Exploratory Data Analysis for Tor Marketplaces – The Drugs’ Case

The world of anonymous marketplaces represents a novel channel for black markets, which offer a wide variety of illegal merchandize. For most marketplaces on the darknet, the overall incidence of sales is still not comparable with the sales incidence of similar physical markets. Nevertheless, given the fact that it reflects an essential trade channel, offering opportunities to new as well as old forms of illegal merchandize to customers worldwide, trading on darknet marketplaces should be thoroughly studied via means of conventional crawling and data analysis, to determine new trends in the trading of illegal goods, whether physical or digital, new drugs and alternative ways for importing socially dangerous merchandize e.g. drugs, weapons….etc.

A recently published paper presented a method for crawling, and manipulation of data for analyzing trading of illicit drugs on such marketplaces. The paper focused the analysis on AlphaBay, East India Company and Nucleus (Nucleus is gone now) and demonstrated how to perform preliminary drug investigation on basis of exploratory data analysis.

Currently, there are over 20 anonymous marketplaces that are active on the dark web, which is part of the deep web. Practically, anonymous marketplaces are usually implemented in the form of hidden web services on the Tor network. Darknet marketplaces usually operate via a model similar to that of eBay, with three actors; sellers, buyers and marketplace administrators who take a 5-10% percentage off of each trade for providing the online platform, the escrow service and the framework of rules that regulate all activities taking place on the marketplace. As per the data published by the Global Drug Survey, online marketplaces account for a small cut of the overall illicit drug sales, despite the fact that they are growing at an accelerating rate and yearly sales grew from approximately $15-17 million in 2012 to $150-180 million in 2015.

Method used to collect data:

Data was collected using a custom spider to crawl the three marketplaces we referred to. For each marketplace, a custom spider was created using the scrapy framework to use Tor so that the spider can reach the anonymous marketplace.

Results:

The authors of the paper recognized sellers with high volume offers across various marketplaces. They found out that the most sold item on all darknet marketplaces are in the cannabis category (natural cannabis products, not synthetic). Cannabis is followed by ecstasy and stimulants in terms of number of offers on various marketplaces. The ranking was repeated individually for AlphaBay, Nucleus and East India and revealed that for all marketplaces, Cannabis was the most commonly ordered item, followed by ecstasy and stimulants. The below pie chart shows the percentage of sales of each type of drug on all three marketplaces.

The below chart shows the destinations of shipment of orders completed on East India marketplaces. The United Kingdom was the most common destination for shipment, followed by the Netherlands and Germany. This data is more or less reliable due to the fact that the shipping fees vary according to the destination. This data can point us to the country where the sold item is located, yet it points to nothing regarding the seller’s location, which in many instances, living near the shipping source.

The below graph’s bubbles indicate that few countries are the shipping source of the sold items. It shows that cannabis, benzodiazepines, stimulants and opiods are the most common substances ordered on Tor marketplaces by customers from countries all over the world, but prescription drugs, tobacco, steroid and weight loss supplements’ orders are only concentrated in a few countries. Ecstasy is considered an anomaly with a large number of offers concentrated in a limited number of countries, yet most of the offers originate from the Netherlands.

Implications of the results:

Tor marketplaces are growing at a rapid rate. The enormous size of listings on Tor marketplaces offer a myriad of trading opportunities. Due to the fact that the effect of these new market dynamics on the drug market collectively is yet to be determined, studying trends and behavior is a pivotal cornerstone to efficiently deal with this phenomenon. This paper represents an important contribution that can help analyze this phenomenon. Technically speaking, our ambitious objective should be to better understand the modus operandi and to determine the criminal mechanisms that represent the basis of the illicit drug trade phenomenon that is taking place on hidden web services across the Tor network.