Dark Web Marketplaces and COVID-19: before the vaccine

Abstract

The COVID-19 pandemic has reshaped the demand for goods and services worldwide. The combination of a public health emergency, economic distress, and misinformation-driven panic have pushed customers and vendors towards the shadow economy. In particular, dark web marketplaces (DWMs), commercial websites accessible via free software, have gained significant popularity. Here, we analyse 851,199 listings extracted from 30 DWMs between January 1, 2020 and November 16, 2020. We identify 788 listings directly related to COVID-19 products and monitor the temporal evolution of product categories including Personal Protective Equipment (PPE), medicines (e.g., hydroxyclorochine), and medical frauds. Finally, we compare trends in their temporal evolution with variations in public attention, as measured by Twitter posts and Wikipedia page visits. We reveal how the online shadow economy has evolved during the COVID-19 pandemic and highlight the importance of a continuous monitoring of DWMs, especially now that real vaccines are available and in short supply. We anticipate our analysis will be of interest both to researchers and public agencies focused on the protection of public health.

Introduction

COVID-19 gained global attention when China suddenly quarantined the city of Wuhan on January 23, 2020 [1]. Declared a pandemic by the World Health Organization on March 11, 2020, at the moment of writing the virus has infected more than 62,000,000 people and caused over 1,450,000 deaths worldwide [2]. Measures such as social distancing, quarantine, travel restrictions, testing, and contact tracing have proven vital to containing the COVID-19 pandemic [3].

Restrictions have shaken the global economy and reshaped the demand for goods and services worldwide, with an estimated 2.5–3% world GDP loss since the crisis started [4]. Demand for many products has fallen; for example, the price of Brent crude oil decreased from 68.90 USD a barrel on January 1, 2020 to 43.52 USD as of August 2, 2020 [5, 6]. Meanwhile demand for other products, such as toilet paper [7], dramatically increased. As a result of increased demand, some products have been in short supply. Individual protective masks were sold in the United States at 7 USD on February 2, 2020 [8] and the price of alcohol disinfectant doubled on July 1, 2020 in Japan [9]. Additionally, anti-gouging regulations were introduced to control prices, which significantly affected the public attention on products related to COVID-19 [10]. As this trend has continued, further exacerbated by online misinformation, numerous customers have sought to fulfill their needs through illicit online channels [11, 12].

Dark web marketplaces (DWMs) offer access to the shadow economy via specialized browsers, like Tor [13]. DWMs offer a variety of goods including drugs, firearms, credit cards, and fake IDs [14]. The most popular currency on DWMs is Bitcoin [15], but other cryptocurrencies are accepted for payment as well. The first modern DWM was the Silk Road, launched in 2011 [16] and shut down by the FBI [17] in 2013. Since then, dozens more DWMs have sprung up and many have shut down due to police action, hacks, or scams. Today, DWMs form an ecosystem [18] that has proven extremely resilient to law-enforcement. Whenever a DWM is shut down, users swiftly migrate to alternative active DWM and the economic activity recovers within a matter of days [19].

Researchers have studied DWMs since the emergence of Silk Road [16], through a series of case studies [20–22], and comparative analyses [23–28]. Past efforts have mostly focused on specific goods, such as drugs or digital products [29]. However, these studies experienced technical difficulties in data collection preventing researchers from analysing a large and up-to-date dataset. As a result, several questions remain open, among which are:

• how do DWMs react to sudden shocks (e.g., shortages) in the traditional economy?

• how do DWMs respond to trends in public attention?

In this study, we address these questions by analysing a new, large, and up-to-date dataset. We studied 851,199 listings extracted from 30 DWMs between January 1, 2020 and November 16, 2020, right before the first worldwide vaccination campaign started in the United Kingdom [30]. We identify 788 COVID-19 specific listings that range from protective masks [31] to hydroxychloroquine medicine [32]. These listings were observed 9464 times during this period, allowing us to investigate their temporal evolution. We compare this COVID-19 related shadow economy with public attention measured through Twitter posts (tweets) [33] and Wikipedia page visits [34]. Finally, we inspect listings that mentioned delays in shipping or sales because of COVID-19. We significantly extend previous analyses that surveyed 222 COVID-19 specific listings extracted from 20 DWMs on a single day (April 3, 2020) [35] and, to the best of our knowledge, offer the most comprehensive overview of the DWM activity generated by the ongoing pandemic.

We found that DWMs promptly respond to signals coming from the traditional economy, increasing or decreasing the supply of goods according to their availability on regulated markets. For example, protective masks appeared in DWMs in March, when they were in short supply in the regulated economy, and became more scarce on DWMs later on when masks could be easily bought in shops. We also found that DWMs swiftly react to changes in public attention as measured through Twitter posts and Wikipedia page views. Finally, we registered spikes in the number of listings mentioning COVID-19 in correspondence with lockdown measures in March and October. Our results are of interest to different audiences: the academic community may further explore the behaviour of DWMs in relation to social changes. Policy makers can better understand the effects that new legislation have in the shadow economy. Practitioners may learn that DWMs posit additional threats to public health. A finding especially important due to the production of COVID-19 vaccines.

The manuscript is organized as follows. In the Background Section, we introduce DWMs with a brief overview of their history. In the Data Section, we explain how we obtained our DWMs, Twitter, and Wikipedia datasets. The main outcomes of our work are presented in the Results Section, while in the Discussion Section we compare them with the established technical literature. Finally, in the Conclusion Section, we highlight the contributions of our work that are relevant to different audiences as well as future research developments.

Background: dark web marketplaces

The online shadow economy is as old as the Internet. The first reported illegal online deal involved drugs and took place in 1972 [36]. The World Wide Web [37] facilitated the emergence of online illicit marketplaces [38, 39] but the first marketplaces could not guarantee anonymity and therefore permitted the traceability of users by law enforcement [40].

Modern DWMs originated and still operate online, but outside the World Wide Web in an encrypted part of the Internet whose contents are often not indexed by standard web search-engines [41]. Silk Road marketplace, which launched in 2011, was the first modern DWM [16]. It proposed a new way of trading drugs and other illegal products online and anonymously [23–25]. There were two key ingredients of Silk Road’s success. First, potential customers could access it using the Tor browser [13], which made their traceability difficult. Second, purchases were made in Bitcoin [15], which provided a degree of privacy to buyers and sellers [29, 42, 43]. After the FBI shut down Silk Road in 2013 [17], new DWMs quickly appeared, offering drugs, firearms, credit cards, and fake IDs [14]. These DWMs also adapted to further increase the level of privacy and security offered to users [20, 21], such as the Invisible Internet Project (I2P) [44] and escrow checkout services [45]. Tor, now available for mobile devices as well, still offers more privacy than many other popular mobile applications [46] and Bitcoin is currently the most popular cryptocurrency in DWMs [47–49].

Trade today on DWMs is worth at least several hundreds of millions of USD per year, and involves hundreds of thousands of buyers and vendors [17–19, 50–52]. As a result, law enforcement agencies have put considerable effort into combating DWMs [17, 51, 52]. Furthermore, DWMs have been targets of cybercriminal actors through use of distributed denial-of-service (DDoS) attacks and hacking attempts, while some DWMs also shut down due to administrators stealing funds from customers directly [53, 54]. However, DWMs have organised into a robust ecosystem which has proven exceptionally resilient to closures and whenever a DWM is closed, the users trading higher volumes of Bitcoins migrate to active DWMs or establish new ones [19].

