Skip to main content
NCBI home page
Elsevier - PMC COVID-19 Collection logoLink to Elsevier - PMC COVID-19 Collection
. 2023 Mar 22;3:100051. doi: 10.1016/j.etdah.2023.100051

Profiling the vendors of COVID‐19 related product on the Darknet: An observational study

Valeria Catalani a, Honor D Townshend b, Mariya Prilutskaya c, Andres Roman-Urrestarazu d,e,f,⁎, Robin van Kessel d,g, Robert P Chilcott a, Hani Banayoti f, Tim McSweeney h, Ornella Corazza a,i
PMCID: PMC10030259  PMID: 37020522

Abstract

Background

In a time of unprecedented global change, the COVID-19 pandemic has led to a surge in demand of COVID-19 vaccines and related certifications. Mainly due to supply shortages, counterfeit vaccines, fake documentation, and alleged cures to illegal portfolios, have been offered on darkweb marketplaces (DWMs) with important public health consequences. We aimed to profile key DWMs and vendors by presenting some in-depth case studies.

Methods

A non-systematic search for COVID-19 products was performed across 118 DWMs. Levels of activity, credibility, content, COVID-19 product listings, privacy protocols were among the features retrieved. Open web fora and other open web sources were also considered for further analysis of both functional and non functional DWMs. Collected data refers to the period between January 2020 and October 2021.

Results

A total of 42 relevant listings sold by 24 vendors across eight DWMs were identified. Four of these markets were active and well-established at the time of the study with good levels of credibility. COVID-19 products were listed alongside other marketplace content. Vendors had a trusted profile, communicated in English language and accepted payments in cryptocurrencies (Monero or Bitcoin). Their geographical location included the USA, Asia and Europe. While COVID-19 related goods were mostly available for regional supply, other listings were also shipped worldwide.

Interpretation

Findings emerging from this study rise important questions about the health safety of certain DWMs activities and encourage the development of targeted interventions to overcome such new and rapidly expanding public health threats.

Funding

CovSaf, National Research centre on Privacy, Harm Reduction and Adversarial Influence Online (REPHRAIN), Commonwealth Fund.

Keywords: Vaccines, Darknet, COVID-19 Certificates, Illicit goods, Public Health

1. Introduction

Darkweb marketplaces (DWMs) are anonymous platforms hosted on the dark web and used to trade a variety of illicit goods and services. They particularly facilitate the supply of illicit drugs, with an estimated two thirds of their offer thought to be drugs or drug-related (EMCDDA 2018; EMCDDA 2017), including new chemicals and pharmaceuticals, such as Novel Psychoactive Substances (Mooney et al., 2017; Negri et al., 2021). Falsified documents, malware, fraudulent products, weapons, protected wildlife and human organs constitute some examples of other products available on these platforms (EMCDDA 2019). Although DWMs still represent a modest slice of the more broadly illicit drug market, they are in constant growth and form a new emerging challenge for law enforcement and public health (EUROPOL 2021).

Following the model of “Silk Road” (Barratt, 2012), DWMs work using anonymised darknets, nearly untraceable payments with escrow services (e.g., cryptocurrencies) and vendor feedback systems. DWMs can vary in size, ranging from niche markets dedicated to the sale of specific items, services or knowledge (e.g., prescription drugs, weapons, stock market information, etc.) to large-scale markets with thousands of different listed products (ElBahrawy et al., 2020; DataBreaches.net 2017), with some simply acting as transaction facilitators between buyers and sellers (ElBahrawy et al., 2020). DWMs and their vendors are characterised by a strong commercial flexibility captured by the ease with which new products can be added to (or removed from) the crime portfolios according to market demand; as well as how new vendors can become active in search of emerging profit opportunities (EMCDDA 2019).

A rise in the use of DWMs was observed during the COVID-19 pandemic when everyday life disruptions, spread of misinformation and confusion were promptly exploited by criminal groups looking to expand their business (Bird et al., 2020). The restrictions imposed by the pandemic caused an initial setback of the online sale of drugs of abuse (UNODC, 2021; 2020), which, together with the opportunity of increasing their revenue, likely pushed DWMs vendors to diversify their portfolio (including COVID-19 related items) to boost their market entry. Indeed, the UNDOC reported how DWMs “underwent opportunistic changes in routes and modus operandi” during the COVID-19 pandemic (UNODC, 2021). In the first month of the pandemic only (March 2020), a total of US$ 14 million in counterfeit medical products targeted at COVID-19 were seized by Interpol (Bird et al., 2020; Guirakhoo, 2020); these frequently being counterfeit antiviral medications (INTERPOL, 2020a). In parallel, COVID-19 vaccines and certifications were implemented as government measures to facilitate freedom of movement and access to services for individuals (CDC, 2021a, 2021b, 2021c; European Commission, 2021; IATA, 2021; New Zealand Government, 2021). The resulting surge in demand for vaccines and certifications (Bracci et al., 2021; Corazza et al., 2022), in combination with the shortages of supply observed for these products in various geographical areas further reinforced the customers use of the DWMs as the only means of granting themselves access to the latter (Callaway et al, 2020).

An increase of COVID-19 related products illicit trade from the United Kingdom and elsewhere has been reported (Bracci et al, 2021). Consequently, the health risks associated with the injection or ingestion of self-administered unlicensed vaccines, alleged cures and false certification remain very high and the engagement with dark net activities very hazardous (INTERPOL, 2021a, 2021b, 2020a, 2020b). A previous analysis of 118 DWMs showed a total of 42 COVID-19 related products (both licit and illicit) being advertised across eight DWMs and sold by 24 vendors (Corazza et al, 2022). The aim of this article is to profile dark web vendors of COVID-19 related products for sale on the previously identified DWMs and provide an observational analysis of the products and risks they pose to public health.

