The use of illicit substances has increased with the growth of the Internet and social networks. The International Narcotics Control Board recognizes that there is a link between social media and drug use (International Narcotics Control Board 2022). This is especially true for young people, as they use social media the most and have a high drug use rate (Riehm et al. 2019).

Fentanyl has a high potential for abuse and is classified under Schedule II of the Controlled Substances Act (Stanley 2014). Due to concerns about its extreme potency, fentanyl was initially approved in combination with droperidol by the United States Food and Drug Administration (Stanley 1992). Despite these concerns, fentanyl is widely used in clinical practice (Comer and Cahill 2019). However, like other opioids, repeated use of fentanyl leads to dependence (Han et al. 2019). There are two main channels for the ‘recreational’ fentanyl drug market (Kuczyńska et al. 2018). One is the illicit production and diversion of the drug in the United States (Kerensky et al. 2021) and Eastern Europe (Uusküla et al. 2015). The other is the unprescribed and unsanctioned use of pharmaceutical fentanyl in Western Europe (Sinicina et al. 2017), Australia (Latimer et al. 2016), and South Korea (Shin 2021).

There are two ways to approach the phrase “illicit online drug sales in the dark social media (DSM).” First, DSM broadly refers to the low online traffic on private social media networks and instant messages, which are difficult to access or are unavailable to the wider public (Swart et al. 2018). There is enough research on “The ‘Darknet’: The new street for street drugs” where drug dealers selling opioids like fentanyl have been studied (Broséus et al. 2016; Pergolizzi et al. 2017; Van Hout and Hearne 2017). Existing studies on cryptomarkets and the dark web fall into this category (Extance 2015). Second, the extended DSM and dark social networking site (DSNS) hypothesis by Al-Rawi explores the flaws of conventional social media and studies malicious drug S&P (Al-Rawi 2019). Al-Rawi (2019) studied the illegal sale and promotion (S&P) of fentanyl on social media (specifically Twitter and Instagram), using big data and computational and qualitative analysis. Additionally, he defined DSM and DSNS (similar to mobile apps). Social media policy is evolving in response to these studies (Kazemi et al. 2017). In the present study, we intend to follow Rawi's definition and method.

We investigated two social media platforms for which we could gather data, Twitter and Tumblr (Fung et al. 2020). This study’s goals were to identify drug dealers’ methods to promote fentanyl sales on the DSM, offer insights for tracing the temporal and technological development of measures to control illegal fentanyl sales and propose practical solutions. Moreover, we attempted to answer three research questions. First, are the established social media research methods used to study illegal drug sales still relevant? Second, by combining previous research methods, can the new ways in which drug dealers use social media as a DSM be identified? Third, at what times and using which techniques do drug dealers use social media as a DSM?

To examine the link between social media and drug use in this cross-sectional study, considering recent changes in application program interface (API) access regulations and accessibility, Tumblr and Twitter data were analyzed (Al-Rawi 2022; Facebook 2021). Twitter was included for its alleged efforts to limit illegal activities on the platform. The study was conducted in three stages: data collection (cloud-based computing), data preprocessing, and data tracking with the forensic examination (Mackey et al. 2018).

Stage I: data collection (cloud-based computing)

‘Fentanyl’ and/or its ‘street names’ were considered among the top 20 keywords (Al-Rawi 2019; United States Drug Enforcement Administration 2020). After a pilot analysis, ‘fentanyl’ was selected as a final search keyword, as the data collected with these keywords did not contain text related to illicit drug use. One non-English word ‘펜타닐’ (Korean) was used for a sensitivity analysis.

Data were collected in two steps. In step I, monthly data from tweets and posts containing the keyword ‘fentanyl’ were collected (from January to June 2021) to identify the trend of data volume changes during the initial six months and observe S&P during the same period. If the monthly data trend changed or S&P was observed, in step II, we collected additional data for January to June 2021 for the social media to confirm the trend’s consistency and back period for the social media, under the assumption that the latest data or S&P would be deleted quickly.

Stage II: data preprocessing

In stage II, data preprocessing was performed. Each tweet and post collected was categorized as ‘direct’ or ‘indirect’ and classified into various subcategories (Table 1). If the word ‘fentanyl’ appeared in the data, the tweet/post was labeled according to the other drugs mentioned.

