Contribution to the harm assessment of darknet markets: topic modelling drug reviews on Dark0de Reborn

Abstract

Amid the global opioid crisis, the volume of drug trade via darknet markets has risen to an all-time high. The steady increase can be explained by the reliable operation of darknet markets, affected by community-building trust factors reducing the risks during the process of the darknet drug trade. This study was designed to explore the risk reduction efforts of the community of a selected darknet market and therefore contribute to the harm assessment of darknet markets. We performed Latent Dirichlet Allocation topic modelling on customer reviews of drug products (n = 25,107) scraped from the darknet market Dark0de Reborn in 2021. We obtained a model resulting in 4 topics (coherence score = 0.57): (1) feedback on satisfaction with the transaction; (2) report on order not received; (3) information on the quality of the product; and (4) feedback on vendor reliability. These topics identified in the customer reviews suggest that the community of the selected darknet market implemented a safer form of drug supply, reducing risks at the payment and delivery stages and the potential harms of drug use. However, the pitfalls of this form of community-initiated safer supply support the need for universally available and professional harm reduction and drug checking services. These findings, and our methodological remarks on applying text mining, can enhance future research to further examine risk and harm reduction efforts across darknet markets.

Introduction

In the 2010s, opioid overdoses have dramatically increased drug-related deaths in North America (Mattson et al., 2021) and are now a global health challenge (Krausz et al., 2021). The increase has been primarily due to the emergence of fentanyl and other synthetic opioids in the illicit drug market (Pardo et al., 2019). These substances are typically distributed already mixed with other drugs (such as heroin), often without the knowledge of the consumer. Mixing can cause an overdose, as the lethal dose of synthetic opioids is significantly lower than that of their non-synthetic counterparts.

In parallel with the opioid overdose crisis, darknet markets selling drugs on the non-indexed part of the internet have emerged and flourished. Although darknet markets accounted for only a tiny slice of the global illicit drug market even in their most prosperous years, figures show that their share had steadily increased in the second half of the 2010s (The United Nations Office on Drugs and Crime, 2020). Data showed that, in the short term, the restrictions caused by the COVID-19 pandemic have even boosted this increase in the number of darknet drug purchases (European Monitoring Centre for Drugs and Drug Addiction & Europol, 2020; Hawdon et al., 2022). However, recent reports suggest that in the long term, the pandemic may have contributed to a decrease in the volume of the darknet drug trade (European Monitoring Centre for Drugs and Drug Addiction., 2022) since delivery difficulties due to the lockdowns have destroyed the reliable link between vendors and customers (Bergeron et al., 2022a). The decreasing trend may have also been significantly influenced by the emergence of encrypted messaging applications and social media, providing channels for the online drug trade (Childs et al., 2020; Moyle et al., 2019; van der Sanden et al., 2022). While these platforms are typically used for retail, darknet markets have increasingly been used for wholesale (The United Nations Office on Drugs and Crime, 2023). Recent trends suggest an increased hybridisation between the surface web, the deep web (i.e. messenger applications), and the darknet regarding their usage for drug trade (Tzanetakis & South, 2023).