2. Methods

2.1. Data access

DWMs were accessed through a proprietary threat intelligence platform in collaboration with CyberSolace, a private sector company specializing in information security advisory services. The platform allows rapid and reproducible monitoring of darkweb activity. The search programs developed using Python scripts facilitate a rapid scanning of different marketplaces, products and online vendors – both active and no longer functional (e.g., due to closure or recognition as scam sites). Data on non-functional DWMs were retrieved and, where necessary, supplemented with the analysis of open web fora on DWMs and other open web sources (e.g., https://dnstats.net, https://darknetlive.com, https://onion.live, https://www.darknetstats.com, https://www.reddit.com/r/darknet/). This study was approved by the Human Sciences Ethics Committee at the University of Hertfordshire, protocol number: aLMS/SF/UH/02951.

2.2. Search strategy

A total of 118 DWMs were observed for the scope of this study. Retrospective automated searches were carried out for the period between January 2020 and October 2021. A set of keywords were identified in relation to a) COVID-19 pandemic (e.g., Coronavirus; COVID; COVID-19; Corona; Rona); b) product types (Pass, Vaccine, Vaccination, Card, Cure, Certificate, Medicine); specific vaccine brand names (e.g., Moderna); and other related terms (e.g., ventilator) and colloquialisms (e.g., covaxin). Duplicates, either on the same thread or from previously observed threads, were removed from the final list. All searches were carried out in the English language.

2.3. Variable of interest

We assessed whether the DWMs were still active (yes/no according to them being active at the start of the search period, i.e. January 2020), level of credibility (high/unreliable/dangerous according to the users feedback), general content available on the DWM (included but not limited to the COVID-19 products, number of sellers, number of items for sale, and COVID-19 product listings (licit/illicit vaccines, fake vaccination certificates, and alleged cures). All information was retrieved either from the intelligence platform or via the open web sources listed above. Data extraction was carried out by three independent scientists. A full review of the findings was done comparing the separate entries from each scientist. Subsequently, the vendors with the most prevalent repertoire of COVID-19 products were profiled in-depth, analysing whether they are still active (yes/no), size of portfolio, contact details, levels of trust, privacy protocols, contact information, and other products for sale.

2.4. Data analysis

A descriptive analysis of the eight DWMs according to the variables of interest was formulated together with a detailed account of the relevant most diffuse vendors of COVID-19 products.

3. Results

3.1. Descriptive analysis

Eight out of 118 DWMs were identified as adverting or selling COVID-19 related products: Cartel, Cannazon, Dark0de Reborn, DarkMarket, Europa, Versus, WhiteHouseMarket (WHM) and Yakuza. Four DMWs were active at the time of the search, with Europa, DarkMarket, Cannazon and WHM reported as defunct (Vincent, 2021; WIRED, 2021). Six were reported across darkweb fora and open web sources to possess a high credibility (DARKNEtone, 2021; dnstats, 2021), while both Europa and Yakuza were instead reported as dangerous and unreliable markets (Onion.Live, 2021). All marketplaces were recent markets that started their operations between late 2019 and early 2020. Despite originating around the same time, these markets varied considerably in size, both regarding the number of vendors utilizing the platforms and the number and variety of items on sale. The characteristics of each market are reported in Table 1 .

Table 1.

Description of identified dark web marketplaces.

Marketplace Active (Y/N) Credibility Content No. sellers No. items for sale COVID-19 Listings
Europa N N/A Drugs (including
Opioids)/Weapons		 119 595 1
Cartel Y High Drugs, fraud,
digital products		 459 8171 8
Dark0de Y High Drugs, fraud,
digital products		 760 8460 10
Cannazon Y High Drugs 360 10,975 1
Yakuza Y N/A N/A 197 10,593 1
Versus Y High Drugs, fraud 1193 31,295 3
WhiteHouseMarket Y High Drugs, fraud 1930 49,684 16
DarkMarket N High Drugs, fraud, digital products 2000 70,000 2
Open in a new tab

Note: The marketplaces are listed in increasing order of the number of items for sale. In the table information on the credibility and categories of products for sale are reported.

3.2. Listing and availability

The two markets displaying most of the listings, Dark0de Reborn and WHM advertised a wide range of diverse COVID-19 products (Table 2 ). Whilst the Dark0de Reborn portfolio was mainly based on COVID-19 related digital products (i.e., fake certificates), in line with its more digital oriented portfolio, WHM was mainly advertising alleged COVID-19 cures, in line with other products offered for sale such as prescription and recreational drugs, such as steroids, cannabis, ecstasy, opioids, hallucinogenic drugs, cocaine and amphetamines. Fake certificates advertised on Dark0de Reborn went from simple blank USA vaccination record cards, to counterfeit Centers for Disease Control and Prevention (CDC) vaccination certificates and American or European Union digital QR-codes (for the full products description (Corazza et al., 2022). Alleged cures advertised on WHM comprised different dosages of Amantadine and Ivermectin (Corazza et al., 2022).

Table 2.

Description of COVID-19 related listing type identified in the dark web marketplaces.

Marketplace Covid listing Listing type No. items
WhiteHouseMarket 16 fake certificate 1
cure 14
Dark0de 10 cure 2
fake certificate 8
Cartel 8 N/A 1
cure 2
vaccine 1
fake certificate 4
Versus 3 fake certificate 1
cure 2
Darkmarket 2 cure 1
fake certificate 1
Europa 1 cure 1
Cannazon 1 cure 1
Yakuza 1 vaccine 1
Open in a new tab

Note: The marketplaces are listed in decreasing order of COVID-19 items for sale.

