1], we observed a first peak in public attention [85], and a corresponding emergence of the COVID-19 specific listings. A second peak in public attention occurred in March, when quarantine measures were adopted by many European countries [74, 75]. Again, during the same period, the number of COVID-19 specific listings sharply increased. When worldwide quarantine began to ease [76] in many countries, in June and July, we registered a decrease in public attention and in available COVID-19 specific listings. Towards the end of 2020, we did not detect significant variations in COVID-19 specific listings and public attention, in correspondence of the second wave of contagions [77] and new lockdown measures in Europe [78]. Both vendors of COVID-19 specific listings and public attention have adapted to the COVID-19 pandemic and react more smoothly to its development.

Listing prices correlated with both variations in public attention and individual choices of a few vendors. Median price experienced a sharp increase in March, probably due to speculation, and then decreased in April due to the choice of a single vendor responsible for 91 listings, named “optimus.” The vendor sold a large quantity of PPE at 1 USD only, which constituted the 37% of active PPE listings in April. Finally, we observed an increase in the percentage of all listings citing delays in shipping and sale offers, which peaked in March, May, September, and November. Similar to a prior work that found Wikipedia page visits of a given drug to be a good predictor for its demand in DWMs [95], we provided further evidence that the DWMs ecosystem is embedded in our society and responds in line with social changes [96]. The DWMs ecosystem swiftly reacted to the pandemic by offering goods in high demand, and even offering vaccines already in March, when no tested vaccination existed.

Our research shares some limitations with previous studies, namely that not all active DWMs were surveyed. For instance, we did not analyse 12 of the DWMs explored in the previous report [35]. It must be noted, however, that the number of active DWMs is constantly changing due to closures or new openings [19] and obtaining full coverage is challenging due to the active efforts of DMWs to obstruct research studies and law enforcement investigations, for example through the use of CAPTCHAs. Another limitation is the lack of reliable fully automated annotation method: this forced us to manually annotate listings and thus limited our analysis to listings only directly related to COVID-19. One key problem to be solved in this regard is the presence of false positives when doing a keyword search. In the presence of a more automated pipeline, one could extend this analysis to a more precise quantification of the effect of the pandemic on traditional goods traded on DWMs such as weapons, drugs, or digital goods.

6 Conclusion

By revealing that DWMs listings of goods related to COVID-19 exist and are correlated with public attention, we highlight the need for a close monitoring of the online shadow economy in the future months, in order to control and anticipate dangerous effects of the COVID-19 “infodemic” [84, 85]. We plan to improve our analysis of DWM activity by increasing the number of monitored DWMs and conducting a more extensive analysis of the impact on the pandemic on overall DWM trade by considering changes in prices of non-COVID-19 specific listings, such as drugs, weapons, or malware. We released a new website [97], where we will provide constant updates on the effect of the pandemic on DWMs.

We anticipate that our work will interest a wide audience and spark new research. Future research work may further explore the behaviour of DWMs over time, potentially extending the spectrum of monitored goods and relating the observed trends to specific social changes. Policy makers and public agencies (especially those focused on protecting consumer rights and health) can use our findings to better assess and shape the effects of legislation on the shadow economy [98]. Practitioners may gain insights on how DWMs posit additional threats to public health. Uninformed citizens exposed to waves of misinformation, such as the ones related to hydroxychloroquine, chloroquine, and azitrhomycin [79, 87–89], may be tempted to shop on DWMs thus exposing themselves to serious health risks. Moreover, the availability of regulated products currently in shortage in the traditional economy undermines anti-price gouging regulations and regulated businesses which sell the same products.