The reliable operation of darknet markets over a decade has been based on a number of interrelated factors. Foremost among these is the anonymity of vendors and customers (Bancroft & Reid, 2017), provided by various encryption techniques. These include anonymisation software (e.g. The Onion Router), encryption protocols (e.g. Pretty Good Privacy), operational security measures (e.g. non-suspicious packaging), encrypted messaging services, and cryptocurrencies (e.g. Bitcoin, Monero) (Basheer, 2022). Although Bitcoin, the most widely traded cryptocurrency, is still present in the darknet markets, the deterioration of its untraceability has led to the rise of altcoins such as Monero and Ethereum on these platforms (Bahamazava & Nanda, 2022; European Union Agency for Law Enforcement Cooperation., 2021). In addition to cryptocurrencies, the payment transaction is usually secured by an escrow system in which the funds are withheld from the vendor until the customer confirms receipt of the product (Janze, 2017). Customers can also opt for the so-called finalizing early (FE) option, meaning that the vendor receives the payment when the order is placed, which exposes the customers to fraud (Moeller, 2022). A recent study reported that escrow reduces the number of drug sales, while in the case of high-value transactions by drug traffickers, escrow increases sales (Andrei et al., 2023). The process of purchasing via darknet markets is crucially affected by vendor reliability (Holt et al., 2016; Kamphausen & Werse, 2019; Laferrière & Décary-Hétu, 2023). The reputation based on this reliability was proven to be transferrable among darknet markets (Norbutas et al., 2020). Social ties and repeated exchanges between vendors and customers were named as the key elements of trust building between the actors (Munksgaard, 2023; Norbutas et al., 2020). Sales are concentrated on a small number of sellers, whose close relationships with their customers help them move to a new market when law enforcement intervenes (Décary-Hétu & Giommoni, 2017). While vendor trustworthiness was found to be a better predictor of vendor selection than product diversity or affordability (Duxbury & Haynie, 2018), when purchasing drugs, the quality of products, including their potency and purity, is of paramount importance (Bancroft & Reid, 2016; Caudevilla, 2016; Munksgaard et al., 2022). Finally, the transaction would not be completed without the timely and stealthy delivery of the products (Aldridge & Askew, 2017; Bancroft & Reid, 2016; Espinosa, 2019). The waiting time (in addition to the time it takes for the payment transaction to be completed, the vendor’s response time, and sometimes the time taken for dispute) can significantly affect the purchase decision of an addicted customer (Bancroft, 2023).

The reliability of the whole process is manifested in the built-in reputation systems of darknet markets (Laferrière & Décary-Hétu, 2023; Masson & Bancroft, 2018; Przepiorka et al., 2017). Similarly to surface web markets, most darknet markets allow users to write textual feedback (reviews) about products and vendors (Brinck et al., 2023). In addition to the reviews, in most cases, users can also rate the vendors, which directly affects the prices that vendors can charge: higher ratings mean higher prices (Espinosa, 2019; Janetos & Tilly, 2017). Reputation data can provide vendors with some predictability for their business model (Kelly, 2023), and customers with information on the reliability of specific vendors and products (Brinck et al., 2023). Darknet markets face competitive pressure to inform customers about the trustworthiness of vendors in their reputation systems (Janetos & Tilly, 2017). Therefore, the data of these reputation systems provide the opportunity for researchers to better understand the operation of darknet markets (Brinck et al., 2023; Jardine, 2019; Szigeti et al., 2023).

Trust among vendors, customers, and darknet market operators form a community of interest (Masson & Bancroft, 2018), a social figuration of the cooperating and interdependent actors, which involve undercover law enforcement agencies (Kamphausen & Werse, 2019) and delivery providers as well (Szigeti et al., 2023). These communities have the potential to make the process more secure and reduce the harms of drug use, even if some of the actors are motivated by economic interests. Darknet markets can reduce the physical violence associated with drug trafficking by removing face-to-face meetings from the crime script (Bergeron et al., 2022b; Martin, 2014; Shortis et al., 2020). Furthermore, the community of darknet markets can reduce the harms associated with drug consumption by providing advice on safer use and information on the purity of the products (Aldridge et al., 2018; Caudevilla, 2016; Shortis et al., 2020). Previous user experience-based research also suggested that darknet markets have the potential to provide a drug supply that is both “clean” and “safe” (Goodyear et al., 2020). Finally, although the reputation system and escrow services of darknet markets can reduce the risk of financial victimisation to some extent, customers of this platform are still exposed to scams (Bergeron et al., 2022b).