WHM recorded a fast and steady growth since August 2019 establishing itself as one of the most popular and secure markets on the darkweb with an accessibility limited to anonymity browsers like Tor and I2P (I2P, 2021; Tor, 2021). Its listings also included fraud-related products and services, such as pre-loaded credit cards, bank frauds and forged documents. This market, unlike others, displayed only restricted information about its well-established vendors, was walletless and only accepted Monero (an almost untraceable cryptocurrency) (Monero 2021). WHM had worldwide vendors and buyers and used English as the main language for most transactions. It was known for its exceptional digital security and its code of conduct, which outlawed murder for hire, sale of weapons and explosives, poisons and child pornography. Despite its documented proliferation, the site handed its resignation letter in October 2021 to announce the voluntary shut down of the business, and the site's administrators withdrew with a net profit predicted to be between USD1.3 and 5 million.

Dark0de Reborn started its operations in May 2020, and since gained thousands of listings with an activity that increased steadily from May 2021 onwards. According to some sources, the Reborn “version” was envisaged as the remake of the Dark0de cybercrime forum and black marketplace which was seized and shut down in 2015 by a joint effort between law enforcement agencies of 20 different countries (Operation Shrouded Horizon) FBI 2015). Europol described this market as “the most prolific English-speaking cybercriminal forum to date” (Europol 2016). Dark0de Reborn is, at the time of writing, one of the largest all-purpose markets on the darkweb. Its portfolio includes a variety of fraud-related products and services, digital products, chemistry equipment and a large variety of regulated drugs. Its main page offers an online shopping experience comparable to that of many on the surface web, with a clear user interface and even an internal forum. Indeed, the Reborn version offers a sleek design with dozens of categories, including a COVID-19 section. No email address is needed to register an account, necessary to navigate the site. Before buying, users need to create an account wallet and deposit funds either in Bitcoin or Monero (DarknetOne, 2021a; DarknetStats, 2021a; reddit, 2021).

Cartel, a general-purpose darknet market, has been active since June 2020. Despite some initial growth, the level of its activity remained limited compared to other markets. Though mainly aimed at drug vendors, it advertises products from other categories as fraud-related products, guides and tutorials, counterfeit items, digital products, other physical items (from clothing to electronics), services, software & malware and finally security & hosting. It is one of the few DWMs left that still offers firearms for sale, categorized under “self-defense”. Bitcoin and Monero are the available forms of payment for this market, and a registration process is mandatory to access the items for sale. Similarly to Dark0de, it has an easy interface with detailed products descriptions and pricing DarknetOne, 2021b; dnstats.net, 2021.

Versus, originated in March 2020, is a medium-sized market that focuses mainly on illicit drugs. Vendors of this market can pay a fee to be promoted to the homepage, a fact that users distrust and that favors allegations of a high presence of scammers among the vendors. When starting Versus, the founder(s) aimed to recreate an "old school" market characterised by a strong spirit and sense of community as observed in Silk Road or Hansa, which had very large, dedicated communities shaped around them. Indirectly, the effort of the Versus team to create a “family business” based on trust and friendly interaction backfired due to cyber-attacks on the platform, resulting in widespread speculation that Versus was just another dark web scam. This market seems to promote the sale of more ‘ethical’ products, banning pornography, dangerous weapons (except for nonlethal, collective, fake and decorative weapons, as well as pepper spray), Doxxing, potent opioids as Fentanyl or its analogues, and services related to physical or mental harm, including hacking. Buyers do not need a wallet to purchase items and they can just pay for as on any regular e-commerce platform that accepts crypto payments (Dark Web Live 2021).

Cannazon was a relatively small market, that sells marijuana and plant related products (e.g., seeds and concentrates) only. The listing connected with the COVID-19 search was a calming weed called ‘corona pack’. Most of its vendors appeared to be shipping from the UK, with no US commerce available. The market has been online since March 2018 and was retired in November 2021 after finalizing all the transactions and releasing all the users’ funds (DarknetStats, 2021b, 2021c).

Yakuza is a relatively new market which started its activities in April 2020 with very few listings. It claims to offer a range of products, including drugs, fraud services and firearms. However, the market is not yet established, with many users still skeptical about its authenticity. Currently, there are only a handful of well-known vendors on this market, with most of the available listings appearing to be scams. Yakuza may become more popular in time, if a more proactive approach in removing scam listings gets adopted (Onion.Live 2021).

It is important to underscore that some of these DWMs adopt a “code of conduct” and internal regulations to limit the sale of very harmful/immoral items (e.g., potent drugs of abuse, some types of pornography). When the COVID-19 pandemic started, Cartel and WHM, together with Monopoly market, decided to ban the advertisement and sale of vaccines after one of their vendors posted such items for sale, in an attempt to safeguard their reputability. According to their statements, the tentative sale of COVID-19 vaccines on their platform was strongly condemned. Despite such ban, two listings of COVID-19 vaccines were identified during the search process, one of which was sold in Cartel. Dark0de Reborn, Versus and Yakuza also allowed the sale of COVID-19 vaccines, and no intervention was made to limit or counter the sale of false/counterfeit COVID-19 related certificates/passes.

3.3. Vendors

Twenty-four vendors selling COVID-19 related products were reported across Dark0de Reborn (DarknetOne 2021a), Cartel (DarknetOne 2021b), WHM, Versus (Dark Web Live 2021), Yakuza, Europa, DarkMarket and Cannazon (DARKNEtone 2021). The group of vendors identified was heterogeneous, spanning from well-established vendors advertising hundreds of listings to “improvised” vendors, advertising from few to only one listing and very often only COVID-19 related. For each vendor activity, information was available on the number of listings added monthly, but not on the number of completed transactions. Most vendors offered Pretty Good Privacy (PGP) to ensure encrypted communication with their clients. For vendors with larger portfolios, the level of trust as rated by the buyers was reported and the seller was identified as “verified” or “not verified”. This information was not found for smaller sellers (i.e., number of advertised items < 40). Larger sellers frequently offered PGP code and multiple PGP codes were listed when selling on multiple markets (Chauhan et al., 2013). The vendors’ direct contact details were often reported in the description of the listing to facilitate direct and fast communication with the customers. Contact details reported varied and included phone numbers for WhatsApp, Telegram, Wickr (an instant messaging app which ensures a very high privacy thanks to encryption and verification) (AWS 2021), and email addresses, especially Jabber and @protonmail (jabber.org 2021, ProtonMail 2021). The latter uses client-side encryption to protect email content and user data. The use of high-level end-to-end encryption and of content- expiring messages, indeed allows increased privacy for sellers and lowers their traceability promoting illicit goods trades. The enhanced encryption is very important, especially when the listings for sale include fake documentation and certificates, and the users are looking for a high level of privacy

