David Maimon

Encrypted messaging platforms are increasingly used for illicit drug distribution, yet research has focused primarily on darknet markets, leaving surface-web activity relatively underexamined. The present study analyzes an open-source intelligence (OSINT) sample of 107 publicly accessible Telegram-based drug markets and nearly 750,000 archived posts from markets identified and collected in the study period between April 2022 and April 2023, including visible historical posting activity dating from October 2020 to December 2023. The study combines dynamic activity averaging, qualitative coding of textual and visual content, and supervised ChatGPT-assisted extraction of explicitly stated price and quantity information. The contribution of this study is twofold: methodological and empirical. The study demonstrates how OSINT can be adapted for social-scientific analysis of public-facing activity in an encrypted messaging environment, while documenting the observable organization, commodities, advertising format, and trust practices of sampled Telegram drug markets. Within the sampled markets, annual post counts increased from 9,201 across five active markets in 2020 to 359,209 across 68 active markets in 2022, before declining in 2023. Cannabis listings increased sharply, while hashish declined, indicating shifts in supply advertisements. Financial fraud and weapons-related posts also emerged, suggesting diversification in these primarily drug-focused markets. Vendors used e-commerce-like practices, including menus, branding, delivery claims, shipping proof images, and scam warnings. This article provides a large-scale descriptive account of an understudied Telegram ecosystem and outlines implications for OSINT-informed monitoring, platform governance, and public-health-oriented responses.

The distribution of malicious spam occurs in substantial numbers around the globe and can function as a precursor to serious forms of cybercrime. Yet to date, no known study has employed criminological theory to gain insight into the macro-correlates of malicious spam victimization. To address this gap in the literature, the current study utilizes data gathered from multiple sources to assess whether variables derived from routine activity theory are associated with malicious spam victimization at the country-level. Findings indicate that multiple measures of target suitability increase the amount of malicious spam a country receives. Specifically, corruption, political freedom, gross domestic product, and being an Asian nation are associated with an increase in malicious spam victimization. Capable guardianship, however, does not decrease the amount of malicious spam a country receives, and in some instances, is associated with an increase. Theoretical and policy implications are discussed.

Compared to the offline world, the online environment is more anonymous and therefore less easily controlled. Criminological theories generally show that people are more likely to commit crime when they experience or perceive less formal or informal social control. Consequently, one might assume that people are more likely to commit crime online than offline. As formal social control is lacking, informal social control and peer-offending may be important predictors of online offending. In this paper, we examine to what extent differences in perceived formal and informal online control are related to the likelihood that a person will commit a system-trespassing offense (i.e. malicious hacking). Additionally, we examine peer system-trespassing, and how this may interact with perceptions of formal and informal social control. In the logistic regression analyses we employ eight different measures for perceptions of formal and informal social control, in addition to peer-offending, and control variables. Both direct effects and interaction effects are examined. Our results show that peer-offending is an important predictor of system-trespassing and interaction effects show that perceived formal and informal online social control are related to this type of offending but only for specific groups. Implications will be discussed.

Adopting the criminal event perspective, we explore how online fraudsters make use of urgency cues in their interactions with potential victims throughout the progression of an online nonpayment fraud attempt. Integrating claims from the ‘Interpersonal-Deception Theory’ with situational explanations of crime, we investigate whether fraudsters’ presentations of verbal cues of urgency during the early stages of a criminal event are followed by a consistent presentation of verbal and non-verbal urgency cues. To answer this question, we posted a large number of ‘for-sale’ advertisements over a classified-ad website and interacted with online fraudsters and legitimate users who responded to our ads over email. Our findings highlight the relevance of the criminal event perspective in guiding research on targets and offenders in cyberspace.