The resilience and functioning operations of modern DWMs are possible partially because of numerous websites and forums where users can share their experiences. One example is Dread [55], a Reddit-like forum created in 2018 after the closure of the dedicated pages on Reddit [56]. Other ad-hoc platforms exist to monitor whether known DWMs are active or currently unavailable [57–60]. Additional mechanisms, like feedback and ratings systems [18], enhance the resilience of these DWMs and build trust towards the DWM and its vendors. In a similar way to regulated online marketplaces, DWM buyers are asked to leave feedback and a rating after a purchase. Additionally, DWM administrators often act as vendor moderators by banning vendors or specific categories of products. Some examples of this are DarkBay, where banned categories include human trafficking, contract killing and weapons [61], and Monopoly marketplace, where COVID-19 fake vaccine listings were recently banned by moderators [62].

DWMs have been used to circumvent laws and regulations. They have been the subject of many case studies [20–22] and comparative analyses [23–28]. These studies highlighted that illicit online transactions in DWMs are perceived as safer than negotiating in face-to-face drug markets [20]. They are based on the concept of “harm reduction,” where vendors prefer to sell tested and high-quality products [21]. Although DWMs form an online community, they are made unstable by their profit-based mentality of capitalism [22]. Vendors customize their products to match the specialisation of different DWMs thus creating an efficient distribution network [28], which sometimes goes beyond a base retail market [27]. While these characteristics favour the DWM economy against the offline shadow economy, DWMs sell a variety of illicit products [23–26], such as, drugs, fake IDs, “how to” manuals (for scams, bombs etc.), and weapons. One prominent category is that of digital goods [63], including ransomware, social engineering guides, and financial malware to steal credit cards and bank account credentials.

It is hard to estimate how many live DWMs currently exist. Some recent reports include one from independent researcher Gwern, who identified 19 live platforms on April 22, 2020 [64], the website www.darknetstats.com, which registered 10 live “established” DWMs on May 27, 2020 [65], and one where 20 DWMs were observed one single day (April 3, 2020) [35]. Currently established DWMs at the time of writing include Hydra and White House marketplaces.

Data and methods

Dark web marketplaces

The listings used for our study were obtained by web crawling DWMs. Web crawling consists of extracting data from websites and is performed by specialized software. Web crawling DWMs is a challenging task because crawlers must bypass several protective layers. Most DWMs require authentication and some even require a direct invitation from a current member. Additionally, strong CAPTCHAs [66] are implemented to avoid otherwise easy and automated access to the online DWM. Several research groups tried to overcome these challenges. Some examples are, HTTrack software used in [16], a combination of PHP, the curl library, and MySQL was proposed in [67], the Python library scrapy adopted in [68], and an automated methodology using the AppleScript language utilized in [69]. There are currently very few open source tools available [66, 70] for crawling DWMs, which often leaves companies and federal agencies to rely on commercial software [71]. Downloading content from DWMs remains a challenging task, and the objective becomes even harder when the research study requires monitoring multiple DWMs for an extended period of time.

Our dataset contains listings crawled from 30 DWMs between January 1, 2020 and November 16, 2020 by Flashpoint Intelligence [72], a company specializing in online risk intelligence. It includes the most popular DWMs in 2020, such as Hydra, White House, Empire and DarkMarket [35, 65]. The crawling pipeline consists of authenticating into DWMs and downloading key attributes for each active listing, as highlighted in Fig. 1. Each DWM was crawled for at least 90 different days. We categorized the COVID-19 specific listings into PPE, medicines, guides on scamming, web domains, medical frauds, tests, fake medical records, and ventilators. Representative examples of listings relative to these categories are presented in Table 1, with specific listing examples in Appendix B.1. Only a fraction of the selected listings were actual COVID-19 specific listings, since mitigation measures to prevent COVID-19 spreading have also impacted illegal trades of other listings. For instance, a vendor might sell cocaine and mention shipping delays due to COVID-19. We included such cases in the category COVID-19 mentions. For details about data pre-processing, see Appendix A, where we explain how we select listings related to COVID-19 and how we classify them in categories. We remark that our pre-processing pipeline is biased towards the English language, and this constitutes a limitation of our work.

Figure 1.

Example of a chloroquine listing in the DarkBay/Dbay marketplace, where we highlight some of its salient attributes. Among the attributes considered in this work and shown in Table 4, “Time” and “Marketplace name” attributes are not present in this screenshot, while the “Quantity” attribute is not fixed by the vendor

Table 1.

Categories used to classify the selected COVID-19 dataset. The first five categories constitute COVID-19 specific listings, while the last one, called COVID-19 mentions, includes listings mentioning one of the keywords in Table 5 without selling actual COVID-19 specific listings

Category	Examples
PPE	gloves, gowns, masks, n95
Medicines	azithromycin, chloroquine, azithromycin, favipiravir, remdesivir
Guides on scamming	how to illicitly get COVID-19 relief packages
Web Domains	covid-testing.in, coronavintheworld.com
Medical Frauds	antidotes, vaccines, allegedly curative recreational drug mixes
Tests	diagnosis, test
Fake Medical Records	medical record, medical certification
Ventilators	medical ventilators
COVID-19 mentions	computer, drugs, scam (excluding listings in the previous categories)

Overall, our dataset includes a total of 851,199 unique listings, which were observed a total of 8,538,593 times between January 1, 2020 and November 16, 2020. In Table 2 we report the breakdown of the number of unique listings and their total observations in each of the 30 DWMs. We did not find any mention of COVID-19 on 12 DWMs (Atshop, Black Market Guns, Cannabay, Darkseid, ElHerbolario, Exchange, Genesis, Mouse in Box, Rocketr, Selly, Skimmer Device and Venus Anonymous). This makes sense as these DWMs are primarily focused on specific goods with a pre-defined listing text structure. A brief description of each DWM together with its specialization can be found in Table 7. On the remaining 18 DWMs, there were a total of 10,455 unique listings related to COVID-19, which constitutes less than 1% of the entire dataset. These listings were mostly composed of drugs that reported discounts or delays in shipping due to COVID-19. Listings concerning more specific COVID-19 goods such as masks, ventilators, and tests were available on 13 DWMs (Connect, Cypher, DarkBay/DBay, DarkMarket, Empire, Hydra, MagBO, Monopoly, Plati.market, Torrez, CanadaHQ, White House, and Yellow Brick). There were 788 COVID-19 specific listings in these DWMs which were observed 9464 times during the analysed time period.

Table 2.