No information on wallet/payment options was retrieved for the vendors, however we know that some markets (e.g., WHM) only accept payment through cryptocurrency such as Bitcoin or Monero. The vendors’ profiles were analysed according to the number of items on sale and their last activity date. These data are reported in Table 3 . Their frequency of hits (i.e., the number of listings matching the COVID-19 search) is reported as well.

Table 3.

Vendors, Frequency of Hits, Number of Items Sold and Activity Dates.

Vendor name Frequency of hits Last activity date No. Of Items For Sale Geographic location
ThreeKings 1 25/05/2021 872 Worldwide
straightfromNL 1 23/10/2021 507 Netherlands
mastermeds 9 06/10/2021 397 India and Singapore
ROCKETLABS 1 09/09/2021 301 India
thebodyshop 4 24/09/2021 251 India but shipment Worldwide
alinlewise 1 05/07/2020 181 NA
bigpharmaswiss 1 11/10/2021 73 Switzerland
fastmeds 5 20/09/2021 68 India
Swisslaboratory 1 25/06/2021 62 Switzerland
TheBodyShops 1 16/07/2021 62 Singapore
pharmacure 1 05/07/2021 61 USA
Meds4ED 2 24/05/2021 57 USA
alanmarret 1 19/04/2021 55 Worldwide
dannysboys 2 11/10/2021 43 USA
block77 1 20/09/2021 41 Worldwide
thesabbath 1 24/09/2021 40 Worldwide
gambler 6 14/10/2021 29 Worldwide
rxsub 1 05/10/2021 16 USA
Jasonmyers 3 09/06/2021 14 Europe
Black deals 1 28/09/2021 5 France and Europe
Megamind 1 20/09/2021 4 Europe
@mausindeals 1 27/03/2020 1 USA
nopass2022 1 11/10/2021 1 Europe
Open in a new tab

Six vendors (ThreeKings, straightfromNL, mastermeds, ROCKETLABS, thebodyshop, and alinlewise) held the highest number of total listings for sale. From the last-activity date (i.e., July 2020), Alinlewise did not figure as active at the time of search, hence it was not further considered for the purpose of this study. The same for ThreeKing, which was last active in May 2021. The other four vendor's profiles were analysed and reported here. StraightfromNL is a European-based seller second in terms of portfolio dimension and, at the time of search, very active online. The COVID-19 related listing was indeed advertised by this seller on the 23 October 2021. At the time of writing, this portfolio counted 507 items among which only one was found to be COVID-19 related. StraightfromNL advertised online the sale of COVID-19 vaccine registration card for €1500 that are valid for Dutch residents only. In the item description, translated from Dutch, it was stated that the vaccine registration was authentic and effective upon checking with the corona check app (the Dutch mobile application for COVID-19 vaccine certificates). StraightfromNL started on the darkweb in January 2019 and showed a fluctuating activity throughout 2020 and 2021 (Fig. 1 ).

Fig. 1.

Fig. 1

Open in a new tab

Vendors activity profile.

During these years, StraightfromNL was active on ten markets, including the now defunct Silk Road, Empire and Berlusconi. This seller was advertising on markets as Televend and Dark0de, while the only COVID- 19 related listing was advertised on Versus. StraightfromNL was identified as a verified seller across all the active markets, with a 100% positive reputation (Elite for Televend) and no prior disputes. The languages used by the vendor were English and Dutch. The telegram shop bot was found as the only methods of contact. The portfolio focused mainly on uncut, high quality, lab tested drugs of abuse: high quality MDMA, XTC, MDMA Gummy Bears, LSD, GHB, 2C-B, Speed, Cocaine, Ketamine, Xanax, Clephedrone (4-CMC), Mephedrone (4-MMC) & BK-MDAE (Ethylone). The vendor publicly encouraged buyers to requests other drugs or higher quantities if needed, and to leave “nice reviews”. For complaints the vendor suggested to be contacted directly prior to writing any negative review. While the COVID-19 vaccine fake registration was intended for the Netherlands market, all the other products advertised included worldwide shipping. The only exception being the USA, for which orders in bulk quantities were required. The vendor strongly suggested buyers to provide real addressed details, name and surname included, in order to avoid delivery issues. Finally, the COVID-19 product advertised by this vendor was by far the most expensive.

