Probably, the wave of popularity of the messenger in Russia and among drug dealers is directly related to the closure of RAMP – the largest darknet site.
In July 2017, in the Russian-speaking segment of Telegram, the drug infrastructure began to grow sharply. On this topic in the messenger appeared closed chat discussions, advertising lucrative offers, bots for sale and individual sellers.
Such a jump in activity has several reasons. The first is that due to the summer clashwith Roskomnadzor, Telegram was regularly mentioned on television and in the federal media, which attracted a new audience.
The second probable cause is connected with the fall of the most popular Russian drug selling site RAMP. The initiators of the closure called the Interior Ministry, competitors and the creators themselves. tried to track the history of the closure of the RAMP and studied how its audience uses Telegram. At the request of the publication’s interlocutors, all names are changed.
Around the end of January and the beginning of February 2017, the user of the White Pillow messenger became interested in buying drugs. He could use the RAMP or Hydra shops, but nonetheless learned from his friends the technical details of transactions in Telegram.
With the purchase directly from the sellers, many problems have arisen. For security, the parties for each transaction created a secret chat in the messenger, where the data on the correspondence were stored only on the phones of the interlocutors. This function, according to the creators of Telegram, provides full protection of correspondence from outsiders.
Buying through chatbot was different. They allow you to automatically select a product, weight and its approximate location. Pillow checked this method and identified its main drawback – by buying through a robot, he was deprived of the opportunity to talk with a live seller in the event of a problem. It was possible to contact technical support, but the operator was not always on the network.
About half a year after the first purchase, Pillow became a moderator for a closed chat in Telegram. He had a boss, salary and work – he began to track in the conference cheaters, prompt inexperienced buyers and promoted new stores in the messenger. In a conversation with , he explained that he had acquired in the Telegram goods for about 150 thousand rubles, and plans to continue.
Closed chat life
In Telegram, drug dealers began to actively flock around mid-summer of 2017, although single channels appeared at the end of 2016. This can be checked by looking at the date of loading the cover of chatbots, private channels or individual sellers.
Chats can be accessed via the invitation link, which is sent through thematic channels. One of the most popular is called RAMP official vol 2. There are about 1,100 people who constantly discuss personal problems, interests, send themed memes, share narcotic experiences or advise sellers. It is difficult to keep track of the thread of the dialogues – messages appear very quickly.
The RAMP chat appeared in January 2017, but in a conversation with one of the Blue Name administrators noted that he had begun to actively develop in May. There are younger and less popular channels. For example, the Hydra market official chat, referring to the eponymous darknet site. There are only 600 people in it, but discussions are also constantly going on there.
There are very small conferences behind which there are no brands of well-known darknet sites. Invitations to these chats usually appear in better known or on mutual advertising. The exact number of these conferences is difficult to determine, not everyone wants to increase the number of participants. If you believe the anonymous interlocutors , these channels began to develop massively in the summer of 2017 – after the fall of the RAMP.
What is known about closing the ramp
Around the middle of 2017, the RAMP site, the largest Russian-language drug selling site, stopped working on the darknet. No reliable information was received from the administration of the project on the reasons for the closure. There are several versions of what happened: the Ministry of Internal Affairs liquidated the site, competitors attacked or its owners fled.
The first problems of RAMP users began in late May-early June. Shortly before this, it was reported on Runion that the customer database of the site was hacked and sold on the darknet. Two interlocutors of the store owners at RAMP and Hydra, questioned this news. The owner of the eponymous store, Philip Morris (4 years in the drug business), stated that the information about the merging of data was a rumor, and all the important negotiations on the forums were never conducted.
The owner of several stores at different sites named Mood (experience in the drug business for more than five years) told that information about hacking is part of a “stuffing” before DDoS attacks on RAMP. Mood hinted that the initial data on the sink appeared on the forums controlled by the competitor RAMP – Hydra. Probably, the sink could be used as a way to discredit the reputation of the site and scare the audience.
Version: MIA intervention
In mid-September, the Interior Ministry reported on the closure of the RAMP. The agency said it liquidated the platform in July, directing the main forces to find distribution channels and curbing distribution activities. This version became the main one and was widely sold in the media.
However, the publication “Mediazona” put into question the statements of the department. First, the investigators did not disclose the details of the elimination of the darknet site. Secondly, it remains unclear why the closure of the RAMP was reported only in the fall, and not in the summer – immediately after the fall.