This Table reports the number of days each DWM was crawled, the number of unique listings, all and COVID-19 specific, and the number of listing observations, all and COVID-19 specific. CanadaHQ indicates The Canadian HeadQuarters marketplace

Name marketplace	Days crawled	Listings All	Listings COVID-19 specific	Observations All	Observations COVID-19 specific
Atshop	135	2748	0	88,014	0
Black Market Guns	293	18	0	5274	0
CanadaHQ	199	63,756	48	360,978	475
Cannabay	251	3578	0	4667	0
Cannazon	159	4160	0	8791	0
Connect	202	476	2	13,602	23
Cypher	138	14,167	14	370,497	495
DarkBay/DBay	127	132,054	425	848,408	6589
DarkMarket	109	54,170	49	89,515	70
Darkseid	321	8	0	2568	0
ElHerbolario	286	13	0	2130	0
Empire	150	58,754	94	221,466	201
Exchange	168	9631	0	31,605	0
Genesis	320	324,312	0	3,729,205	0
Hydra	263	13,648	2	96,965	5
MEGA Darknet	260	916	0	3219	0
MagBO	109	35,641	50	248,825	189
Monopoly	184	1125	2	98,074	272
Mouse In Box	154	2826	0	114,858	0
Plati.market	321	22,551	3	36,599	3
Rocketr	320	462	0	15,437	0
Selly	221	822	0	6415	0
Shoppy.gg	321	10,458	0	820,339	0
Skimmer Device	321	12	0	3852	0
Tor Market	130	634	0	25,344	0
Torrez	151	15,330	22	449,797	527
Venus Anonymous	309	84	0	25,660	0
White House	187	46,983	42	627,343	278
Willhaben	321	25,346	0	85,925	0
Yellow Brick	129	6516	35	103,221	337
Total	≥90	851,199	788	8,538,593	9464

Table 7.

List of all DWMs, together with their specialization and a brief description

DWM	Specialization	Description
Atshop	Digital Goods	Atshop e-commerce marketplace platform
Black Market Guns	Weapons	Weapons Marketplace, now exit scammed according to onion.live [57]
CanadaHQ	Mixed	Multivendor cryptocurrency marketplace
Cannabay	Drugs	Russian language drug marketplace focusing on cannabis
Cannazon	Drugs (Cannabis)	Drug marketplace for cannabis products only
Connect	Mixed	A social network that hosts a marketplace for the sale of illicit goods
Cypher	Mixed	Cypher is a multivendor market for the sale of drugs and digital goods.
DarkBay/DBay	Mixed	Multivendor cryptocurrency DWM selling digital goods, drugs, and services
Dark Market	Mixed	Multivendor cryptocurrency DWM selling digital goods, drugs, and services
Darkseid	Weapons	Weapons DWM
ElHerbolario	Drugs	Single-vendor shop, selling just 3 products, primarily leaning towards Cannabis
Empire	Mixed	Alphabay-style DWM with BTC, LTC, XMR, MultiSig, and PGP 2FA
Exchange	Mixed	Chinese language marketplace
Genesis	Digital goods	Marketplace selling digital identities for account takeover activities
Hydra	Drugs	Russian language drug DWM
MagBO	Digital Goods	Shell, account and card shop
MEGA Darknet	Mixed	Russian language DWM
Monopoly	Drugs	Multivendor market that is primarily focused on drugs
Mouse In Box	Digital Goods	Marketplace that sells packages of login and session information acquired from web browsers with a stealer malware.
Plati.Market	Digital goods	digital goods DWM
Rocketr	Digital goods	Marketplace for the sale of illicit digital goods
Selly	Digital goods	Marketplace for the sale of illicit digital goods
Shoppy.gg	Digital goods	Marketplace for the sale of illicit digital goods
Skimmer Device	Skimmer devices	Marketplace selling skimmer devices
Tor Market	Drugs	Drug DWM focused on supplying the drug marketplace in New Zealand
Torrez	Mixed	Torrez is a multivendor market that uses wallet-less payments.
Venus Anonymous	Mixed	Multivendor DWM selling digital goods and drugs
White House	Mixed	Multivendor cryptocurrency DWM
Wilhaben	Mixed	German language DWM for the sale of illicit goods
Yellow Brick	Mixed	Multivendor cryptocurrency DWM

Twitter

We sampled tweets related to COVID-19 using a freely available dataset introduced in Chen et al [33]. We downloaded the tweets ID from the public GitHub repository and then used the provided script to recover the original tweets through the Python library twarc. We studied the temporal evolution of the number of tweets mentioning selected keywords, such as “chloroquine”. In line with our dataset of DWM listings, most of the considered tweets were written in English and the time period considered ranges from January 21, 2020 to November 13, 2020.

Wikipedia

We used the publicly available Wikipedia API [34] to collect data about the number of visits at specific pages related with COVID-19, such as chloroquine. The Wikipedia search engine was case-sensitive and we considered strings with the first letter uppercase, while the others lowercase. We looked for the number Wikipedia page visits in the English language from January 1, 2020 to November 16, 2020.

Results

We assessed the impact of COVID-19 on online illicit trade along three main criteria. First, we focused on the 13 DWMs containing at least one COVID-19 specific listing, analysing their offers in terms of the categories PPE, medicines, guides on scamming, web domains, medical frauds, tests, fake medical records, and ventilators, as introduced in Table 1. Second, we considered the 18 DWMs that included at least one listing in one of the categories in Table 1, thus adding listings to the COVID-19 mentions category in our analysis. We investigated the relationship between major COVID-19 events, public attention, and the time evolution of the number of active listings. Third, we quantified the indirect impact that COVID-19 had on all 30 DWMs under consideration by tracking the percentage of listings mentioning the themes of lockdown, delays, and sales. We linked their frequency to major COVID-19 events.

Categories of listings

Here, we focus on the 788 COVID-19 specific listings present in our dataset, observed 9464 times in the considered time window. PPE is the most represented category, with 355 unique listings (45.1% of COVID-19 specific listings) observed 5660 times (59.8% of observations of COVID-19 specific listings). The second most represented category is medicines, with 228 (28.9%) unique listings observed 1917 (20.3% of all) times. Some medicines listings, which are often sold together, included 38 chloroquine listings, 65 hydroxychloroquine listings, 51 azythromicin listings and 45 Amoxicillin listings. Other medicines included 2 remdesivir listings, one of the drugs used to treat USA’s president Trump [73]. A breakdown of the medicines category together with a brief description of the specific drugs can be found in Table 8, and multiple medicines are sometimes sold in the same listing. Another prominent category was guides on scamming, with 99 unique listings (12.6%). It includes manuals on how to earn money exploiting flaws in COVID-19 related government relief funds, and others on how to exploit alleged pandemic related security weaknesses (e.g. online banking, delivery systems). A breakdown of the different kinds of guides can be found in Table 9. One DWM (MagBO) was specialised in selling web domains, like “coronavirusmasks.in,” with 50 unique listings (6.3%). Additionally, we classified 34 (4.3%) unique listings as medical frauds, which are listings that promised immunity from COVID-19 (no such product exists, at the moment of writing), or supposed devices able to detect COVID-19 in the air. These listings also included illicit drug mixes sold as cures. We also registered 17 test (2.2% of COVID-19 specific listings), 3 fake medical records (0.4%) and 2 ICU ventilator (0.3%) listings. More details on these listings together with some examples are reported in Appendix B. There were a total of 252 vendors selling COVID-19 specific listings. Additionally, sellers posted multiple unique listings. In fact, 88 of them sold PPE (34.9%), 106 sold medicines (42.1%), 40 sold guides on scamming (15.9%), 15 web domains (6.0%), 23 sold medical frauds (9.1%), 13 sold tests (5.2%), 3 sold fake medical records (1.2%), and 2 sold ventilators (0.8%). The information in this paragraph is summarized in Table 3.