Table 1 . Data preprocessing results.

Case		Twitter (n = 12,189)	Tumblr (n = 1,240)	p-value
Direct	Medical use of fentanyl	91 (0.75%)	11 (0.89%)	0.603
	Non-medical use of fentanyl	270 (2.22%)	609 (49.11%)	< 0.001
	Sales and promotion of fentanyl	1 (0.01%)	193 (15.56%)	< 0.001
	Total	362 (2.97%)	813 (65.56%)	< 0.001
Indirect	Others	6,371 (52.27%)	177 (14.27%)	< 0.001
	Unrelated cases	2,949 (24.19%)	25 (2.02%)	< 0.001
	News articles	1,491 (12.23%)	107 (8.63%)	< 0.001
	Campaign phrases	181 (1.48%)	42 (3.39%)	< 0.001
	Research materials	73 (0.60%)	12 (0.97%)	0.170
	Other medicines	46 (0.38%)	26 (2.1%)	< 0.001
	Novels	22 (0.18%)	11 (0.89%)	< 0.001
	Song lyrics	15 (0.12%)	27 (2.18%)	< 0.001
	Faulty coding	679 (5.57%)	-	< 0.001
	Total	11,827 (97.03%)	427 (34.43%)	< 0.001

Stage III: data tracking with web forensics

In stage III, we conducted web forensics using Mackey’s research method to identify how drug sales take place on social media and whether tweets and posts were sent to consumers to facilitate illegal online S&P via communication apps (Mackey et al. 2018). Web forensics focused on websites and individual dealers linked to external web pages, photo images, videos, emoticons, hashtags, and direct messages. First, each hyperlink was checked to ensure that it was ‘active’ (i.e., whether it was a valid URL to an active web page). Next, the data associated with ‘inactive’ hyperlinks were collected. Legal categories of Internet pharmacy websites were classified as ‘rogue’ (vendors engaging in illegal, dangerous, or deceitful acts) or as ‘no database’ (vendors not subject to LegitScript review or monitoring) using the Internet surveillance service company LegitScript LLC. To determine where and how an Internet Protocol (IP) address was registered, the WHOIS lookup tool was employed. To monitor changes in illegal fentanyl S&P data, data tracking with the forensic examination was repeated.

Statistical analysis

Counts and percentages were used to represent discrete variables. The Python Programming Language 3 interface for streaming application programs was used for data collection. Fisher’s exact test and Chi-squared test for discrete variables were used to detect differences. All analyses were conducted using RStudio (Version 4.2.1) software. A P value lower than 0.05 was considered statistically significant.

Graphic summary

A graphic summary of this study’s research methods and findings is provided (Fig. 1).

Figure 1. Summary of methodology and the main findings.

Data collection of Twitter and Tumblr

In step I of stage I (data collection, January-June 2021]), 12,189 tweets and 376 Tumblr posts mentioning ‘fentanyl’ were detected (Fig. 2A). After analyzing their content, 61 (16.2%) S&P Tumblr posts and 1 (0.01%) S&P tweet were detected. Twitter’s monthly data were found to be consistent, whereas Tumblr’s data were more up-to-date. Following data collection, Tumblr’s backward (January-December 2020) and forward (July 1-31, 2021) data collection began. In step II, 583 Tumblr posts from the previous year were collected (Fig. 2B). However, a forward trend of S&P on Tumblr indicated that the most recent data were lost over time. For forward data analysis, the target dataset of 281 Tumblr posts from July 2021 (collected on August 1, 2021) decreased to 147 posts by August 2021 (collected on September 7, 2021) (Fig. 2C). The original S&P data were quickly removed from Tumblr (114/281, 40.6% ^→ 31/131, 23.6%), in contrast to other categories (non-medical use of fentanyl and indirect data, Fig. 2C). During steps I and II, we collected 1,240 Tumblr posts (January 2020-July 2021).

