Mobile Networks and Applications https://doi.org/10.1007/s11036-019-01440-2 A Market in Dream: the Rapid Development of Anonymous Cybercrime Gengqian Zhou1 · Jianwei Zhuge1 · Yunqian Fan2 · Kun Du1 · Shuqiang Lu1 © Springer Science+Business Media, LLC, part of Springer Nature 2020 Abstract In this paper we have conducted a comprehensive measurement and analysis on the Dream market, an anonymous online market that uses cryptocurrency as transaction currency. We first collect data between October 30th 2018 and March 1st 2019. Then we use decision tree-based approach to classify goods. Following we analyze the category of goods sold in the market, the shipping place of vendors. By analyzing more than 1,970,303 items, we find the goods sold in Dream Market are mainly drugs and digital goods. We estimate the total sales of all vendors, and find that an average monthly income is $14 million during the measurement period, which means that the market commission income is more than $560,000 per month. Based on these data, we use transaction cost theory to analyze the transaction attributes of illegal transactions, which shows that anonymous online market can reduce transaction cost of illegal transactions. We finally discuss the results analyzed and the intervention policy, as well as recent DDoS attacks and future trends of illegal transactions in anonymous online market. Keywords Anonymous online market · Illegal transactions · Cybercrime 1 Introduction on it allow buyers and vendors to hide their identity, making it difficult for law enforcement to tracking them. As a result, Anonymous network initially served as an approach for many prohibited goods such as drugs and privacy data, have browsing Internet anonymously, protecting user privacy. become the main business in anonymous online market. With the development of anonymous network, more and Since the rise of Silk Road in 2011,1 market size and more users can access it by related tools such as Tor volume of the anonymous market have been growing. In browser [11] easily. Anonymous online markets that based 2012, the largest anonymous online market items volume was around 24,400 [10]. By 2015, AlphaBay replaced Silk Road and became the largest market. In July 2017, Jianwei Zhuge AlphaBay had more than 369,000 products and 400,000 [email protected] users [1]. Gengqian Zhou Nowadays, three major large anonymous online markets 2 3 [email protected] are Dream Market, Wall Street and Silk Road 3.1 . Among them, the amount of items daily in Dream Market is around Yunqian Fan 170,000, which is much more than Wall Street’s 10,000. In [email protected] many dark market forums, Dream Market’s score is much Kun Du higher than the other two [4]. [email protected] In this paper, we attempt to provide a scientific analysis of Dream Market and anonymous cybercrime by collecting Shuqiang Lu [email protected] and analyzing a set of data for approximately four months (from October 30th, 2018 to March 1st, 2019). We think our research has mainly four contributions. 1 Institute for Network Sciences and Cyberspace, Beijing National Research Center for Information Science and Technology (BNRist), Tsinghua University, Beijing, China 1https://en.wikipedia.org/wiki/Silk Road (marketplace) 2 2 School of Software and Electronics, Peking University, http://wallst4qihu6lvsa.onion/ Beijing, China 3http://silkroad7rn2puhj.onion/ Mobile Netw Appl (1) We have designed a relatively sophisticated collection 2 Overview system to get public data from Dream Market. (2) We use collected data to show the groups of goods and Dream Market (Fig. 1) is an anonymous online market first vendors in Dream Market. appeared in November 2013. There are goods such as drugs, (3) We use buyer’s feedback as a proxy for sales, and theft data and hacking services in this market. Based on we describe the amount of sales in our measurement the characteristics of anonymous itself, both buyers and range. We provide an estimation of daily sales in vendors in Dream Market are anonymous. In this section, Dream Market and use this to estimate the amount of we summarize the main features of Dream Market by commission charged by the market operator. Although visiting steps involved in a typical transaction and other we can’t use the data sets we collect to estimate the market mechanisms: access to Dream Market, shopping, number of buyers, we can see that Dream Market and so on. is a very important market with nearly 10 thousand Similar to other darknet sites, before entering Dream vendors and the average sales is $14 million per month. Market, user needs to access the market page by Tor (4) We use transaction cost theory to explain the reasons browser. User needs to register her own account in Dream for the continued growth of anonymous cybercrime. Market. Dream Market supports automatic generation of We also notice that anonymous cybercrime has been user names, of course, you can set it yourself. Registration developing rapidly. only requires information like username, password, PIN and CAPTCHA. For security reasons, the market supports The rest of the paper is organized as follows. We give two login types: password login and 2FA login. 