Table 8.

COVID-19 related medicines appearing in the listings, together with a brief description and the number of listings related to that drug

Medicine	Description	Listings
Hydroxychloroquine	Malaria medication	65
Azitrhomycin	Antibiotic often paired with hydroxychloroquine	51
Amoxicillin	Antibiotic medication	45
Chloroquine	Malaria medication	38
Ciprofloxacin	Antibiotic medication	6
Favipiravir	Antiviral medication used to treat influenza	5
Dxycycline	Antibiotic medication	4
Metronidazole	Antibiotic medication	4
Remdesivir	Antiviral medication	2
Lopiravir	Antiviral medication used to treat HIV	1

Table 9.

COVID-19 related guides on scamming appearing in the listings, together with a brief description and the number of listings related to that sub-category

Topic	Description	Listings
SBA loan	how to illicitly get money from the USA Small Business Loan program [81]	19
Bank account	how to exploit pandemic related security to open bank accounts	16
Fraud Pack	pack containing multiple generic covid related frauds	7
Covid-19	Generic guides explaining how to exploit the pandemic in many different ways	7
Amazon	Amazon related fraud guides	6
GoFundMe	GoFundMe related fraud guides	4
Apple	Apple related fraud guides	3
Unemployment fund	How to illicilty get money from government unemployment funds	3
Other	Other COVID-19 related fraud guides	34

Table 3.

Summary statistics for the considered categories of listings. For each category, we included the number of unique listings, observations, and vendors. If the same vendor sold listings in different categories, we counted it as one unique vendor

Category	Unique listings	Total observations	Vendors
PPE	355 (45.1%)	5660 (59.8%)	88 (34.9%)
Medicines	228 (28.9%)	1917 (20.3%)	106 (42.1%)
Guides on scamming	99 (12.6%)	1244 (13.1%)	40 (15.9%)
Web Domains	50 (6.3%)	189 (2.0%)	15 (6.0%)
Medical Frauds	34 (4.3%)	316 (3.3%)	23 (9.1%)
Tests	17 (2.2%)	51 (0.5%)	13 (5.2%)
Fake Medical Records	3 (0.4%)	9 (0.1%)	3 (1.2%)
Ventilators	2 (0.3%)	78 (0.8%)	2 (0.8%)
COVID-19	788 (100%)	9464 (100%)	252 (100%)

It is important to note that vendors often do not provide complete information on their listings but rather invite direct communication to facilitate sales. In 391 (49.6%) unique listings, the vendor invited potential customers to communicate via email or messaging applications such as WhatsApp, Wickr Me, and Snapchat. Thus, 511 (64.8%) COVID-19 specific listings contained no information about the offered amount of goods, 579 (73.5%) did not provide shipping information, and 16 (2.0%) did not disclose the listing price.

PPE and web domains were the least expensive products with a median price of 5 USD. Followed by medicines with 33 USD, guides on scamming with 75 USD, fake medical records with 130 USD, tests with 250 USD, medical frauds with 275 USD, and ventilators with 1400 USD. The distribution of prices for these categories can be found in Fig. 2(a). It shows that many listings had a low price of around a few USD or less and only few listings exceeded thousands or more USD. The cumulative value of the detected unique listings was $563\text{,}202$ USD, where we excluded listings with prices larger than $40\text{,}000$ USD using manual inspection. When vendors post listings at high price this typically indicates they have halted sales of an item with the expectation of selling it again in the future. We remove these anomalously high priced listings since they would largely overestimate the sales price of actually active listings [18]. The shipping information declared in the analysed listings involved a total of 18 countries or regions. Most of the vendors are willing to ship worldwide. Shipping from different continents appears possible because some vendors explicitly declare in listing descriptions that they have multiple warehouses across the globe, while shipping to any continent is done through specialized delivery services. The United States is the second largest exporter and shipping destination. The United Kingdom is the third largest exporter and importer, and no vendors explicitly mentioned Germany as a shipping destination even thought it is the fourth largest exporter. Complete shipping information is available in Fig. 2(b). Some examples of the COVID-19 specific listings are available in the Appendix B.1.

Figure 2.

(a) Box plot of the distribution of listing prices for each COVID-19 category. The box ranges from the lower to the upper quartile, with the horizontal line indicating the median. The whiskers extend up to the 5th and 95th percentiles respectively. The dots represent outliers. (b) Shipping information in COVID-19 specific listings. Note that 545 (or 71.1%) of these listings did not provide any shipping information

Figure 3(a) presents a word cloud built from the titles of the selected COVID-19 specific listings. The word cloud was built from 1-grams, meaning single words, excluding common English words and stop words. The COVID-19 pandemic was referred to as either “coronavirus,” “corona,” “covid,” or “covid19”. Among COVID-19 medicines, “hydroxychloroquine,” and “chloroquine” were the most popular ones, with fewer mentions of “azithromycin,” “medicated,” and “medical” products in general.

Figure 3.

(a) Word cloud for “Listing title” in COVID-19 specific listings. (b) Category breakdown of COVID-19 specific listings in the DWM that offered them. (c) Fraction of vendors selling at least one COVID-19 specific listing. (d) Vendor specialisation. Most vendors responsible for at least one COVID-19 specific listing also sell other listings, and in greater number

DarkBay/DBay marketplace contained the majority of the COVID-19 specific listings in our dataset, amounting to 425 (54.0%). The most available unique listings in DarkBay/DBay were PPE, which totaled 293. We also found 105 medicines, 24 medical frauds, 2 ventilators, and 1 tests. The number of listings available in the other DWMs was: 94 in Empire (which shut down in August 2020), 50 in MagBO, 49 in DarkMarket, 48 in The Canadian Headquarters, 42 in White House, and 35 in Yellow Brick. These numbers together with statistics of the less represented DWMs are as shown in Table 2. The entire breakdown of the number of COVID-19 specific listings detected in each category is available in Fig. 3(b).

In Fig. 3(c), we ranked the DWMs by their share of vendors selling COVID-19 specific listings. The total number of vendors behind COVID-19 specific listings in our dataset is 252. Most vendors sold only one COVID-19 specific listing, while few of them sold more than ten different unique COVID-19 specific listings. In Appendix D, we analysed the distribution of COVID-19 specific listings for each vendor. We found that it was heterogeneous according to a power-law with an exponent equal to −2.3 and 80% of the vendors had fewer than 5 unique listings, as shown in Fig. 7. This may imply that vendors of COVID-19 related products have a focus on a specific product category, or are just creating one-off listings to try to make quick money. In DarkBay/DBay, more than 15% of the vendors were selling COVID-19 specific listings, while in MagBO, The Canadian HeadQuarters, and Cypher this fraction was around 5% (with almost all other DWMs around 1%). This shows that law enforcement or intelligence intervention should not necessarily be approached evenly across marketplaces but instead focused on select marketplaces first with a higher concentration of COVID-19 specific listings. Finally, Fig. 3(d) shows that essentially no vendors specialised on COVID-19 products, with only 7 vendors selling more COVID-19 specific listings than unrelated ones, 4 of which actually sold just one or two COVID-19 specific listings overall in our dataset.