Mastermeds is a China based seller, third in terms of portfolio dimension and, at the time of search, very active online, with his last-activity date on the 6th of October 2021. This vendor's portfolio counted a total of 397 items of which nine were found to be COVID-19 related and advertised between August and September 2021. These nine listings were mainly advertising different quantities (i.e., batch of 50, 100, 200 etc.) of Amantadine 100 mg, and Ivermectin 12 mg tablets as effective treatment against COVID-19 infection. The vendor claimed that “ivermectin works against SARS-CoV-2 virus”. These products were advertised across different DWMs with the scope of reaching customers from different geographical areas and in particular China (the seller base country), India, Singapore and worldwide. The price requested for Amantadine and Ivermectin varied from USD 50 to 200 according to the size (number of tablets) of the order. Mastermeds started his listings in July 2020, showing a fluctuating activity throughout 2020 and 2021 (Fig. 1). While the COVID-related listings were identified on Dark0de Reborn and WHM, this vendor was highly present on Televend. Mastermeds was identified as a verified seller with a 100% positive reputation. At the time of writing, Mastermeds did not seem to have been involved in any dispute. The language used by the vendor was English, and the only method of contact was found to be the telegram shop bot. The portfolio focused mainly on prescription drugs, classic drugs of abuse and Novel Psychoactive Substances (NPS). Among the NPS were found benzodiazepines (e.g., alprazolam, deschloroetizolam), compounds from the nitazene family (e.g., etonitazepipne, etonitazene), MDMA, cathinones, tryptamines, dissociatives (e.g., fluorexetamine) and psychedelics (allylescaline, 3C-P). No information on the quality of the products was retrieved. Differently from the COVID-19 products which were advertised for/from various geographical location, the rest of the portfolio seemed to be focused mainly on the Chinese market with the possibility of worldwide shipment. As seen for StraightfromNL, the COVID-19 products advertised did not seem in line with the other listings of the vendor.

ROCKETLABS is an India based seller, fourth in terms of portfolio dimension and, at the time of search, very active online, with his last-activity date on the 9th of September 2021, The portfolio counted a total of 301 items with only one product, i.e., Ivermectin 6 mg related to COVID-19. The latter was sold for USD 50 and advertised as effective treatment for COVID-19 with no further description. ROCKETLABS started the online business in July 2017, although no further activities were recorded until April 2021 (Fig. 1). This vendor has been active only on two markets, WHM and the now defunct Alpha Bay. The geo location reported is India. No other information was retrieved or was available on this vendor. The portfolio focused mainly on prescription drugs /antibiotics (e.g., testosterone, venlafaxine, metformin, metronidazole) and drugs to treat erectile dysfunction (e.g., tadalafil). No information on products shipment was available. In this case the COVID-19 product advertised seemed in line with the other listings of the vendor.

Thebodyshop, a Singapore based seller, and the fifth seller in term of portfolio size had its last activity-date on the 24th of September 2021. The portfolio counted a total of 251 items of which four were related to COVID-19. The most recently listed of these products was advertised on the 2nd of August 2021. The four listings advertised different quantities of Ivermectin 6 mg, and were described as treatment for COVID-19, but no further information was available. The price requested varied between USD25 and 170 according to quantity purchased. Thebodyshop started its activity in May 2019, and after that showed fluctuating activity throughout 2020–2021 (Fig. 1). This vendor has been active on eight markets during the last couple of years, among which figure defunct famous markets as Berlusconi and Cryptonia. While the covid related listings were identified on WHM, recently this vendor has been more active on Dark0ode Reborn. He figured as a trusted and verified seller with a 100% positive reputation.

At the time of writing, Thebodyshop did not seem to have been involved in any customer dispute. The language of communication was English. A proton email was found as methods of contact. The portfolio focused mainly on high quality therapeutics drugs: armodafinil, tamoxifen, testosterone, ciprofloxacin, tadalafil, propranolol among others. All the listings were claimed to be authentic, purchased from major pharmaceuticals in India. No homemade or counterfeit drugs were advertised. Requests for other drugs or higher quantities were encouraged. For complaints the vendor suggested to be contacted directly prior to writing any negative review. A very detailed refund policy for customer was also available on the vendor page. The products were all listed for worldwide tracked shipment from Singapore. However, for some high-risk countries (i.e., stricter customs check), as Germany, Austria, Canada, the vendor suggested finding domestic suppliers. Buyers were invited to provide real addressed details, name and surname included, in order to avoid delivery issues. In this case the COVID-19 product advertised seemed in line with the other listing of the vendor.

4. Discussion

This article aimed to provide a detailed profile of key marketplaces and vendors offering COVID-19 products on the darkweb. These products included unlicensed treatments (i.e., mainly different dosages of Amantadine and Ivermectin), vaccines and vaccination certificates. The latter were mostly blank vaccination cards, but also official vaccination certificates with fake doctor signatures and health care providers’ stamps and fully functional QR codes certificates . We found that the four vendors with the highest number of listings on the darknet specialised exclusively on COVID-19 treatments and certificates. Other COVID-19 products (i.e., vaccines) were advertised only by two vendors on the Yakuza market (i.e., alinlewise and alanmarret), also selling firearms, forged documents and fake currencies. The portfolio description and the lack of any further information suggest how these two vendors could be more unscrupulous compared to the ones profiled above, in line with what usually reported for sellers operating in the not very “reliable” Yakuza market.

The analysis of the vendors’ profile revealed that the majority of them were well-established and often owned diversified portfolios, with very few vendors being “new” or owning COVID-19 improvised products selections . For the most established vendors a correlation was found between the COVID-19 related products and the general items advertised in their portfolios. This suggests how established vendors could be facilitated in introducing new products in their sale list, both as per accessibility and credibility. It could be tempting to speculate that these larger vendors are supported by organised crime groups, which help in a quick and prompt adaptation of the online portfolio and thrive in the formally unregulated and non-controlled structure of the dark web (EMCDDA-Europol 2020, EMCDDA-Europol 2019.

It is clear from the results of this study that DWMs and vendors quickly adapted to the COVID-19 pandemic, introducing related products to fulfill the necessities generated on the market soon after the introduction of new global restrictions. For each marketplace, the number of products introduced was not in relation to the size of the markets, but more to the types of products that the market was already advertising.

Whilst a description of these marketplaces has been offered, the direct effect of COVID-19 is more easily seen within the activities of the single vendor.

Findings support the hypotheses that most vendors appeared to have added COVID-19 products to their existing DWM portfolios, as opposed to new vendors emerging on the DWM, suggesting that the sale and distribution of these products was dominated by pre-existing illicit organisations and/or individuals. Indeed, out of the 24 vendors identified, only two had the sole scope of selling COVID-19 products, with portfolios limited to one item. For those well-established vendors, a trend of advertising COVID-19 products in line with their portfolio was noted, suggesting a high level of expertise with such products and type of markets proper of organised crime.

