The NPS Phenomenon and the Deep Web : Internet Snapshots of the Darknet and Potentials of Data Mining

Background: The illegal electronic trade of NPS substances on the deep web and the darknet have never been thoroughly mapped. This study will propose and illustrate a blueprint for mapping of the darknet e-marketplace, including activities originating from the Middle East. Materials and Methods: Multiple Internet snapshots were taken for the darkest e-marketplace, e-markets, Grams search engine, and e-vendors. In relation to the most popular and high-risk NPS substances, the most dominant e-market will be identified. Special correlation will be carried out with the; population count of shipping countries of NPS, the incidence of rape and sexual assaults, and religious affiliation. Results: The most popular high-risk NPS were identified; cannabis and cannabimimetic, MDMA, crack, Meth, and LSD. These were geo-mapped primarily into; Netherlands, US, UK, Germany, Australia, Canada, France, and Spain. AlphaBay e-market was found to be a proper representative for the darknet e-marketplace; the main advertised NPS were categorised into cannabis and cannabinoids (1), stimulants (2), empathogens (3), psychedelics (4), benzodiazepines (5), opioids (6), and prescription-related substances (7). The contributing Middle Eastern and Arabic countries included; UAE, Oman, Morocco, Egypt, and Cyprus. Conclusion: The e-commerce activities on the darknet have been ever evolving. Future attempts to study this e-marketplace should be innovative and rely on statistical inference. A blueprint is required for geo-mapping of the shipping countries, including those from the region of the Middle East. Principles of social sciences, including the analysis of the individual basis of power, should be considered.

. The characteristics of e-vendors from the Middle East were studied marginally in the literature (Van Hout et al., 2013;Van Hout et al., 2014); the analyses of the individual basis of power (authority) for e-vendors, based on social science principles, were never attempted before (French et al., 1959;Wrong, 2017).Power scoring of e-vendors should also be explained within the geographical context (geo-mapping) of shipping countries of e-vendors dealing with NPS.This study will conduct an observational analysis; it is based on a cross-sectional analysis of the darknet, and a retrospective analysis of Google Trends database.
Internet snapshots are known to be obsolete beyond the point of time at which they were captured.However, real-time snapshots are attainable via integration with ICT innovations of relevance to knowledge discovery in databases (KDD) (Adhikari et al., 2017;Hohman et al., 2009).Mapping and analysing the deep web is already an exhaustive and a depleting task for all resources, not to mention that mapping a tiny contribution of a particular region (as in the Middle East) will be even harder much like searching for a needle in a haystack.These limitations can be overwhelming to NPS researchers, but they can also be overcome effectively by the integration of data mining technologies within the discipline of NPS research.