Time evolution of DWM listings and public attention

The number of active unique listings evolved over time, as shown in Fig. 4(a). The first COVID-19 specific listing in our dataset appeared on January 28, 2020, following the Wuhan lockdown [1]. In March, lockdowns in many countries [74, 75] corresponded to an increase in the number of these listings, whose number kept increasing until May. In June and July, when quarantine restrictions in the northern hemisphere started to ease [76], we observed a decreasing trend in the selected COVID-19 specific listings, which continued until November. COVID-19 mentions followed the same trend with two notable exceptions. We observed two sudden increases in COVID-19 in correspondence of the second wave of contagions in Europe in September [77] and new lockdown measures in November [78]. Figure 4(b) shows the evolution of the total number of observed PPE and medicines, the two most available COVID-19 specific listings in our dataset (see Table 3). PPE followed a trend compatible with the overall observations shown in Fig. 4(a), with a peak in May and a sudden decrease after July, as PPE have gradually become more available worldwide with respect to the shortage in the beginning of the pandemic. COVID-19 medicines remained approximately stable throughout these months, with a peak after USA president Donald Trump first referred to chloroquine [79]. A different trend was found for COVID-19 guides on scamming, which saw spikes in the number of listings in correspondence to event related to relief program measures [80–82]. More details can be found in Appendix D, Fig. 8.

Figure 4.

Longitudinal analysis of DWM activity. (a) Seven-days rolling average of active listings mentioning COVID-19 and COVID-19 specific listings. (b) Seven-days rolling average of the observed COVID-19 specific listings in the medicines and PPE categories. Black dashed vertical lines in panels (a) and (b) corresponded to significant COVID-19 world events, see Appendix C. (c) Seven-days median price with 95% confidence interval for COVID-19 specific listings. (d) Seven-days median price with 95% confidence interval for active COVID-19 specific listings in the PPE and medicines categories

The time evolution of the listing prices followed a different pattern. We considered the median price and its 95% confidence interval of active COVID-19 specific listings in Fig. 4(c), and of active PPE and medicines, in Fig. 4(d). Until March, the only COVID-19 specific listings concerned medicines, which influenced the overall median price. Afterwards, when PPE listings started to appear, they led the variation in the overall median price. In fact, over the entire time window, the median price of medicines listings was reasonably stable. PPE listings, instead, had a high price for March and most of April, possibly due to speculation. Interestingly, at the end of April, a vendor named “optimus,” active on DarkBay, started selling large quantities of PPE at 1 USD, putting many online listings at the same time, thus drastically reducing the median price, which remained low until July. Overall, “optimus” had 91 PPE listings during the registered period. PPE median price then increased back to the March level in July, when general worldwide availability of masks for the general population decreased the demand for small quantities of products. We report an analysis of the listings price for COVID-19 guides on scamming in Fig. 8 of Appendix D.

We also considered tweets and Wikipedia page visits as proxies for public attention, as already done in prior studies analysing the COVID-19 pandemic [83–85]. We compared trends in public attention with temporal variations in the number of active COVID-19 specific listings on DWMs. We focused our analysis on the PPE category and on relevant medicines in our dataset: hydroxychloroquine, chloroquine, and azitrhomycin. Figure 5(a) shows that a first peak in public attention on PPE was reached in late January following the Wuhan lockdown [1]. A second peak occurred in March [84] when PPE listings started to appear in DWMs. The number of PPE listings reached their maximum in May. After May, PPE listings steadily decreased along with public attention. It is worth noting that May also marked the end of the first wave of contagion in many European countries [86]. PPE listings virtually disappeared in July, as products became more accessible in legal shops. On the contrary Twitter saw a huge spike in June, when many states decided to gradually lift lockdown measures [76], causing a public debates on mask wearing which increased the twitter signal to stable high levels until November.

Figure 5.

DWMs and public attention. (a)-(c) Seven-days rolling average of active listings selling PPE, together with the time evolution of the number of tweets referring to masks and of visits in the relative Wikipedia page visits. (b)-(d) Similar comparison as in panels (a)-(c) but considering active listings of hydroxychloroquine, chloroquine, and azithromycin. Black dashed vertical lines in panels (a) and (b) mark significant events related with COVID-19, see Appendix C. See Appendix D for panels (a) and (b) with a linear y-axis

A similar relationship between mass media news, public attention, and DWMs was registered for the listings regarding the three considered medicines, as shown in Figs. 5(b) and (d). Four peaks in public attention were detected after four declarations from President Trump about these medicines [79, 87–89]. The number of active medicines listings closely followed. However, a closer look reveals the different shapes of Wikipedia page visits, tweets, and DWM active listings curves. Wikipedia page visits saw a very high peak of page visits after the first declaration from President Trump [79], and smaller peaks in correspondence in the following declarations. Tweets instead saw peaks of attention of increasing height. DWM listings on the contrary were much steadier in time and with little variation in the number of active listings throughout the first wave of the pandemic, while decreasing to a lower steady availability from the summer.

Impact of COVID-19 on other listings

We considered the indirect impact of COVID-19 on all the 30 DWMs in our dataset. We analyzed all listings in these DWMs (COVID-19 related and beyond), and looked at listings mentioning: lockdown, using keywords “lockdown” or “quarantine,” delay, using “delay” or “shipping problem,” and sales, using “sale,” “discount,” or “special offer.” Examples of listings reporting these keywords are available in Appendix B.2.

Figure 6(a)-(b)-(c) shows the percentage of all listings mentioning these themes over time. The percentage of all listings in the 30 DWMs mentioning lockdown never exceeded 1%, as illustrated in Fig. 6(a). It reached its maximum in November, when Europe started new lockdown measures [78]. Other peaks occurred in April and September, when nations first started to implement these measures [1, 74, 75] and at the beginning of the second wave of contagion in Europe [77], respectively. Delay mentions reached local peaks in March and May. These peaks occurred after major COVID-19 events, such as lockdowns [74, 75] and the situation in Europe starting to improve [86], respectively. Two global peaks, instead, were reached in September and November, when cases started to surge again in Europe [77] and when Europe started new lockdown measures [78], as shown in Fig. 6(b). A similar pattern was visible for the percentage of all listings mentioning sales. In addition, we observed that sales had a first peak corresponding to the New Year, which is a common practice of many offline regulated shops, as displayed in Fig. 6(c). Despite observing that the increase in the percentage of all listings mentioning sales, delays, and lockdown followed major events related to the pandemic, not all of these listings also mentioned COVID-19. We further researched this by plotting which percentage of the relative listings also mentioned COVID-19 in Fig. 6(d). The percentage of listings mentioning that current sales were due to COVID-19 was less than 1%, while mentions of delays reached up to 40%. For lockdown it was close to 100% until July, as one can expect since lockdowns exist because of COVID-19. In the three selected cases, the percentages of listings mentioning COVID-19 followed the global awareness about the current pandemic: increasing trends from January to the July [1, 74, 75, 90], less attention during the summer [86], and a returning increase in September and November [77, 78].

Figure 6.