The speed and the extent at which COVID-19 related products emerged on DWMs (52 items across eight marketplaces) suggest the need for further monitoring activities and more targeted health interventions to avoid/limit the risks associated with the use of unapproved cures for COVID-19. Efforts should be made to inform users/potential users about such risky behaviors and the unwanted health consequences that might derive from the ingestion of such products. These mostly include commonly sold medications, like Ivermectin and Amantadine, which do not have any therapeutic indication/use in the treatment of Coronavirus infection India Today, 2021. When used improperly these drugs could became very dangerous from interacting with other medications, like blood-thinners, or causing mild to severe side effects (i.e., nausea, vomiting, diarrhea, hypotension (low blood pressure), allergic reactions (itching and hives), dizziness, ataxia (problems with balance), seizures, coma and even death) (Temple et al., 2021; FDA, 2020). Both the surface and the deep/darknet (e.g., fora) represent suitable digital environments where such interventions could take place allowing contact with an otherwise hard to reach population. This might include potential users who have not yet entered the darknet to purchase such medications and might be discouraged to do so by the evidence emerging from our studies as well as the enhanced awareness of becoming victims of frauds or the interaction with organized crime organizations. As the DWMs are not regulated, the risk associated with the adulteration of such products with other unlisted compounds remains high and make the intervention from governments even more necessary to safeguard public health.

Though restrictions associated with the COVID-19 pandemic are waning at the time of writing, the volatile nature of the DWMs suggests that new high-demand items will continue to present potential public health risks until addressed fundamentally. Future research utilizing differing methodologies for data collection would enable the development of renewed perspectives as well as the possibility to identify new trends in DWMs vendors activities.

Some study limitations need to be discussed. First, since we present a high-level exploratory analysis of DWMs, the breakdown into classifications of available products is limited. Data collection was restricted to that which has been processed by the utilised intelligence platform provided by Cybersolace. The latter has previously demonstrated to be an effective search tools for such type of activities on DWMs (Negri et al., 2021). Second, the limited sample size collected means generalisations about availability based on this data are restricted. However, as this research was largely exploratory and intended to identify the initial nature and extent of COVID-19 related products on DWMs with a view to informing policy response, we feel the insights generated are of value. Third, this study did not purchase any products advertised for sale on the observed DWM listings and so cannot testify the genuineness of the products listed available, nor their actual availability.

5. Conclusion

The COVID-19 pandemic gave rise to a substantial wave of illicit products being offered on DWMs.

While accessing DWMs requires a certain level of digital literacy, which has not yet been widely reached (van Kessel et al., 2022), the potential health risk associated with the purchase of goods from such markets cannot be understated. Provision of false COVID- 19 certification can jeopardise not only health of the individual, but may cascade into larger-scale public health problems. In addition, the distribution of dubious ‘cures’ for COVID-19 may pose their own health risks that is then compounded by the infection itself (López-Medina et al., 2021, Temple et al., 2021). Considering the anonymity in which DWMs operate, these findings further capture the urgency to develop digital capacity in the general population as to increase awareness of the risks associated with browsing and interacting with vendors of dubious nature on the darkweb. Further policy interventions should also focus on regulating access pathways to the darkweb to further stifle their ability to spread illegal and counterfeit products. Ultimately, the DWMs constitute a complex problem that remain largely unknown in an increasingly digitalising society yet become increasingly more dangerous over time due to the growing contents of their portfolios.

CRediT authorship contribution statement

Valeria Catalani: Conceptualization, Methodology, Software, Data curation, Writing – original draft, Visualization, Investigation, Writing – review & editing. Honor D. Townshend: Conceptualization, Methodology, Software, Supervision, Writing – review & editing. Mariya Prilutskaya: Conceptualization, Methodology, Software, Supervision, Writing – review & editing. Andres Roman-Urrestarazu: Conceptualization, Methodology, Software, Supervision, Writing – review & editing. Robin van Kessel: Conceptualization, Methodology, Software, Supervision, Writing – review & editing. Robert P. Chilcott: Conceptualization, Methodology, Software, Supervision, Writing – review & editing. Hani Banayoti: Conceptualization, Methodology, Software, Supervision, Writing – review & editing. Tim McSweeney: Conceptualization, Methodology, Software, Supervision, Writing – review & editing. Ornella Corazza: Conceptualization, Methodology, Software, Supervision, Writing – review & editing.

Declaration of competing interests

The authors declare that they have no known competing financial interests or personal relationships that could have appeared to influence the work reported in this paper.