Materials and Methods
This study will implement a hybrid observational analysis of Google Trends database (retrospective analysis) and the darknet (cross-sectional analysis).Multiple internet snapshots were taken on the 13 th and the 14 th of February 2017.Most e-markets on the darknet adopt an NPS classification system made of eight categories (Dargan and Wood, 2013).The same categorization scheme has been used to map the darknet via using the Grams search engine (Grams, 2017).Each category of NPS was mapped for; the total number of advertised hits (items) (1), shipping country and geographic location (2), and the number of hits per geographic area (3).Similarly, hazardous psychoactive substances were mapped on darknet using a set of specified keywords via Grams search engine; the assigned parameters included; total number of hits ( 1), e-markets promoting the NPS (2), number of hits per e-market (3), Shipping country and location (4), and the total number of hits per geographic region (5).
High-risk substances were also mapped via Grams search engine for the shipping country, and the number of hits per country.Additionally, Google Trends database was utilised to retrieve data in retrospect in relation to each of these substances to infer the corresponding global attentiveness of surface web users.Geo-mapping was also analysed using Google Trends.The keywords used for Google Trends were; MDMA, Cannabis, Methamphetamine, Cocaine, and Lysergic acid diethylamide.
An accurate analysis was conducted in relation to AlphaBay e-market, the aim was to test the hypothesis if this particular e-market is a proper representative for the darknet e-marketplace.The hypothesis has been tested via analysing the major categories of NPS on both AlphaBay and Grams search engine; the number of hits on both were investigated to reach an inference via regression models.The most prevalent and most toxic (high-risk) NPS substance were also examined in relation to the Middle East and the Arabic world.It was based on a snapshot for the darknet via Grams engine; mapping included the total number of hits (1), geographic location (2), and the number of hits per location (3).Special statistical correlations were later carried out.
The characteristics of e-vendors (existing on the darknet) were also mapped and thoroughly analysed.Mapping included e-vendor's related parameters; e-markets (1), geographic location (2), the number of hit pers location (3), type of advertised substance (4), and the e-vendor's rating on Grams engine (5).The e-vendors found on AlphaBay e-market were further analysed for power scoring; the power scoring relied on five parameters; vendor level, trust level, e-customers' positive feedbacks percentage, e-vendor score, and e-vendor antiquity in the AlphaBay.The strongest e-vendors were pointed out via the power scoring.Furthermore, the power score for e-vendors was later correlated with the determinant parameters of the score itself; the purpose was to infer the most significant determinant parameter of power (authority) on the darknet.The power scores were also correlated with the total number items sold by the e-vendors on the darknet; this correlation is another way to infer how AlphaBay is dominating the e-marketplace.Special correlations, using inferential statistics, were implemented, these included; GHB substance geo-mapping versus incidents of sexual assault in GHB-shipping countries (1), high-risk NPS versus religious affiliation in the shipping countries (2), and the number of hits originating from the Middle Eastern and Arabic countries versus of those countries from the European Union (3).The aim of these analyses is to deduct specific conclusions in relation to the diffusion of certain substances in the world.This analytic approach is simple yet powerful; it can provide an insight and also serve as a basis for an early warning system to anticipate particular events, for example; sexual assault and rape, shift in the religious affiliation for a specific geographic location, and the patterns of trending NPS substances in correlation with the population count in different countries.The implemented statistical tests included; regression models, Student's t-test, analysis of variance and covariance (ANOVA), and nonparametric tests.A confidence interval of 95% (95% CI) and an alpha value of 0.05 was set as the cutoff margin for considering the statistical significance.