Percentage of all active listings mentioning the themes lockdown, delay and sales in panels (a), (b), (c), respectively. (d) Percentage of active listings in panels (a), (b), (c) that mentioned also COVID-19 in their listings. Black dashed vertical lines in panels (a), (b), and (c) corresponded to major COVID-19 events, see Appendix C

Discussion

We investigated the presence of listings related to COVID-19 in 30 DWMs, monitored over a ten-months period in 2020. We considered COVID-19 specific listings and COVID-19 mentions, found them in 13 and 18 DWMs, respectively. COVID-19 specific listings totaled 788 unique products and represented less than 1% of our dataset. The majority of COVID-19 specific listings offered PPE (45.1%), followed by medicines (28.9%), guides on scamming (12.6%), web domains (6.3%), medical frauds (4.3%), tests (2.2%), fake medical records (0.4%) and ventilators (0.3%). Most COVID-19 specific listings did not report the quantity sold (64.8%) or shipping information (73.5%). Almost half of these listings invited potential customers to communicate via email or messaging applications, like WhatsApp (49.6%). Although direct communication fosters a trustworthy vendor-buyer relationship and may lay the ground for future transactions outside DWMs, it also exposes users to higher risk of being traced by law enforcement [91].

In our dataset, DarkBay/DBay is featured prominently among DWMs offering COVID-19 specific listings. Ranking in the top 100 sites in the entire dark web [92], DarkBay/DBay is regarded as the eBay of the dark web because it offers more listings categories than other DWMs [93]. It was also frequently accessible during the period of time monitored during this research, with an uptime of 80%, higher from the 77% uptime of Empire, the largest global DWM at the time of writing [94].

Our work corroborates previous findings and expands them in several ways. To the best of our knowledge, the most extensive report to date examined the presence of COVID-19 specific listings in 20 DWMs on one single day (April 3, 2020) [35]. Despite only a subset of overlapping DWMs between that report and our study, (Cypher, DarkBay/DBay, DarkMarket, Empire, Monopoly, Venus Anonymous, White House, and Yellow Brick) we both assessed that COVID-19 specific listings constituted less than 1% of the total listings in the DWMs ecosystem. These listings were mostly PPE, followed by medicines and they were found in only a few DWMs, while non COVID-19 specific listings were widespread.

An important novelty of the present study is the analysis of the temporal evolution of DWM behaviour and its relationship to public attention, as quantified through tweets and Wikipedia page visits. Following the Wuhan lockdown [1], we observed a first peak in public attention [85], and a corresponding emergence of the COVID-19 specific listings. A second peak in public attention occurred in March, when quarantine measures were adopted by many European countries [74, 75]. Again, during the same period, the number of COVID-19 specific listings sharply increased. When worldwide quarantine began to ease [76] in many countries, in June and July, we registered a decrease in public attention and in available COVID-19 specific listings. Towards the end of 2020, we did not detect significant variations in COVID-19 specific listings and public attention, in correspondence of the second wave of contagions [77] and new lockdown measures in Europe [78]. Both vendors of COVID-19 specific listings and public attention have adapted to the COVID-19 pandemic and react more smoothly to its development.

Listing prices correlated with both variations in public attention and individual choices of a few vendors. Median price experienced a sharp increase in March, probably due to speculation, and then decreased in April due to the choice of a single vendor responsible for 91 listings, named “optimus.” The vendor sold a large quantity of PPE at 1 USD only, which constituted the 37% of active PPE listings in April. Finally, we observed an increase in the percentage of all listings citing delays in shipping and sale offers, which peaked in March, May, September, and November. Similar to a prior work that found Wikipedia page visits of a given drug to be a good predictor for its demand in DWMs [95], we provided further evidence that the DWMs ecosystem is embedded in our society and responds in line with social changes [96]. The DWMs ecosystem swiftly reacted to the pandemic by offering goods in high demand, and even offering vaccines already in March, when no tested vaccination existed.

Our research shares some limitations with previous studies, namely that not all active DWMs were surveyed. For instance, we did not analyse 12 of the DWMs explored in the previous report [35]. It must be noted, however, that the number of active DWMs is constantly changing due to closures or new openings [19] and obtaining full coverage is challenging due to the active efforts of DMWs to obstruct research studies and law enforcement investigations, for example through the use of CAPTCHAs. Another limitation is the lack of reliable fully automated annotation method: this forced us to manually annotate listings and thus limited our analysis to listings only directly related to COVID-19. One key problem to be solved in this regard is the presence of false positives when doing a keyword search. In the presence of a more automated pipeline, one could extend this analysis to a more precise quantification of the effect of the pandemic on traditional goods traded on DWMs such as weapons, drugs, or digital goods.

Conclusion

By revealing that DWMs listings of goods related to COVID-19 exist and are correlated with public attention, we highlight the need for a close monitoring of the online shadow economy in the future months, in order to control and anticipate dangerous effects of the COVID-19 “infodemic” [84, 85]. We plan to improve our analysis of DWM activity by increasing the number of monitored DWMs and conducting a more extensive analysis of the impact on the pandemic on overall DWM trade by considering changes in prices of non-COVID-19 specific listings, such as drugs, weapons, or malware. We released a new website [97], where we will provide constant updates on the effect of the pandemic on DWMs.

We anticipate that our work will interest a wide audience and spark new research. Future research work may further explore the behaviour of DWMs over time, potentially extending the spectrum of monitored goods and relating the observed trends to specific social changes. Policy makers and public agencies (especially those focused on protecting consumer rights and health) can use our findings to better assess and shape the effects of legislation on the shadow economy [98]. Practitioners may gain insights on how DWMs posit additional threats to public health. Uninformed citizens exposed to waves of misinformation, such as the ones related to hydroxychloroquine, chloroquine, and azitrhomycin [79, 87–89], may be tempted to shop on DWMs thus exposing themselves to serious health risks. Moreover, the availability of regulated products currently in shortage in the traditional economy undermines anti-price gouging regulations and regulated businesses which sell the same products.

Appendix D: Supplementary material

In this Section we provide additional material that support our main findings. In Table 7 we provide more details on the 30 DWMs considered in our study. In particular we indicate the main specialization of the DWMs, i.e., the main category of products sold. If it is “Mixed”, it means that the DWM is not specialised in any particular category of goods. In the description we instead put information on the DWMs, with more details where available. All this information has been researched and compiled by the authors, with particular help given by Flashpoint Intelligence [72].

In Table 8 we provide a Table reporting the different COVID-19 related medicines which were found in the listings. The medicines were selected as they have been found or claimed to be effective against COVID-19 [32]. The number of listings related to each medicine is also reported, noting that some listings sell more than one medicine (e.g. listings selling both hydroxychloroquine and azitrhomycin). We do the same for guides on scamming in Table 9, reporting the different kinds of guides which were found in the listings.

In Fig. 7 we plot the distribution of listings per vendor in log-log plot, showing a clear power-law shape with exponent −2.0. In the inset of Fig. 7, we show the histogram using linear spacing, through which we understand that most vendors sold very few COVID-19 specific listings, while few vendors going as high as 91 different listings. We noted that 80% of the vendors had indeed less or equal than 5 listings.