References

  1. AWS, 2021. Wickr, an AWS Company | Secure Collaboration Service (accessed 12.18.21).
  2. Barratt M.J. SILK ROAD: EBAY FOR DRUGS. Addiction. 2012;107:683. doi: 10.1111/J.1360-0443.2011.03709.X. [DOI] [PubMed] [Google Scholar]
  3. Bird, L., Bish, A., Gastelum Felix, S., Gastrow, P., Mora Gomez, M., Kemp, W., Kimani, J., Meegan-Vickers, J., Mejdini, F., Micallef, M., Tagziria, L., Tennant, I., Rademeyer, J., Reitano, T., Scaturro, R., Sellar, J., Shaw, M., Stanyard, J., 2020. Crime and Contagion The impact of a pandemic on organized crime.
  4. Bracci, A., Nadini, M., Aliapoulios, M., McCoy, D., Gray, I., Teytelboym, A., Gallo, A., Baronchelli, A., 2021. Dark Web Marketplaces and COVID-19: After the vaccines. [DOI] [PMC free article] [PubMed]
  5. Callaway E. The unequal scramble for coronavirus vaccines - by the numbers. Nature. 2020;584:506–507. doi: 10.1038/D41586-020-02450-X. [DOI] [PubMed] [Google Scholar]
  6. CDC, 2021a. VAMS COVID-19 Vaccination Reporting [WWW Document]. URL https://www.cdc.gov/vaccines/covid-19/reporting/vams/index.html (accessed 12.21.21).
  7. CDC, 2021b. U.S Citizens, U.S. Nationals, U.S. Lawful Permanent Residents, and Immigrants: Travel to and from the United States [WWW Document]. URL https://www.cdc.gov/coronavirus/2019-ncov/travelers/international-travel-during-covid19.html (accessed 12.21.21).
  8. CDC, 2021c. Requirement for Proof of COVID-19 Vaccination for Air Passengers [WWW Document]. URL https://www.cdc.gov/coronavirus/2019-ncov/travelers/proof-of-vaccination.html (accessed 12.20.21).
  9. Chauhan P.R., Gardas S.J., Kumar N., Scholar M.E. A Review of Completely Public, PGP Public Key Servers. International Journal of Engineering Research & Technology. 2013 2. [Google Scholar]
  10. Corazza, O., Catalani, V., Townshend, H.D.M., Prilutskaya, M., Chilcott, R.P., Metastasio, A., Banayoti, H., McSweeney, T., 2022. Illicit COVID-19 products online: Identify and preventing online health risks. under submission. [DOI] [PMC free article] [PubMed]
  11. Dark Web Live, 2021. Versus Market [WWW Document]. URL https://darkweblive.net/versus-market/ (accessed 12.18.21).
  12. DARKNEtone, 2021. #1 Darknet Markets List 2021 [WWW Document]. URL https://darknetone.com/markets/ (accessed 12.17.21).
  13. DarknetOne, 2021a. Dark0de Reborn Market [WWW Document]. URL https://darknetone.com/market/dark0de/ (accessed 12.17.21).
  14. DarknetOne, 2021b. Cartel Market [WWW Document]. URL https://darknetone.com/market/cartel-market/ (accessed 12.17.21).
  15. DarknetStats, 2021a. Dark0de Reborn [WWW Document]. URL https://www.darknetstats.com/dark0de-reborn/ (accessed 12.17.21).
  16. DarknetStats, 2021b. Cannazon Market [WWW Document]. URL https://www.darknetstats.com/cannazon-market/ (accessed 12.18.21).
  17. DarknetStats, 2021c. The Dark Web's Biggest Cannabis Only Market is Retiring [WWW Document]. URL https://www.darknetstats.com/the-dark-webs-biggest-cannabis-only-market-is-retiring/ (accessed 3.7.22).
  18. DataBreaches.net, 2017. Niche dark web marketplaces for buying confidential insider information [WWW Document]. URL https://www.databreaches.net/niche-dark-web-marketplaces-for-buying-confidential-insider-information/ (accessed 4.11.22).
  19. dnstats, 2021. The Big List of Darknet Markets 2021 - Best Darknet Markets [WWW Document]. URL https://dnstats.net/list-of-darknet-markets/ (accessed 12.16.21).
  20. dnstats.net, 2021. Cartel Market [WWW Document]. URL https://dnstats.net/shop/cartel-market/ (accessed 12.18.21).
  21. ElBahrawy, A., Alessandretti, L., Rusnac, L., Goldsmith, D., Teytelboym, A., Baronchelli, A., 2020. Collective dynamics of dark web marketplaces. undefined 10. 10.1038/S41598-020-74416-Y. [DOI] [PMC free article] [PubMed]
  22. EMCDDA, 2018. Darknet markets ecosystem – Lifetimes and reasons for closure of over 100 global darknet markets offering drugs, sorted by date [WWW Document]. URL https://www.emcdda.europa.eu/publications/posters/2018/darknet-markets-ecosystem_en (accessed 4.7.22).
  23. EMCDDA, 2017. Drugs and the darknet: perspectives for enforcement, research and policy | www.emcdda.europa.eu. Lisbon.
  24. EMCDDA-Europol, 2020. EU Drug Markets: Impact of COVID-19. 10.2810/19284. [DOI]
  25. EMCDDA-Europol, 2019. EU Drug Markets Report 2019.
  26. European Commission, 2021. European Commission [WWW Document]. URL https://ec.europa.eu/info/live-work-travel-eu/coronavirus-response/safe-covid-19-vaccines-europeans/eu-digital-covid-certificate_en (accessed 12.15.21).
  27. EUROPOL . Internet organised crime threat. 2021. assessment (IOCTA) 2021. Luxembourg. [DOI] [Google Scholar]
  28. Europol, 2016. Cybercriminal Darkode forum taken down through global action [WWW Document]. URL https://www.europol.europa.eu/media-press/newsroom/news/cybercriminal-darkode-forum-taken-down-through-global-action (accessed 12.17.21).
  29. FBI, 2015. Cyber Criminal Forum Taken Down [WWW Document]. URL https://www.fbi.gov/news/stories/cyber-criminal-forum-taken-down/cyber-criminal-forum-taken-down (accessed 3.7.22).
  30. FDA, 2020. Why You Should Not Use Ivermectin to Treat or Prevent COVID-19 | FDA [WWW Document]. URL https://www.fda.gov/consumers/consumer-updates/why-you-should-not-use-ivermectin-treat-or-prevent-covid-19 (accessed 3.12.23).
