Illicit drug sales in the digital age: OSINT analysis of encrypted markets (2026)

Encrypted messaging platforms are increasingly used for illicit drug distribution, yet research has focused primarily on darknet markets, leaving surface-web activity relatively underexamined. The present study analyzes an open-source intelligence (OSINT) sample of 107 publicly accessible Telegram-based drug markets and nearly 750,000 archived posts from markets identified and collected in the study period between April 2022 and April 2023, including visible historical posting activity dating from October 2020 to December 2023. The study combines dynamic activity averaging, qualitative coding of textual and visual content, and supervised ChatGPT-assisted extraction of explicitly stated price and quantity information. The contribution of this study is twofold: methodological and empirical. The study demonstrates how OSINT can be adapted for social-scientific analysis of public-facing activity in an encrypted messaging environment, while documenting the observable organization, commodities, advertising format, and trust practices of sampled Telegram drug markets. Within the sampled markets, annual post counts increased from 9,201 across five active markets in 2020 to 359,209 across 68 active markets in 2022, before declining in 2023. Cannabis listings increased sharply, while hashish declined, indicating shifts in supply advertisements. Financial fraud and weapons-related posts also emerged, suggesting diversification in these primarily drug-focused markets. Vendors used e-commerce-like practices, including menus, branding, delivery claims, shipping proof images, and scam warnings. This article provides a large-scale descriptive account of an understudied Telegram ecosystem and outlines implications for OSINT-informed monitoring, platform governance, and public-health-oriented responses. [Author's abstract]