If it is technically possible for law enforcement agencies to shut down entire darknet markets, it could directly cut off this drug supply, but in such cases, customers typically migrate to another darknet market (Décary-Hétu & Giommoni, 2017; ElBahrawy et al., 2020; Ladegaard, 2019; Tavabi et al., 2019). The research, therefore, questions the long-term success of such law enforcement actions (Horton-Eddison & Cristofaro, 2017), presenting them as the extension of the (failed) war on drugs approach to online drug markets (Martin et al., 2023). Targeted interventions might be more effective and can be implemented at any stage during the crime script of the darknet drug trade (Jardine, 2021). The first stage of the script is informational accumulation, during which users become familiar with the darknet, TOR network, cryptocurrencies, and darknet markets. This is mostly done by surface web searches that are not anonymous and can therefore be leveraged by the authorities. The second stage is account formation when prospective users create cryptocurrency wallets and customer or vendor accounts. An example of intervening at this stage was Operation Bayonet, where Dutch law enforcement agencies took over an entire darknet market and gained direct access to user data. The kind of operation which damages trust among the actors by actual data or financial loss of the users is more effective than simply removing a market from the darknet (Bradley & Stringhini, 2019). However, these types of interventions have been criticised for using an extraterritorial surveillance strategy based on questionable legal tactics to collect the data of darknet market users from various geographical locations (Martin et al., 2023). The third stage of the crime script is the actual market use when vendors advertise themselves and their products while customers select and order what they are looking for (Jardine, 2021). Notifying individuals that they have been observed engaging in darknet market activities could deter them and other users from future use of the platform by showcasing the intelligence-gathering power of law enforcement. An example of this was also Operation Bayonet, where the Dutch agency, after takedown of AlphaBay and Hansa, posted user account details of some accounts they were tracking. The final stage is the delivery and receipt of the products. Even if encrypted, shipping addresses of the recipients are shared during the process, allowing law enforcement to detect and intercept the packages, which, however, is typically only effective in disrupting transnational supply and allows only for interception of an individual package, making a small impact in the war against drugs (Martin et al., 2023).

In sum, the above-mentioned displacement and the previously presented harm assessment of darknet markets together suggest that interventions aimed at darknet markets should take into account the risk reduction efforts of the given darknet markets and their communities (Shortis et al., 2020). This study was designed to explore these risk reduction efforts by directly assessing the large amount of customer reviews scraped from a selected darknet market. Ultimately, we aimed to contribute to the development of a methodology to systematically measure the harm caused by darknet markets.

Methods

Directly exploring the darknet drug trade is challenging due to the difficulty of reaching its anonymous participants, making it difficult to apply traditional methods such as survey questionnaires (Karden & Strizek, 2022). However, scraping textual data from darknet markets provides an opportunity for the direct observation of vendor reputation data, which Jardine (2019) suggested should be used as an element of darknet threat metrics. Unstructured textual data scraped from darknet markets can be analysed by various text analytics methods based on natural language processing algorithms. Since no previous research has, to our knowledge, examined customer reviews on darknet markets by any natural language processing method, we aimed to assess these customer reviews using an exploratory approach, namely Latent Dirichlet Allocation (LDA) topic modelling. LDA topic modelling represents the documents of a corpus (in our case, the reviews) as a set of a fixed number of topics, identifying the topics based on the distribution of words in the corpus (Blei et al., 2003).

The data analysed in this study was scraped from the Dark0de Reborn darknet market between June 10 and June 27, 2021. The darknet market was scraped in its entirety, and all products available at the time of data capture were scraped. The darknet was scraped by a custom-written crawler (The Dark Crawler), which allowed the entire platform, product per product, to be scraped. All content on each page was captured, including product name, description, price, and vendor instructions. Vendors placed the products into categories, which were clearly displayed on the page of each product and were captured as part of the data capture, and then used later to select the products for analysis.

The Dark0de Reborn darknet market, whose predecessor was a hacker forum that operated until 2015, opened in May 2020 and closed in February 2022. The closure was presumably the result of an exit scam, i.e. the intentional shutting down of the market by its operators to acquire the funds in deposit. While it existed, this darknet market was a dominant player among illegal online drug markets based on daily minimum sales (The United Nations Office on Drugs and Crime, 2023). Thus, although Dark0de Reborn was only a slice of the darknet drug markets, the data scraped from it provided an opportunity to directly examine community factors behind the operation of darknet drug markets on one of its flagship platforms.