In response to the publication’s request for details of the liquidation of the RAMP, the Office sent a formal response, from which it followed that it was not the entire site that was being liquidated, but only a few little-known stores located on it. Moreover, the fact of closing three cells on the site could hardly completely undermine the work of the site.
Version: RAMP Administration Flight
RAMP was divided into two parts – the main forum and instant store, located on different domains, where you could see and buy goods. At the end of May, unknown persons began to conduct DDoS attacks on the site – that is, to send mass requests to the site server, hindering its work. The former mortgage taker Ignite told that at first the instant store had started to work poorly at the site.
Five interlocutors of the publication stated that coordinated attacks were made on the site. Mood suggested that these were not just DDoS attacks, but a well-written script. He automatically created and logged into new accounts on the site, scoring the time to access the database. This task, the seller believes, could be carried out by experts from Hydra or the shadow forum Legal.
The attacks, according to the sellers, were successful. At some point, the RAMP stopped supporting Qiwi wallet transfers. This payment method accounted for 50-70% of retail sales, according to Mood, the alternative was Bitcoins – a more sophisticated means of payment.
Three interlocutors of , including the author of the Klademen Telegram channel , said that at the time of the DDoS attacks, the RAMP site was technically outdated and could not withstand such loads. If you believe the rumors, the chief executives of the Darkside and Orange platform left at the end of 2016, and the new administration did not devote enough time to defense. This led to unstable work and, presumably, forced the administration to withdraw all the money from the site and close it.
Mood told the alternative version. Allegedly, until mid-July, the RAMP administration fought off attacks (in July, the site worked with strong interruptions), but the situation took a sharp turn – the most popular Russian bitcoin exchange BTC-E stopped working . On this site, the administration of the RAMP kept most of the funds, so after the close of the exchange, they had no money left to fight back from the attacks. After that, the administration allegedly chose to withdraw the remaining savings and wind down the business.
Panic and opening RAMP 2.0
The author of the Kladmen Telegram channel, Mood and his colleague Philip Morris told about the reaction of dealers and drug business customers to the closure of the RAMP. The situation has undermined the work of many dealers who have lost money invested in stores. On the project, they had a rating system that users trusted. Plus – the rating system protected clone owners from stores. With the closure of the RAMP, these advantages are gone.
July was the month of panic for RAMP dealers. The administration of the darknet site forbade sellers to have an alternative store on another service – for violating the rules of the RAMP, it ceased cooperation with the dealer. Many were counting on the restoration of the site and waited without risking opening stores on Hydra or in Telegram.
When in August it became known about the opening of RAMP 2.0, dealers and customers loyal to the site moved there. The head of the new project introduced itself as a former member of the RAMP – Exsistentia.
According to the Telegram-channel “Darknet” (more than 34 thousand subscribers), the administration of RAMP 2.0 has left a loophole that allowed viewing and saving passwords from user accounts. The attackers then resold the account data to third parties and shut down the RAMP 2.0 servers. Now the site is not working.
Mood told that he had lost $ 500 because of fraud, while his colleague Philip Morris chose to leave for Hydra and soon developed a store there. Both vendors called RAMP 2.0 falsification.
RAMP 2.0 cheat put an end to the story of the fall of the original site. At the end of August, the darknet project audience actively shared versions of the involvement of the Interior Ministry, competitors, or personal motives of administrations in the fall of the project. None of the versions is officially supported and based on individual opinions.
In this case, the topic of police intervention in the affairs of drug sites remains one of the most popular among the darknet audience. When asked about the involvement of the Interior Ministry in the closure of the site, Philip Morris declined to comment on the situation of . “There is an opinion, but I don’t want to announce it, because for me later, it’s ***. I don’t touch anyone and they don’t touch me, ”the seller replied.
Outlet to the sellers in the Telegram
The administrator of the closed chat Blue Name explained that the development of the channels began after the authors found a way to monetize. The manual began to distribute invitations to the conference in other chat rooms and attentively moderate discussions in order to attract advertisers.
For 5 thousand rubles, the administration advertises a shop or chatbot in a Telegram three times a day. The same scheme works in the Hydra market official. If the seller’s advertiser deceives the buyer, the chat administration blocks him.
