Online shopping isn’t just a convenient way to buy batteries, diapers, computers and other stuff without going to a brick-and-mortar store.
Many Americans also use the internet to quietly acquire illegal, fake and stolen items. Guns, prescription drugs no doctor has ordered and checks are on this long list, as well as cloned credit cards, counterfeit passports and phony driver’s licenses.
Because buyers and sellers alike realize that the authorities can detect illegal online transactions, criminals and their customers prefer covert online platforms that protect user anonymity, such as Tor, or encrypted messaging applications like Telegram and WhatsApp. Buyers and sellers also use digital wallets and cryptocurrencies to further conceal their identities.
As scholars of high-tech crime, we were eager to solve a riddle. Having these items shipped to the buyers’ homes or offices would make it easy for authorities to catch them. So how do people who buy these illegal items maintain their anonymity when they take possession of items they purchased on the dark web?
They mostly use vacant residential properties, called “mule addresses” or “drop addresses.” Once the illegal goods or phony documents get delivered – presumably without the owners’ knowledge – to the doorstep of the uninhabited home, the buyer or a middleman picks it up. This practice makes it very hard to trace these transactions.
Penchant for sharing
To discover where these items change hands, we took advantage of the inclination of some of the criminal vendors to share images on Telegram of the parcels they send, along with the illicit items.
They use this strategy to build their reputations, earn the trust of buyers and market their services.
Not all users of online underground markets do this, but we still spotted thousands of packages delivered this way over a period of two years.
In one case, we found a photo of a forged or stolen check alongside the mailed envelope used for its delivery on a Telegram channel dedicated to trading stolen and counterfeit checks.
The label on the envelope bears not only the shipping date but also the Wyoming address where it was sent. Armed with this information, anyone can retrieve related details by searching online. We found an apartment complex at that address with several units for rent.
A forged or stolen check alongside the envelope used to mail it to the person who bought it on the dark web.
Screen capture by David Maimon, CC BY-NC-ND
Guns, drugs and rentals
We also found that criminal vendors use mule addresses as their sender address. In one example, we found a video, uploaded in April 2023, of an assault rifle shipped from an Arizona address. At the time, that property was for sale.
The video displays an assault rifle apparently shipped from that address after being purchased online on an underground gun market. At the time, that property was for sale.
…