Geo-mapping showed that the leading shipping countries (regions) for benzodiazepines were; US, Phillippines, India, Germany, Denmark, UK, Canada, Netherlands, European Union, and China; there were no shipping countries from the Middle East or the Arab world.The shipping countries for cannabis and cannabinoids included; US, UK, Germany, Netherlands, Canada, Spain, Finland, Belgium, Australia, and France; Shipping countries from Arabic world included only Morocco and Oman; both summed to 0.04% of the total e-trade.For dissociative substances; Netherlands, UK, Germany, US, Finland, Canada, China, Norway, Spain, and Australia; there was no contribution from the Middle East or the Arab world.For empathogens; Netherlands, Germany, UK, Finland, US, Australia, Belgium, Spain, Norway, and Canada; Oman was the only contributing country from the Arabic world accounting for 0.04% of the total e-trade of dissociatives.For opioids; Germany, US, India, Netherlands, Australia, Spain, France, UK, Italy, and Canada; there was no contribution from the Middle East and the Arab world.For prescription-related NPS; US, Germany, Netherlands, Belgium, India, UK, Australia, Denmark, and Japan; there was no contribution from the Middle East and the Arab world.For stimulants; Netherlands, Germany, US, UK, Finland, Australia, Spain, China, Norway, and Belgium; Oman was the only contributing country from the Arab world accounting for 0.05% of the total e-trade of stimulants.For psychedelics; Netherlands, UK, Germany, US, Canada, Finland, Australia, Ireland, and France; there was no contribution from the Middle East or Arabic countries.
The analyses of the high-risk and trending NPS on darknet showed that the number of hits was as follows; LSA (3378), 2-FA (134), DMA / DOX (108), MXE (366), Mescaline (801), MDA (972), Methylone and BK (442), crack (18904), GHB (3850), NBOMe (2560), 2C-B (1383), DMT (1499), Ketamine (4331), Adderall and Vyvanse (2179), Fentanyl (3202), Heroin (5843), Meth (12867), LSD (10709), Cannabis and Hashish (19768), MDMA (28446).The most popular substance per geographic location was MDMA (7949, Netherlands).Other most popular substances were; cannabis and cannabinoids (primarily sold in the US), Crack (Netherlands), Meth (Netherlands), and LSD (Netherlands).The contribution of the US, UK, Western Europe, and Canada is undeniable for the e-trade phenomenon on the darknet.MDMA was in the lead, while cannabis and cannabinoid represented the leading category of NPS on the darknet.Holistic geographic analyses (Geo-mapping) of the shipping countries of these substances (Figure 1) revealed that the top shipping countries were; the Netherlands, US, UK, Australia, Canada, France, Germany, and Spain.In relation to these top contributing countries, it was inferred; crack was more advertised for e-trade than Meth (p-value=0.005),LSD was more advertised than crack (0.002), MDMA was more advertised than crack (0.041), while Meth and LSD were promoted significantly less than MDMA (0.013, 0.009 respectively).Furthermore, linear regression confirmed a positive linear correlation between; crack versus cannabis and cannabinoids (R 2 score=0.410),MDMA versus crack (R 2 score=0.151),and MDMA versus cannabis and cannabinoids (R 2 =0.151).In relation to these five popular substances, Google Trends analyses for the period from the start of 2012 to the end of 2016 (Figure 2) showed that surface web users of highest attentiveness (interest) were from (descending order); US, Chile, Canada, Australia, Costa Rica, Uruguay, Puerto Rico, New Zealand, Argentina, and the UK.Apparently, several countries are from Latin and Central America; these were not compatible with the data retrieved from the darknet snapshot; this difference may be attributed to the traditional trade rather than e-trade of NPS in South and Central America (Atkinson et al., 2017;Duddley, 2010;Scott and Marshall, 1998;and Wolf, 2016).Additionally, high attentiveness (statistical outliers) were found in; Chile, US, Australia, New Zealand, and the Czech Republic; these outliers were in relation to; methamphetamine, MDMA, and cannabis; no outliers were found in relation to cocaine (Figure 2,Boxplot).Inferential statistics, using the paired Student's t-test, was implemented to conclude inferences on the most common NPS for surface web users (Figure 3).There was a significant difference in web popularity between all five substances with an exception for; MDMA vs Meth (0.164) and MDMA vs LSD (0.246).The AlphaBay e-market is a dominant one on the darknet.However, it is still to be inferred if the AlphaBay is a proper representative for the darknet e-marketplace.This hypothetical assumption has been tested by mapping the number of items advertised under each category of NPS on both AlphaBay and Grams search engine (Figure 6), these were; benzodiazepines (1023, 14860 items), cannabis, hashish, and cannabinoids (19768,65275), dissociative substances (923, 4319), empathogens (3821, 30207), opioids related substances (943, 16889), prescription-related NPS (1728, 8736), stimulants (5623, 14007), and psychedelics (3127, 33098).The AlphaBay-to-Grams ratio of the number of hits was ranging from 3.3% to 17.9% while averaging 8.3%.The average of the number of hits (per each category of NPS) on AlphaBay was 4620, while the average on Grams was 23424 hits; the number of items on AlphaBay was significantly less than Grams engine (4620 vs 23424, p-value=0.004).However, regression has shown a strong positive linear correlation between AlphaBay and Grams engine (R 2 score=0.791).It is to be concluded that AlphaBay is a proper representative of the e-trade phenomenon on the e-marketplace of the darknet.Countries from the Middle East and the Arabic world contributed the least to the global e-trade on the deep web.