2FA login an overview in Section 2. We introduce how we collect requires user to set a PGP public key. Only users who have data in Section 3 and illustrate our metrics analysis in the corresponding private key can log in 2FA. Section 4, including volume analysis of illegal goods. In During transaction, Dream Market charges a certain Section 5, we discuss market economic data. In Section 6, amount of commission from vendors and imposes restric- we use transaction cost theory to explain the reasons for tions on vendors. Some categories of goods are listed the continued growth of anonymous cybercrime. We discuss below [3]. our findings in Section 7, including relevant intervention policies and ethical considerations, and discuss related – Assassinations or any other services which are doing cybercrime, and the impact of DDoS attacks on the market. harm to another. The related work is outlined in Section 8 andwegiveour – Weapons of mass destruction: chemical, biological, conclusion in Section 9. explosives, etc. – Fentanyl. Fig. 1 Dream Market front page Mobile Netw Appl – Weapons. as much as possible, we registered different accounts for – Poisons. website login. For each page request, the crawler replaced – Child pornography. the circuit once, and we used the stem5 tool to do this. From – Live action snuff/hurt/murder audio/video/images. October 30th, 2018 to March 1st, 2019, we tried to crawl pages from Dream Market every day and record the time Although the market has restrictions on goods and each page crawled. services such as weapons and violence, sensitive goods such as drugs, fake identity documents (such as fake passports), 3.2 Challenges privacy data and hacking services are still missing from the list of prohibited items. Hiding trace is important during crawling. So, we used Sele- When user selects a favorite item from the product list, nium to simulate browser and visited the web cautiously. she can click on the item link to make a purchase. The However, in our initial attempts, we found that if we vis- market supports cryptocurrencies such as BTC and BCH, ited the pages a bit more frequently, it would trigger the and the wallet address is provided by the market. Before anti-DDoS mechanism, which made crawling impossible. In purchasing, user needs to buy or transfer a certain amount order to solve this problem, we limited our crawl frequency of cryptocurrency to the wallet address. Once the wallet has and periodically performed circuit replacement. sufficient currency, user can select the transaction currency In order to enhance the hidden effect, the crawler’s and set transaction information, then pay for the transaction. threads login use different accounts. We started crawling Dream Market supports escrow, which means that buyer’s thread at random time every day. For example, in the payment will not be sent to the vendor immediately. Instead, adjacent two days, we crawled at 5am and 2pm respectively. it first will be escrowed by the market itself, then transfer to Once login successfully, cookies for Dream Market are vendor after buyer receives the goods and confirms. valid for one week. But if we do not operate the browser After receiving the goods, buyer can give a feedback. for a period of time, the cookie will expire. In many cases, Dream Market recommends submitting negative feedback e.g., when we start crawling every day or because it costs to better solve the vendor’s service problems. At the same too long to visit pages due to network delay, we need to time, Dream Market provides reporting capabilities, so use a new cookie. Since the website login page needs to buyers can report vendor’s situation to Dream Market, enter CAPTCHA, we manually login to get the cookie in including receiving problems, fraud and even reporting to the early stage. This is also practical in many previous the vendor ID which controlled by law enforcement. work [21]. Later, we analyze the patterns of the website’s CAPTCHA and develop a machine learning tool based on 3 Data collection GAN to achieve automatic login. The CAPTCHA detection can reach higher than 90% accuracy rate. Thereby it can solve the problem of manual login and can do re-login when In this section we will introduce our data collection page-loading timeout. methods. We adopt a more secure crawling method, but we Although we have made great efforts in hiding trace, we have also encountered many challenges. We will illustrate still need to dispose unexpected exceptions.