In the main text, we performed a longitudinal analysis of the time evolution of all COVID-19 specific listings and all listings mentioning COVID-19, as well as the PPE and medicines categories, as shown in Fig. 4. Now, we provide a similar analysis for COVID-19 guides on scamming, as illustrated in Fig. 8. We observe they first appeared in March, when the first lockdown measures were adopted. The number of listings then started increasing after the Cares act was introduced in USA [80]. Other peaks coincide to the extension of the SBA loan program in July [81] and to the failing of negotiations on the Heroes act [82], after which the number of listings decreased up to April levels. Listings in the guides on scamming category teach people how to take advantage of several kinds of COVID-19 relief funds, or other pandemic related scam opportunities. In many western countries, new relief funds were signed on a monthly basis constant updates made on the relative listings on DWMs.

In order to complement Fig. 5(a) and (b) in the main text and properly show the peaks of Wikipedia page visits and tweets, we create Fig. 9. The new representation of Fig. 5 does not modify the claims made in the main text and how major event related with COVID-19 impacted public attention.

Appendix A: Data pre-processing

In the following, we describe the DWMs dataset in more details, by focusing on how listings were stored and how we formed the COVID-19 categories in Table 1, that is, PPE, medicines, guides on scamming, web domains, medical frauds, tests, fake medical records, ventilators, and COVID-19 mentions.

The listings appearing on the DWMs were crawled and stored according to selected attributes. While a brief explanation of these attributes is already presented in Table 4, here we focus on those attributes which involved some pre-processing before the analysis, that is, “Shipping information,” “Quantity,” and “Price.” The “Shipping information” attribute was initially stored considering what the vendor declared. Then, it was standardised among vendors to correct any misspellings, using the standard python library pycountry. Vendors may declare a specific country, like United States, a continent, like Europe, or the entire world, which we standardise here as worldwide. The “Quantity” attribute was instead retrieved from the title of the listing using Facebook open-source library Duckling [99], then it was manually checked and corrected during an annotation process. The “Price” attribute on DWMs was displayed in the listings in various currencies, such as cryptocurrencies and fiat currencies. In order to standardise and properly compare listing prices, we converted prices to USD at the daily conversion rate. Rates were taken from Cryptocompare [100] for cryptocurrencies, and from the European Central Bank [101] for fiat currencies.

Table 4.

Selected attributes of the listings under consideration along with a brief explanation of their respective purposes

Attribute of a listing	Explanation
“Listing body”	Description of the listing as it appears in the DWM
“Listing title”	Title of the listing as it appears in the DWM
“Marketplace name”	Name of the DWM
“Shipping information”	Where the listing is declared to ship from and to
“Time”	When the listing is observed
“Quantity”	Quantity of the listing sold
“Price”	Price of listing
“Vendor”	Unique identifier of the vendor

The attributes “Listing body” and “Listing title” in Table 4, representing the title and description of the listings, were used to select the COVID-19 categories in Table 1. To this end, we prepared two sets of keywords as shown in Table 5. Every selected COVID-19 listing contained either a word in the “Listing body” that matched one keyword in the first set or a word in the “Listing title” that matched one keyword in the second set. The rationale behind this choice was that the listing title was usually more precise on the product sold, whereas the body might contain promotions of other items the vendor was selling in other listings. At the same time, the vendor might mention COVID-19 in the body for various reasons, which we analysed in the main text. In order to classify listings in either COVID-19 specific listings (that is, PPE, medicines, guides on scamming, web domains, medical frauds, tests, fake medical records, ventilators) or COVID-19 mentions, we ran a regex query in google bigquery. We remark that the chosen method returned words containing a string equal to one of our keywords. For instance, with the keyword chloroquin, we detected also chloroquine and hydroxychloroquine. After this automatic filtering step, we manually checked the selected COVID-19 related listings to further improve the accuracy of our sample. In order to minimize human error, at least two authors of the present manuscript checked each of these listings. A limitation of our approach was that keywords considered were in English. Therefore, even if drug names such as chloroquine were common to many languages and we detected some listings in a non-English language, our sample of COVID-19 related listings was biased toward the English language.

Table 5.

Keywords used to sample COVID-19 specific listings from the DWMs in Table 2

First set of keywords checked against the words included in the attribute “Listing body” in Table 4

corona virus, coronavirus, covid, covid-19, covid19

Second set of keywords checked against the words included in the attribute “Listing title” in Table 4

anakinra, antidote, antiviral, azithromycin, baloxavir, baricitinib, bemcentinib, chloroquin,

corona virus, coronavirus, covid, covid-19, covid19, darunavir, dexamethason, diagnosis,

diagnostic, favipiravir, ganciclovir, glove, gown, lopinavir, marboxil, mask, n95, n99,

oseltamivir, prevention, remdesivir, repurposed, ribavirin, ritonavir, sanitiser,

sanitizer, sarilumab, siltuximab, surgical, thermo scanner, thermo-scanner,

thermometr, thermoscanner, tocilizumab, umifenovir, vaccine, ventilator, ciprofloxacin,

doxyciclin, metronidazol, amoxicillin

While each listing had an associated url to determine its uniqueness, which allowed us to track listing over time, vendors receiving bad reviews sometimes put identical copies of the same listing online. To overcome this issue and correctly count the number of listings, we determined a listing as unique if it had the combination of “Listing body,” “Listing title,” “Marketplace name,” and “Vendor” different than any other listings. For instance, if two listings had the same title and body but were sold in two different DWMs, we considered them as two different listings. Also, we considered at most one observation for each unique listing per day. The total number of unique listings and observations of these listings in each DWM is available in Table 2.

Appendix B: Examples of listings related with COVID-19 in dark web marketplaces

Here, we present detailed examples of the selected listings. We consider both COVID-19 specific listings and COVID-19 mentions.

B.1 COVID-19 specific listings

The most popular category of COVID-19 specific listings was PPE, which included mainly face masks. We detected listings selling small quantities of masks, like “KN95 Face Mask for Corona Virus box of 50” priced at 50 USD, while others proposed wholesale deals, as in “AFFORDABLE 20 BOXS OF SURGICAL FACE MASK (WHOLESALE PRICE)” in which 5000 masks were available at 2000 USD.

The second most popular COVID-19 category was guides on scamming and includes listings explaining how to stole several kinds of COVID-19 related relief funds. Specifically, a subset of these listings were about the Small Business Administration loan in the USA. They provided step-by-step instructions, with constant updates to ensure the scam activities were effective. One listing in particular suggested: “I do not recommend taking more than 10,000 of the approved amount, because after that cashing out becomes a little harder.” The price of this listing was 113 USD.

MagBo was the only DWM selling listings in the web domains category. These listings may cause a potential threat to public health. They may be the actor of several phishing activities or sell scams. Examples of these web domains were “coronavintheworld.com,” “covid-conspiracy.net,” and “coronavirusmasks.in.” Prices of these domains were low and less than 10 USD.

Listings on the medicines category were composed mostly by chloroquine, hydroxychloroquine, and azythromicin. We registered several wholesale deals, as in “9000 tabs hydroxychloroquine 200mg (USA AND CANADA ONLY)” where 9000 tabs were sold for 1194 USD. The smallest quantity we detected was 50 pills “chloroquine 50pills for 250$,” sold at 250 USD. We also noticed that vendors often specified the size of the pill, being it 200 mg, 250 mg, or 50 mg. The azythromicin was usually sold together with hydroxychloroquine as a prescription against COVID-19. One example of it was “hydroxychloroquine sulfate 200mg and azithromycin 250mg,” where an unknown quantity of these drugs was sold for 40 USD.