Since this research focused on the darknet drug trade, the collected data was filtered to the drug category based on the product categories provided by the users, resulting in 34,445 valid (not blank) reviews. Non-English reviews were then filtered out of the database using the Langdetect package in Python (Danilak, 2014), resulting in 26,728 reviews. During the cleaning process, we removed duplicates, since users often posted the same review for different products and orders. We filtered out reviews with the same content that were longer than 30 characters, were written about the same product, or were written by the same user. Finally, we manually went through the first one thousand longest reviews that potentially influenced the analysis the most due to their high token count and deleted the flawed reviews, such as reviews that contained only a word or phrase repeatedly, or non-English items that remained in the sample despite the language detection algorithm. Duplicate removing and manual filtering resulted in a total of 1,621 reviews being deleted and the finalized analysis sample consisted of 25,107 user reviews. The product subcategories in the sample are presented in Table 1.

Table 1 Product reviews by product subcategory (the “Other” category included custom orders, drug precursors, and unknown substances)

We implemented the pre-processing of the data in Python packages such as NLTK (Bird et al., 2009) and spaCy (Honnibal & Montani, 2017). In addition to the removal of non-textual elements and stopwords, pre-processing included the application of lemmatization as well as bi- and tri-gram algorithms. The topic modelling procedure was implemented with Gensim’s (Rehurek & Sojka, 2011) default LDA parameters, and the analysis included nouns, verbs, adjectives, adverbs, and proper nouns.

Results

For topic modelling, the number of topics must be specified in advance, where this number was chosen based on the C_v coherence value (Röder et al., 2015). After running the model with 2 to 100 topics assumed, the model showed the highest C_v coherence score (0.57) in the case of 4 topics. A list of the coherence scores for the different number of topics set for each topic model is presented in Fig. 1. The topics obtained in the case of 4 topics are summarised in Table 2. Although the tokens of the corpus were not evenly distributed among the topics obtained in the model with the highest C_v value, the subjects of the topics were identifiable. Thus, taking into account both this qualitative assessment and the coherence score, we analysed the model with 4 topics.

Fig. 1

The C_v coherence score by the number of topics from 2 to 100 set for each topic model

Table 2 Topics obtained by Latent Dirichlet Allocation topic modelling with the distribution of the tokens among the topics, the titles by the authors, and the top 10 most relevant terms of each topic

Topic 1: General satisfaction

Topic one (T1) contained the largest share of tokens (51.6%) and reflected general satisfaction with purchasing. Based on both the number of tokens and the content of the texts, this topic represented typical reviews in which buyers briefly described what they were satisfied within the process:

Perfect transaction. Excellent service, product, stealth and very fast shipping. Will continue to come back. Thanks so much Very reliable and honest seller (Quote of user review #1 representing T1).

Customers also used the review to directly express their gratitude to the vendors and recommend them to others:

Super high quality product as usual, good stealth and fast delivery!!! Vendor more than professional, I recommend!!! Thanks a lot and see you soon ;-) (Quote of user review #2 representing T1).

In addition, praising the quality of the product and emphasising the speed and stealth of delivery were also identifiable elements of the reviews that represented this topic:

Bought a few times from this vendor. Always quick delivery but this time stealth was VERY good. Good quality tabs too, using these for micro-dosing. Thanks for the 5-star service! (Quote of user review #3 representing T1)

Topics 2: Order not received

The topic (T2) with the second largest share of tokens (20.3%) was reports about orders not being received. The reason why these reports contained such a large amount of tokens was that they were typically longer, with users describing the process of their order in detail and explaining their interactions with the vendor:

Ordered on 7th April, vendor accepted/sent order on 8th. Order has NOT arrived. I messaged vendor 4 days ago saying it had not arrived, and sent a follow-up message yesterday. The vendor has not responded to my messages. I checked their profile and can see that they have logged on every day for the past 4 days, so it seems like they are deliberately ignoring my messages. Hopefully, this gets their attention! Update: I have still received no response. (Quote of user review #4 representing T2)

The unresponsiveness of the given vendors was often mentioned, pointing out that customers tried to solve the issues directly with the vendors:

Order sent on 07/05/2021 as of today nothing received contacted methbusters on 3 occasions asking for refund and was told to wait after nearly a month I doubt anything will turn up. So only option is to leave a negative review very unsatisfactory dealer. (Quote of user review #5 representing T2)

At the same time, customers often showed their patience and understanding, and in some cases they expressed willingness to update their review if the vendor does send the product:

Has been over 2 weeks since marked sent and hasn’t arrived yet. I didn’t order a lot so I know it’s a longer wait time but I’ve messaged the vendor twice asking for tracking and any info on the package and got no response. I know he’s a trusted vendor so I’m gonna give it another week but as of right now I’m disappointed. Will change review if package ever arrives. (Quote of user review #6 representing T2)

Topic 3: Product quality

Topic three (T3) was about the quality of the products. In the reviews representing this topic, users typically shared their own experiences of consuming the drug, including describing the drug’s form, smell, taste, cleanliness, and effect:

For the price, you get what you pay for. My pack came with a lot of trimmings, stems, and it was really brown and dry. It smokes decent, but there’s not much of a nose or visual to it. A couple of joints will get you stoned though (Quote of user review #7 representing T3).

Reviewers also shared information about the originality of the drugs, i.e. whether the product delivered matched the product advertised. Some reviewers based their assessments on the look of the products if they had not tried them out yet, but sometimes even included the results of drug tests that they had carried out:

Tested with eztest mdma test kit. Was maximum only medium mdma content. We both got massive headaches. Nearly no positive effect, even after a lot of mg on that evening. (Quote of user review #8 representing T3)

Topic 4: Vendor reliability

Topic four (T4) was about the reliability of the vendor, based on the trust that comes from a long-term reliable relationship between the given customer and vendor. These reviews were typically short and contained only a few phrases, which is why this topic contained the smallest proportion of tokens. The reviews representing this topic were aimed directly at the vendor and often referred to the vendor’s previous presence in other darknet markets:

Reliable long-term DN vendor from many previous sites. Did business with him then and will continue to do so here moving forward. (Quote of user review #9 representing T4)

The authors also often referred to themselves as repeat customers by using phrases like “always” and “usual”, and they stated that they are going to purchase again, demonstrating the already established relationship with the given vendor:

If you want the real deal and to be treated right these guys have always been my go to take care of business guys!!! I guarantee it!! (Quote of user review #10 representing T4)

Discussion

This research study was designed to explore the operation of darknet markets by implementing topic modelling on customer reviews collected from a selected darknet market. Findings show that the community of the darknet market under study made efforts to deliver a safer form of drug supply. Based on the customer reviews, the platform appears to be able to reduce risks during the payment transaction and the delivery stage, as well as the potential harms of drug use.

The reliable relationship between vendors and customers was mirrored in customer feedback on vendor reliability which often manifested in users declaring themselves as repeat customers (T4). These results support the hypothesis that the reliable operation of darknet markets relies on the trust-based relationship between vendors and customers (Holt et al., 2016; Kamphausen & Werse, 2019; Laferrière & Décary-Hétu, 2023), which is built on the success of repeated transactions (Munksgaard, 2023; Norbutas et al., 2020). The reported issues about vendors not sending the product (T2) confirm that the conflicts that challenge the vendor-customer relationship are manifested in the financial victimisation of customers (Bergeron et al., 2022b). Furthermore, emphasising the time and stealth of delivery (T1) is also consistent with previous studies highlighting the role of delivery in maintaining trust between the actors (Aldridge & Askew, 2017; Andrei & Veltri, 2024; Espinosa, 2019; Szigeti et al., 2023). These results suggest that risk awareness campaigns should focus on the risks of payment transactions and product delivery (Bradley & Stringhini, 2019; Jardine, 2021). Informing (potential) darknet market customers about the risks arising during product delivery and exposure to scams could contribute to effective prevention. Evidence suggests that warning darknet market users about a potential scam can reduce vendor and customer activity in the given market (Howell et al., 2022). While users may migrate to another market in response, in some cases (for example, a market selling mixed substances), this displacement may be beneficial from a public health perspective. Detecting fentanyl traffickers, and uncovering and dismantling hidden fentanyl networks should be a priority in the strategic planning of darknet market interventions (Maras et al., 2023).