Figure 2. Step I and II of data collection. (A) Step I: First cross-sectional data collection of tweets and Tumblr posts containing the keyword ‘fentanyl’ (January 2021-June 2021). (B) Step II: Backward data collection of Tumblr posts containing the keyword ‘fentanyl’ (January 2020-December 2020). (C) Step II: Forward data collection for the previous month (July 1-31, 2021) of Tumblr posts containing the keyword ‘fentanyl’ (S&P, medical and non-medical use of fentanyl, indirect data, and news articles). Original analysis data (collection date: August 1), first follow-up (September 7), and second follow-up (October 1) of Tumblr posts.

Data preprocessing

In stage II, data preprocessing was conducted (Table 1). The datasets from Twitter and Tumblr were notably different (p < 0.001), except for two categories: medical use of fentanyl (p = 0.603) and research materials (p = 0.170). Half of the Tumblr data were related to the non-medical use of fentanyl, which is consistent with previous research (Cavazos-Rehg et al. 2017). The 10 most frequent drug words, except fentanyl, are drug-related words mentioned (Table 2)

Table 2 . The 10 most frequent drug words, except fentanyl, used in the data (includes duplicates).

Rank	Drugs	Twitter	Tumblr
1	Amphetamine (meth)	1,715 (35.9%)	329 (13.9%)
2	Cocaine	708 (14.8%)	150 (6.3%)
3	Heroin	696 (14.6%)	576 (24.32%)
4	Marijuana	337 (7.1%)	37 (1.6%)
5	Naloxone	268 (5.6%)	38 (1.6%)
6	Oxycodone	195 (4.1%)	91 (3.9%)
7	Percocet	147 (3.1%)	69 (2.9%)
8	Morphine	119 (2.5%)	70 (3.0%)
9	Alcohol	114 (2.4%)	24 (1.0%)
10	Xanax	100 (2.1%)	84 (3.5%)

Data tracking with web forensics

In stage III, web forensics was conducted for posts categorized as S&P. Among 1,240 posts, 192 posts from 51 Tumblr IDs were found. In the first forensic period (August 2021), three groups of S&P data were identified.

Individual drug dealers: group A

Group A comprised 19 individual sellers who used images within e-mails, social networking site (SNS) accounts, and direct messages. E-mails (7) and phone numbers (5) were the primary sources of contact. SNS sources (including duplicates) were Wicker (10), Telegram (7), WhatsApp (4), Snapchat (4), Wicker Me (1), and Kik (1). Two accounts used direct messages (DMs) and hashtags (#) or pill emoticons (&#x1f48a;) in the comments of popular drug-user bloggers. However, most were ‘No-DMs’ sellers.

Website seller: group B

Group B comprised 30 websites for direct S&P of fentanyl using words and images with hyperlinks. Group B was further subdivided into B1, B2, and B3. Group B1 comprised groups for illegal S&P of fentanyl and other opioids—including 11 active members and 1 inactive member (LegitScript ‘rogue’). Group B2 comprised clandestine hyperlink groups where all 13 URLs were active (LegitScript ‘no database’). Group B3 comprised five inactivate hyperlinks on the first forensic test day (August 27, 2021; LegitScript ‘no database’). In the August 2021 web forensics test, 30 hyperlinked homepages were discovered, of which 24 were active (80.0%); by October 1, 2021, only 14 remained active (46.7%). We used WHOIS to ensure that the address on the webpage matched the address for the registered domain.

Group B used e-mails (22) and phone numbers (19; 3 were duplicates). SNS sources (including duplicates) were WhatsApp (12), Wicker (5), Instagram (2), Twitter (2), Facebook (2), Telegram (1), Snapchat (1), and YouTube (1). Of these, accounts linked to Instagram, Twitter, Facebook, and YouTube were suspended.

Redirected user: group C

Group C comprised indirect illegal S&P of fentanyl. There were 2 IDs links to other blogs or homepages that redirected users to sites selling fentanyl illegally.

Data tracking

In stage III, data tracking was conducted (Fig. 3). The original analysis data (From July 1, 2021 to July 31, 2021; collected on August 2021) comprised 114 S&P datasets. Group B was the most active (72.8%), followed by Group A (26.3%) and Group C (0.9%). In Group A, 15 of 30 posts were inactive. At the first follow-up (September 7, 2021), there were 47 S&P datasets, Group B (87.2%) remained active, all six posts in Group A (12.8%) were inactive, and Group C had now new posts. At the second follow-up (October 1, 2021), 33 datasets remained, all belonging to Group B2.