Here, the contribution will be assessed for NPS categories via using specific keywords for each category on Grams search engine; the top contributing countries were; Afghanistan (64%), Oman (29%), and Morocco (7%).Another way of mapping of darknet was done via using keywords specific to high-risk and popular NPS.The mapped substances were; LSA, 2-FA, DMA, MXE, Mescaline, MDA, Methylone, Crack, GHB, NBOMe, 2C-B, DMT, Ketamine, Adderall, Fentanyl, Heroin, Meth, LSD, Cannabis and Cannabinoids, and MDMA.The contributing countries (Figure 7) included; Afghanistan (77%), UAE (12%), Oman (4%), Morocco (2%), Egypt (3%), and Cyprus (2%).Some of these substances were not in circulation on darknet at the time the snapshot was taken; these substances included LSA, 2-FA, MXE, 2C-B, DMT, Ketamine, and Adderall; it seems that these substances are exclusive to other regions of the world including; Western Europe, US, UK, Canada, and Australasia.On the other hand, trending NPS (Figure 8) included; Heroin, Meth, Crack, Cannabis and Hashish, MDMA, GHB, NBOMe, LSD, DMA, Mescaline, MDA, Methylone, and Fentanyl.Afghanistan appears to be in the lead, possibly due to its high population count.Accordingly, an assumption (hypothesis) that the number of items in each country is proportional directly with its population count; this was tested via linear regression, and it was proven to be true (R 2 score=0.137).Other factors may also be contributing to this phenomenon including the political instability as in Afghanistan.Visual and box plot presentation (Figure 10) of e-vendors revealed the most powerful e-vendors (statistical outliers), these were; ThinkingForward, MrNatural, eztest.The e-vendors contributed to the e-trade as follows; ThinkingForward (23%), MrNatural (23%), eztest (13%), TheCocaHero (8%), DrRelax (7%), dutchdream (6%), MagicCarpetUk (6%), stiffstyle (6%), chris03 (5%), fake (2%), mikehamer (2%), alterEgo (2%), hcb965 (1%), TripleDutchDelivery (1%), AlCaponeA1 (1%), Dogkingdom (<1%), koplak12 (<1%), zeroz (<1%), and dawoud522 (<1%).A Combo plot (Figure 11) of the power score and the total number of items for each e-vendor, clearly shows there is a positive linear correlation.Accordingly, linear regression was done, and it was inferred that a positive linear correlation was found between; total number of hits per an e-vendor versus his (her) power score (R 2 score=0.216),e-vendor's antiquity versus power score (0.610), and total number of hits per an e-vendor versus e-vendor's antiquity (0.028).Hence, the strongest correlation was found between e-vendor antiquity and power scoring.The Middle Eastern and Arabic countries involved in the e-trade on darknet included; Israel, Turkey, Cyprus, UAE, Afghanistan, Egypt, Oman, and Morocco.Individual correlations were also carried out, the Middle East and Arabic countries contribution to the e-trade on darknet was far less than that of the European Union.It has also been known that GHB substance is used to sedate victims during sexual assault incidents and rape; a linear regression (Table 1) was implemented and it was found that a positive linear relationship (R 2 score= 0.0389) exists between the number of GHB hits on Grams engine and the incidence of sexual assaults in these locations (Elsohly & Salamone, 1999;Mehling & Johansen, 2016;Schwartz et al., 2000;Varela et al., 2004).Finally, a correlation was done in relation to the total number of hits (Grams) for nine countries (regions) known of high NPS e-prevalence; Australia, Canada, European Union, France, Germany, Netherlands, Spain, United Kingdom, and the United States.These were chosen as they represented the top contributors for e-trade phenomenon on darknet for specific high-risk and trending NPS including; LSA, 2-FA, DMA/DOX, MXE, Mescaline, MDA, Methylone and BK, Crack, GHB, NBOMe, 2C-B, DMT, Ketamine, Adderall, Fentanyl, Heroin, Meth, LSD, Cannabis and Hashish, and MDMA.The correlation was done between the total number of hits and the religious affiliations existing in these countries/regions (Figure 12).It was found that one religious affiliation, Christianity, was negatively correlated with the number of hits on Grams engine (R 2 score of 0.426).On the other hand, Islam and Judaism had almost no correlation with the number of hits (0.0002, 0.0005 respectively).However, atheism was found to be positively correlated with the number of hits (0.399).Therefore, it can be assumed that countries with high population of atheist are expected to have more advanced levels of NPS e-trade on the darknet; it seems that Christianity was protective against this phenomenon in the selected countries.