The exploration of reputational data also discovered that in addition to praising the products in general (T1), customers use the reviews to share information on the products’ quality and originality (T3). These results support that quality assurance in darknet markets is not only about access to potent drugs but also about safer substance use and consuming pure drugs (Bancroft, 2017; Munksgaard et al., 2022). Darknet markets, therefore, seem to provide a community-initiated response to the need for safer supply programmes, which recent studies widely emphasised (Bonn et al., 2020; Fleming et al., 2020; Ivsins et al., 2020; Pauly et al., 2022). Policing drug markets should focus on the characteristics causing the most problems to the communities, following the model of harm reduction policing (Bacon & Spicer, 2023). Hence, policing should take into account the potential of darknet markets in mitigating the harms associated with drug trade and consumption (Shortis et al., 2020). However, the implementation of safer supply by the communities of darknet markets raises concerns beyond its illegality. First, the fact that purchasing on the darknet is only available for users with appropriate digital literacy, who thus typically belong to a higher social class (Tzanetakis, 2018), results in the exclusion of the most vulnerable groups of drug users. Second, the shift of online drug trafficking from darknet markets to encrypted instant messaging applications and social media removes the quality assurance provided by reputation systems (Demant et al., 2019), which can potentially increase the risk of overdoses caused by purchasing unknown substances. Likewise, the lack of assurances on the reliability of vendors and the transaction may also increase the risk of financial losses due to scams in this new form of online drug trafficking. Finally, while there is already some evidence of the high quality of the drugs sold on darknet markets (Caudevilla et al., 2016), up-to-date research is needed in this regard and on the quality of harm reduction measures provided by the actors as well. Although peer involvement within harm reduction programmes can have positive impacts on health outcomes (Chang et al., 2021), relying on the darknet market’s community to ensure quality assurance and harm reduction is not risk-free (Aldridge et al., 2018). For instance, there is no agreement among the users of darknet markets about the meaning of terms such as purity, predictability, or potency (Bancroft, 2020). The above-mentioned potential pitfalls of community-based harm reduction support the need for developing web outreach on darknet platforms implemented by professional harm reduction organisations (Davitadze et al., 2020). In addition, although darknet markets appear to be able to provide some form of safer supply, their ability to do so is limited, therefore we argue that universal access to drug checking for the general public is also needed to tackle the overdose crisis (Wallace et al., 2022).

Limitations

The exploratory analysis of textual data scraped from the darknet market allowed us to examine the characteristics of the online illicit drug trade directly. However, our approach had some limitations regarding data quality, analysis method, and generalisability of the results. First, despite the darknet market’s complex user identification process, bots may registered on the site and create fake reviews. Vendors may also use false reviews to build their reputation or to damage the reputation of others, as they are reportedly prone to do (Kamphausen & Werse, 2019). In the data cleaning process, we only filtered out longer reviews with repetitive negative words that would significantly influence the model, so shorter, potentially fake reviews might have been included in the sample. Furthermore, by filtering the sample for English language reviews, we may have removed reviews that could contribute to different results. In addition, we applied Latent Dirichlet Allocation topic modelling, which cannot account for correlations between the topics. The results suggest a correlation between the topics analysed, in which case the Correlated Topic Model (CTM) is recommended (Blei & Lafferty, 2007). Therefore, the use of CTM should be considered in future research, but we argue that the implemented LDA process significantly contributed to the understanding of the phenomenon under study. Finally, since this study examined data from only one selected darknet market, our sampling method limits the generalisability of the results. Each darknet market contributes to safer supply to different degrees; for example, a more bounded psychedelic drug user community may reduce the harms associated with substance use to a greater extent (Bancroft et al., 2020).

Conclusion

By implementing text analytics on data directly scraped from the darknet, this study not only contributed empirical results to our understanding of the operation of darknet markets but also provided methodological remarks for their harm assessment. The results of this text-mining study can be used as a basis for future research: either for cross-platform comparisons or for further topic-targeted research on the identified topics. In addition, the risk reduction efforts explored by topic modelling suggest that the darknet market under study (among others that we have not examined) provided a platform for safer drug supply during the opioid crisis. Regardless of its quality, the realisation of community-initiated safer supply in this online space provides a glimpse into the digital transformation of our society. However, we argue that this form of safer supply is problematic for a number of reasons, and calls for policy attention regarding the need for improved access to harm reduction and drug checking services.