Figure 3. Tracking results (July 1-31, 2021) of changes in illegal fentanyl sales and promotion data on Tumblr. Original analysis data (collection date: August 1, forensic date: August 27), first follow-up data (collection date: September 7, forensic date: September 7), second follow-up (collection date: October 1, forensic date: September 7). Group A: Individual drug dealer. Group B: Website seller; Group B1: Rogue website; Group B2: No database and active; website; Group B3: No database and inactive website. Group C: Indirect seller.

Case report

While analyzing and tracking S&P data, we discovered a notable case (Fig. 4). A group of sellers with the same phone number used three different Tumblr IDs and links to set up illegal online shops for fentanyl. The self-proclaimed location of the online shop was the United States; however, the IP belonged to India, Bangladesh, and another undisclosed location.

Figure 4. A representative example of online illegal fentanyl sale shops avoiding social media surveillance (Group B3: No database and inactive website; Group B1: Rogue website; Group B2: No database and active website).

Our study aimed to understand how drug dealers avoid social media surveillance. To this end, we collected and analyzed fentanyl-related data from social media. We examined fentanyl-related data from Twitter and Tumblr, using three-stage data tracking with forensic examination to determine how drug dealers avoid social media surveillance. Our findings suggest that Twitter’s efforts to limit the sale of opioids are effective. Online drug dealers have evolved along with social media surveillance and turned it into a DSM; thus, the illicit S&P of fentanyl via SNSs is a fight against time and technology. Drug dealers who are active on SNSs continuously search for loopholes and find innovative ways to advertise their goods. The web forensic analysis showed that drug dealers use social media as a gateway to connect with new customers.

Regarding the first research question, it was found that previous studies’ research methods for data collection, analysis, and web forensics were applicable to Twitter and Tumblr data. Regarding the second research question, by combining previous research methods, we identified the new methods used by drug dealers on the DSM. Combining the methods of Mackey (Mackey et al. 2018) and Branley and Covey (Branley and Covey 2017), a statistical comparative study method was applied to Twitter and Tumblr data. Consequently, considering ‘fentanyl’ as a keyword, Tumblr represents a darker social media platform than Twitter (Table 1). Data preprocessing showed that a higher percentage of Tumblr data (192 [15.56%]) was classified as pertaining to fentanyl S&P, compared with Twitter data (1 [0.01%]). Additionally, negative S&P activity on Tumblr (192 [15.6%]) outnumbered positive activity such as news articles and campaigns (149 [12.0%]; Table 1). It seems that Twitter is faster at removing fentanyl S&P-related data (1 [0.01%]), leaving mostly positive data (1,672 [13.7%]), in line with its efforts to limit the sale of opioids (Al-Rawi 2019). This contrasts with Instagram and Facebook, which censor both positive and negative fentanyl-related activities (Al-Rawi 2019). Further, we compared other drugs mentioned on Twitter and Tumblr (Table 2). Regardless of the drug class, meth, cocaine, and heroin were the most popular drugs on Twitter, whereas heroin—a narcotic like fentanyl—was mentioned most frequently on Tumblr. This suggests that drug dealers have used Tumblr instead of Twitter as a DSM for fentanyl S&P.

Data analysis was conducted close to ‘real-time’, which compensated for the limitations of Mackey’s method (Mackey et al. 2017). For a cross-sectional study of Tumblr and Twitter data, a fast data tracking and analysis method was used. The results differed from previous research (Mackey and Kalyanam 2017; Mackey et al. 2017). As we decided to stop collecting additional data if there was no trend change or S&P in step I of data collection, rather than tracking quantitative data, in Step II, we focused only on Tumblr and the keyword ‘fentanyl’, collecting relatively more ‘active’ URLs and IDs. Mackey et al. found 1,778 tweets, but only 46 hyperlinks were ‘active’. Our study found 30 hyperlinks in 192 Tumblr posts, 24 of which were ‘active’ (Mackey et al. 2017).