In the COVID-19 category of medical frauds, the most prominent listings were vaccines. Despite at the moment of writing of the first version of this manuscript (July 2020), vaccines are far from being actually developed, they were sold in DWMs since March. These listings included both low price vaccines like “complete order free shipment COVID19 VACCINE,” sold at just 200 USD, or high price one like “Covid-19 Vaccine. Lets keep it low key for now,” priced at $15\text{,}000$ USD. In addition, among the listings in the medical frauds category, one could find potentially dangerous illicit drug mixes with claimed curative power against COVID-19, like “Protect yourself from the corona virus:” a marijuana based drug mix supposedly helpful in recovery from coronavirus infection. Other medical frauds included a 300 USD “CORONAVIRUS DETECtOR DEVICE, SAVE LIVES NOW” or a 1000 USD “Buy CORONAVIRUS THERMO METER.”

Tests category of COVID-19 specific listings count a few different items. We detected listings in the tests category both at low quantities, such as, “25 pcs COVID-19 (coronavirus) quick test,” sold for 430 USD, or at very large one, like “Corona Virus Test / Covid-19 Test Kits (5000Pcs),” for a price of 7500 USD.

The three listings in the fake medical records categories can be used to fake COVID-19 diagnosis. One of these listings said in its title: “Novelty/Fake Medical Records! Any diagnosis, custom made.” And in its body claimed “The right medical excuse can get you out of anything, and open many doors,” with a following disclaimer “IT IS UP TO YOU TO USE THESE ETHICALLY AND LEGALLY!” The price for this listing was 20 USD only, which could favour its wide adoption.

The two listings in the ventilator category were ICU ventilators. They were advertising fundamental hospital instrument, such as, “ICU Respiratory Ventilators, Emergency Room Vents” sold at 800 USD or “BiPAP oxygen concentrator ventilato Amid Covid-19” for 2000 USD.

B.2 COVID-19 mentions

We describe three examples of listings in the COVID-19 mentions category. The listing with title “Best Organic Virginia Bright Tobacco Premium quality 600g” refers to the lockdown in its body as “unfortunately we have to respect coronavirus lockdowns, in order to ensure as much security as possible, we had to choose one type of shiping that is unfortunately much more expensive while lockdowns last.” Another listing with title “(Out of Stock! Lower Price for Pre-orders Only) Testosterone Enanthate 250mg/ml - 10ml - Buy 4 Get 1,” mentions in the body that they “are currently out of stock of this product due to our oil suppliers not being able to get their raw powders shipped to them because of the Coronavirus” and they “have lowered the price a little to help make up for this delay.” A third listing mention a sale directly in the title “COVID-19 SPECIAL OFFER 1GR CROWN BOLIVIAN COCAINE 90% £65,” and link the discount with the distress caused by the pandemic.

Appendix C: Timeline of the COVID-19 pandemic

In this Section we aim at providing a summary of the main events related to the pandemic, focusing on the ones cited in the main text and listed in Table 6. This is by no means a complete summary of the COVID-19 pandemic timeline.

Table 6.

Significant COVID-19 events. We defined an acronym for each event and reported it in the main text plots. Please note that this list does not intend to be exhaustive or to establish a ranking between events

Date	Event	Acronym
2020-1-23	Wuhan Lockdown [1]	Wuhan
2020-3-9	Italy Lockdown [74]	Italy
2020-3-18	USA’s President Trump first refers to chloroquine [79]	Trump 1
2020-3-27	USA’s President Trump signs the CARES act [80]	Cares
2020-4-3	1M COVID-19 cases worldwide [90]	1M cases
2020-4-5	USA’s President Trump promotes the use of chloroquine and hydroxychloroquine against COVID-19 [87]	Trump 2
2020-4-24	COVID-19 cases in Europe are beggining to slow down [86]	Europe
2020-5-18	USA’s President Trump declares he is taking hydroxychloroquine preventively against COVID-19 [88]	Trump 3
2020-6-9	Governments start to lift lockdown measures around the world [76]	Openings
2020-6-30	USA senate agrees to extend small business rescue [81]	SBA
2020-7-28	Twitter limits Donald Trump Jr’s account for posting COVID-19 misinformation [89]	Trump 4
2020-9-7	Spain is the first country in Europe to record half a million COVID-19 cases [77]	Second wave
2020-9-10	Negotiations for the Heroes act keep failing [82]	Heroes
2020-10-31	PM announces four-week England lockdown [78]	New lockdowns

The first event to gain international attention and make the public aware of the coronavirus was the decision from China to lockdown the city of Wuhan, first epicenter of the pandemic, on January 23, 2020 [1]. The virus then found its way to Europe, where the first country to be heavily hit by the pandemic was Italy. The Italian government decided to lockdown the entire country on March 9, 2020 [74]. The virus rapidly spread in Europe and internationally, with cases appearing more and more in the United States, leading USA’s President Donald Trump to first take a stance on the possibility of using chloroquine to cure individuals infected from COVID on the March 18, 2020 [79]. The epidemic started to heavily hit the United States and cases were surging almost everywhere in the world: 70 days after the lockdown of Wuhan, the worldwide count of infections had already surpassed 1 Million cases on April 3, 2020 [90]. On March 27, President Trump signed the Cares Act with the first economic aids to whose affected by COVID-19 [80]. After that, he explicitly promoted the use of hydroxychloroquine on April 5, 2020, before any official medical trial ended [87]. In April the situation started to become asymmetric. In Europe, thanks to the many policies in place, the COVID-19 became less threatening [86] and lockdowns started to be eased [76]. USA and other countries were instead seeing a rise in cases, and the USA Senate prolonged the small business rescue fund [81].

In May, President Trump declared he was now taking Hydroxychloroquine preventively against COVID-19 [88], while in July, he posted a video (labet banned by Twitter) diffusing misinformation about the medicine [89]. The second wave of contagions hit Spain in September, and few weeks later the entire Europe [77], while The USA saw the failing on the negotiations around a second relief package [82]. Several new lockdown measures have took place in November in Europe [78] and, through that month, the number of COVID-19 related new infections has started to reduce. In the meantime, the USA is continuing to register a high number of new contagions.

Authors’ contributions

ABa, AT and AG conceived of the project. ABa coordinated the project. All authors designed the research. MA and IG provided the data. ABr, MN, MA and IG preprocessed and analysed the data. All authors analysed the results and wrote the manuscript. All authors approved the final version of the manuscript.

Funding

A.Br., M.N., A.T., A.G and A.Ba. were supported by ESRC as part of UK Research and Innovation’s rapid response to COVID-19, through grant ES/V00400X/1. M.A and D.M., acknowledge support from the U.S. National Science Foundation grants 1717062 and 2039693.

Availability of data and materials

The data that support the findings of this study are available from Flashpoint Intelligence but restrictions apply to the availability of these data, which were used under license for the current study, and so are not publicly available.

Competing interests

The authors declare that they have no competing interests.