The exact number of chatbots or individual sellers in the Telegram is difficult to determine. According to the administrator of the RAMP chat, there are a lot of them, but technically they copy each other. You can arrange a purchase in a secret chat with a courier, then delete the correspondence for additional security. This option is convenient because the client can find out all the nuances and in case of problems write to the seller.
Chatbots are mainly used by large Telegram dealers who cannot manually respond to each request. The purchase is as follows: the customer selects the desired city (some shops only work in Moscow) and the product. The store offers to choose the weight of the product from several options, but you cannot specify the exact weight yourself. Usually in each chatbot they give a choice of 2-3 areas where a bookmark will be made, the payment methods are the same everywhere — bitcoins or Qiwi-wallet.
Clients always send money first, then wait for confirmation from the seller, receive a photo and approximate address of the goods. Some chatbots have more functions: they inform about store vacancies or display a list of closed chat communities where you can discuss the product. Through them you can also contact a technical specialist.
Between the closed chat communities there is no hard confrontation for customers, sometimes a participant in one conference is in another. Blue Name told about a certain intruder who copies the profile of “prominent figures” of the conference. One day he faked a RAMP chat administrator account and started offering drugs to the conference participants that he did not have.
The attacker explained the Blue Name, which “will lag behind” from their chat for 5 thousand rubles. The conference administrator refused. At the request of to provide a link to the profile of the attacker, the chat manager explained that the cheater is constantly changing accounts.
Closing the RAMP is an important, but not the only reason Telegram is popular with drug dealers. In the middle of summer, the messenger was on the verge of blocking in Russia, which was talked about on television and in the federal media. This publicity has attracted a new Russian-speaking audience to the service – a potential clientele for drug dealers.
Mood, author of the Kladmen telegram channel and Philip Morris, acknowledged that the closure of the RAMP has shaken and forced drug dealers to switch to Hydra and to Telegram. Other interlocutors agree with this. Only versions about the prospects of the drug business in the messenger are diverging.
Its main disadvantages are the absence of a large number of verified sellers and reviews, with the exception of a few stores that have a chat for reviews and technical support. Inexperienced buyers may have problems with the purchase stages in the messenger: you first need to find a reliable chat, then find an advertisement for a trusted store, study its functionality and then buy.
Against the background of Hydra, which is now called the monopoly of the drug business in RuNet, Telegram is an unattractive service. But in a conversation with , the author of “Kladman” noted that this situation may change. This requires only the neutrality of the administration of the messenger, which will not block the narcotic content, and good programmers. “And we will see in Telegram large-scale projects that are in no way inferior, or even superior, to sites like RAMP and Hydra,” concluded the former cladman.
Attitude Telegram leadership to the development of the drug
The rules of the messenger do not say directly about the ban on the sale of drugs in the messenger. It says that the administration can remove content that infringes copyrights, propagandizes terrorism or spreads pornography. It can also block stickers, channels or chatbot on the user’s complaint if it contains illegal content.
Since 2015, it has been known about blocking channels with pornography and terrorist propaganda . However, the topic of drug trafficking rose much less frequently. In July, Channel One said that drug dealers are using Telegram to sell goods. Two days later, Durov said that locking the site in Russia “will not complicate the tasks of terrorists and drug dealers.” Later, the entrepreneur clarified his position.
As part of working with a Russian regulator, we can only promise the level of cooperation that we demonstrate in all other countries, namely, to continue to work together to remove public materials related to the promotion of terrorism, drugs, calls for violence and child pornography, and to continue working to curb spam mailings.
In September, the topic of drugs in the messenger rose again. Iranian authorities said Telegram is used by members of the Islamic State, arms dealers, child pornography and drugs. “I am surprised by this news. We regularly block terrorist and pornographic content in Iran, ” Durov commented on the situation. Twitter users then noticed that Durov did not say anything about the fight against drugs in Telegram.
asked Durov a few questions on the chatbots and the fight against drugs that appeared in the messenger, but received only a brief answer from a Telegram representative: “If a valid official request is received, such a bot can be blocked. It is not clear from it how such a request should look, where to send it and which requests to Telegram are considered valid. It is also unknown whether Telegram has ever blocked drug-related channels or bots – Durov did not answer this question.
The head of the private chat community told that he had never heard of locks on channels with narcotic content. The problem of closing the chatbots was not raised by other interlocutors of the publication in the field of drug trafficking. Correspondent complained about the five chatbot for the sale of drugs through a special form of messenger, to check whether the moderators react to this. At the time of this writing, stores continue to work.