By combining Al-Rawi’s and Mackey et al.’s methods, we found that the DSNS of drug dealers using hyperlinks and of individual sellers were different. The mobile apps used in Groups A and B were WhatsApp (16), Wicker (15), and Telegram (8), similar to a previous study (Al-Rawi 2022); however, individual sellers in Group A predominately used Wicker (10) and Telegram (7), while online shops in Group B used WhatsApp (12). However, Korean drug dealers utilize Telegram more than any other DSNS (Prosecution Service 2021). We included hashtags and emoticons in our study and found that Group A (individual sellers) used them the most.

Regarding the third research question, we found that drug dealers’ methods and activity patterns evolved to avoid social media surveillance. Most Tumbler S&P accounts were either deleted or disappeared within two months (Fig. 3). Accounts that were ‘active’ for more than two months were found in Group B2. Additionally, Group B2 included clandestine hyperlink sites that may be illegal. Tumblr provides a procedure for deleting negative posts or suspending IDs for text but not for images. Therefore, it is essential to employ image, hashtags, and emoticons analysis to prevent the activities of individual dealers. We found examples of the strategies used by fentanyl dealers that exploit loopholes in Tumblr (Fig. 4). Three different Tumblr IDs belonged to the same seller, as they used the same international phone number. Dealers’ average activity cycle is 1-2 months, after which Tumblr deletes the accounts or deactivates data (Fittler et al. 2013). Immediate action is required to prevent people from linking to illicit drug-sale websites. Given how long illicit online drug shops usually last, marketing permission for S&P websites that are unclear on the law should be delayed one to two months. Furthermore, given the cycle of online drug dealers’ activity, social media should establish strict monitoring intervals for regulated substances.

Twitter quickly deletes drug S&P-related tweets in English; however, it is not as fast for other languages. Therefore, extra effort is required for those languages. In South Korea, in 2021, there were 16 cases of prosecution for violating narcotics marketing via Twitter (13% of all social media accounts) (Prosecution Service 2021).

The IP address of the S&P hyperlinked websites on Tumblr appear evenly distributed in the United States, Europe, and Asia, implying that illegal online fentanyl transactions occur worldwide. The government and social media companies must find ways to collaborate to fight against illegal drug sales through international IP addresses. Additionally, given the recent changes in API access regulations and accessibility, Tumblr and Twitter were chosen for this study, as prior studies focused on one or two SNSs (Mackey et al. 2018; Li et al. 2019). In this study, we found Twitter has been successful in limiting the sale of opioids, but attention should be paid to non-English languages. However, Tumblr has a higher amount of negative S&P than positive activity such as news articles and campaigns (Cavazos-Rehg et al. 2017). To block the illegal S&P of fentanyl in social media platforms, first, given drug dealers’ activity cycle, regulated substances such as fentanyl should be closely monitored on social media. Second, websites with ambiguous S&P activities should be put on hold for one or two months. Third, it is important to use an image, hashtag, and emoticon analysis tools to track and stop individual dealers. Social media companies also must collaborate with governments and researchers to positively maintain social networking platforms to prevent the illicit sale of drugs.

This study has some limitations. First, we did not interact with the accounts to confirm whether the drugs were available, as this is prohibited by law, even for research purposes. Second, there was a time lag in data collection. Specifically, we encountered time and technical constraints when examining drug dealers’ methods based on historical data, compared with the real-time rapid changes in drug dealers’ activity patterns. Data preprocessing was performed via manual annotation and classification. Future research combining machine learning and image analysis is expected to overcome these limitations.

This study was based on fentanyl-related data collection from Twitter and Tumblr, using three-step data tracking with forensic examination to determine how illegal drug dealers avoid social media surveillance. Our main results indicated that the illicit S&P of fentanyl via social media was a fight against time and technology. So, we conclude that social media can block the illegal S&P of fentanyl through the following considerations. First, given the cycle of activity of drug dealers, regulated substances should be closely monitored on social media. Second, individual dealers must be identified and stopped using image, hashtag, and emoticon analysis. Finally, researchers, governments, and social media companies must collaborate to positively maintain social networking platforms to prevent the illicit sale of drugs through such platforms.

The authors declare that they have no conflict of interest.

This work was supported by the National Research Foundation of Korea (NRF2021R1F1A1062044 and 2021R1A6A1A03044296).