  31. Guirakhoo, A., 2020. How cybercriminals are taking advantage of COVID-19: Scams, fraud, and misinformation [WWW Document]. URL https://www.digitalshadows.com/blog-and-research/how-cybercriminals-are-taking-advantage-of-covid-19-scams-fraud-misinformation/ (accessed 12.20.21).
  32. I2P, 2021. I2P Anonymous Network [WWW Document]. URL https://geti2p.net/en/ (accessed 3.7.22).
  33. IATA, 2021. Travel Pass Initiative [WWW Document]. URL https://www.iata.org/en/programs/passenger/travel-pass/ (accessed 12.20.21).
  34. India Today, 2021. Why HCQ and Ivermectin were removed from India's Covid-19 treatment protocol - Coronavirus Outbreak News [WWW Document]. URL https://www.indiatoday.in/coronavirus-outbreak/story/why-hcq-ivermectin-dropped-india-covid-treatment-protocol-1857306-2021-09-26 (accessed 12.23.21).
  35. INTERPOL, 2021a. Fake COVID vaccine distribution network dismantled after INTERPOL alert [WWW Document]. URL https://www.interpol.int/en/News-and-Events/News/2021/Fake-COVID-vaccine-distribution-network-dismantled-after-INTERPOL-alert (accessed 12.21.21).
  36. INTERPOL, 2021b. Online vaccine scams: INTERPOL and Homeland Security Investigations issue public warning [WWW Document]. URL https://www.interpol.int/en/News-and-Events/News/2021/Online-vaccine-scams-INTERPOL-and-Homeland-Security-Investigations-issue-public-warning (accessed 12.15.21).
  37. INTERPOL, 2020a. Global operation sees a rise in fake medical products related to COVID-19 [WWW Document]. URL https://www.interpol.int/en/News-and-Events/News/2020/Global-operation-sees-a-rise-in-fake-medical-products-related-to-COVID-19 (accessed 12.20.21).
  38. INTERPOL, 2020b. INTERPOL warns of organized crime threat to COVID-19 vaccines [WWW Document]. URL https://www.interpol.int/en/News-and-Events/News/2020/INTERPOL-warns-of-organized-crime-threat-to-COVID-19-vaccines (accessed 1.4.22).
  39. jabber.org, 2021. jabber.org - the original XMPP instant messaging service [WWW Document]. URL https://www.jabber.org/ (accessed 3.7.22).
  40. van Kessel R, Wong BLH, Rubinić I, O'Nuallain E, Czabanowska K. Is Europe prepared to go digital? Making the case for developing digital capacity: an exploratory analysis of Eurostat survey data. PLOS Digital Health. 2022;1(2) doi: 10.1371/journal.pdig.0000013. [DOI] [PMC free article] [PubMed] [Google Scholar]
  41. López-Medina E, López P, Hurtado IC, Dávalos DM, Ramirez O, Martínez E, et al. Effect of ivermectin on time to resolution of symptoms among adults with mild COVID-19. JAMA. 2021;325(14):1426. doi: 10.1001/jama.2021.3071. [DOI] [PMC free article] [PubMed] [Google Scholar]
  42. Monero, 2021. Monero - secure, private, untraceable [WWW Document]. URL https://www.getmonero.org/ (accessed 12.16.21).
  43. Mooney R., Simonato P., Ruparelia R., Roman-Urrestarazu A., Martinotti G., Corazza O. The use of supplements and performance and image enhancing drugs in fitness settings: A exploratory cross-sectional investigation in the United Kingdom. Hum Psychopharmacol. 2017;32 doi: 10.1002/hup.2619. [DOI] [PubMed] [Google Scholar]
  44. Negri A., Townshend H., McSweeney T., Angelopoulou O., Banayoti H., Prilutskaya M., Bowden-Jones O., Corazza O. Carfentanil on the darknet: Potential scam or alarming public health threat? International Journal of Drug Policy. 2021;91 doi: 10.1016/J.DRUGPO.2021.103118. [DOI] [PubMed] [Google Scholar]
  45. New Zealand Government, 2021. My Vaccine Pass | Unite against COVID-19 [WWW Document]. URL https://covid19.govt.nz/covid-19-vaccines/covid-19-vaccination-certificates/my-vaccine-pass/ (accessed 12.20.21).
  46. Onion.Live, 2021. Yakuza Market - Where Anarchy Meets Capitalism [WWW Document]. URL https://onion.live/site/yakuza-market-where-anarchy-meets-capitalism (accessed 12.18.21).
  47. ProtonMail, 2021. Secure email: ProtonMail is free encrypted email. [WWW Document]. URL https://protonmail.com/ (accessed 3.7.22).
  48. reddit, 2021. Interview With Darknet Marketplace Dark0de Reborn : darknet [WWW Document]. URL https://www.reddit.com/r/darknet/comments/kx9u9r/interview_with_darknet_marketplace_dark0de_reborn/ (accessed 12.17.21).
  49. Temple C., Hoang R., Hendrickson R.G. Toxic Effects from Ivermectin Use Associated with Prevention and Treatment of Covid-19. New England Journal of Medicine. 2021;385:2197–2198. doi: 10.1056/NEJMC2114907/SUPPL_FILE/NEJMC2114907_DISCLOSURES.PDF. [DOI] [PMC free article] [PubMed] [Google Scholar]
  50. Tor, 2021. Tor Project [WWW Document]. URL https://www.torproject.org/(accessed 12.17.21).
  51. UNODC, 2020. COVID-19 and the drug supply chain: from production and trafficking to use. Available from: www.unodc.org (this was COVID-19 nd).
  52. UNODC, 2021. Covid-19 and drugs: impact outlook. Vienna.
  53. Vincent, J., 2021. Police arrest 150 suspects after closure of dark web's largest illegal marketplace - The Verge [WWW Document]. URL https://www.theverge.com/2021/10/27/22748317/darkmarket-closure-international-arrests-operation-dark-huntor (accessed 3.7.22).
  54. WIRED, 2021. The Demise of White House Market Will Shake Up the Dark Web [WWW Document]. URL https://www.wired.com/story/white-house-market-dark-web-drugs-goes-down/ (accessed 3.7.22).

Articles from Emerging Trends in Drugs, Addictions, and Health are provided here courtesy of Elsevier

RESOURCES