Conclusion
The anonymous darknet has been thoroughly explored; the contribution of countries from the regions of the Middle East and the Arabic world were also mapped.Despite that several implemented techniques to analyse this contribution and to create a geo-mapping, the input of the Middle East was negligible and even statistically insignificant when compared to other regions of the world, for example, the European Union.Accordingly, it can be surmised that the global e-trade is highly dependent on the developed countries especially in western Europe, UK, US, Canada, and Australasia.Power scoring of e-vendors whom activities were carried out in the Middle East and Arabic countries gave an insight that they were either not Middle East nationals or at least hold dual nationality from the Middle East and other nations.The reason behind this assumption is the presence of multiple shipping countries for each e-vendor, some countries are Middle Eastern or Arabic, while the majority of the rest were from the developed world.Moreover, their usernames (nicknames) of those e-vendors gave an impression that they were foreign rather than native to the Middle East.
Geo-mapping of Google Trends yielded additional data from countries in south and central America including; Chile, Costa Rica, Uruguay, Puerto Rico, and Argentina.However, the same countries did not contribute significantly on the darknet e-marketplace; it can only be assumed that the diffusion of NPS in these countries is not dependent on the e-trade from darknet; other modalities may be involved including the traditional ways of the drugs trade and trafficking.Special statistical correlations were proven to be indispensable; an interrelationship was inferred between diffusion of NPS on darknet and specific social and demographic parameters including; the religious affiliations, atheism, population count, in addition to the incidence of rape and sexual assaults.
The deep web is virtually massive, most of which is nondescript.The classic internet snapshot method used to observe and analyse a minimal contribution, like that of the Middle East, is highly time-consuming and efforts-depleting.Furthermore, any snapshot will get obsolete as time passes by.Hence, an innovative mixed-breed of the snapshot method and data mining technique can solve the problem; data mining should include the use of automated software(s) for real-time analyses of e-markets.This hybrid methodology, centred on data mining, can potentially provide accurate real-time reports based on cross-sectional and prospective studies of the e-trade on the darknet.Additionally, combining this hybrid technique with Google trends' analyses will further augment the accuracy of geo-mapping of NPS e-prevalence to unprecedented levels.

Figure 1 .
Figure 1.The Main Shipping Countries of the Most Popular NPS on the Darknet

Figure 2 .Figure 3 .
Figure 2. Geo-mapping of Attentiveness towards the Most Popular Psychoactive Substances on Darknet

Figure 4 .Figure 5 .
Figure 4. Geo-mapping via Google Trends: Contribution of the Middle East and the Arab World

Figure 6 .
Figure 6.Grams Engine versus AlphaBay e-market: The Advertised Categories of NPS

Figure 7 .Figure 8 .
Figure 7. Geo-mapping via the Darknet: High-risk and Popular NPS in the Middle East and Arabia

Figure 9
Figure 9. e-vendors from the Middle East and Arabic Countries

Figure 10 Figure 11 .
Figure 10.e-vendors Operating in the Middle East: Number of Items on Grams Engine

Table 1 .
Figure 12.The Religious Affiliation versus the Total Number of Hits (Grams) GHB on the Darknet: Number of Hits (Grams) versus the Incidence of Sexual Assaults in 2010.