What are ‘mule addresses’? Criminologists explain how vacant properties serve as depots for illegal online purchases

Nobody’s home, just as the sender intended. AndreyPopov/ iStock via Getty Images Plus

Online shopping isn’t just a convenient way to buy batteries, diapers, computers and other stuff without going to a brick-and-mortar store.

Many Americans also use the internet to quietly acquire illegal, fake and stolen items. Guns, prescription drugs no doctor has ordered and checks are on this long list, as well as cloned credit cards, counterfeit passports and phony driver’s licenses.

Because buyers and sellers alike realize that the authorities can detect illegal online transactions, criminals and their customers prefer covert online platforms that protect user anonymity, such as Tor, or encrypted messaging applications like Telegram and WhatsApp. Buyers and sellers also use digital wallets and cryptocurrencies to further conceal their identities.

As scholars of high-tech crime, we were eager to solve a riddle. Having these items shipped to the buyers’ homes or offices would make it easy for authorities to catch them. So how do people who buy these illegal items maintain their anonymity when they take possession of items they purchased on the dark web?

They mostly use vacant residential properties, called “mule addresses” or “drop addresses.” Once the illegal goods or phony documents get delivered – presumably without the owners’ knowledge – to the doorstep of the uninhabited home, the buyer or a middleman picks it up. This practice makes it very hard to trace these transactions.

Penchant for sharing

To discover where these items change hands, we took advantage of the inclination of some of the criminal vendors to share images on Telegram of the parcels they send, along with the illicit items.

They use this strategy to build their reputations, earn the trust of buyers and market their services.

Not all users of online underground markets do this, but we still spotted thousands of packages delivered this way over a period of two years.

In one case, we found a photo of a forged or stolen check alongside the mailed envelope used for its delivery on a Telegram channel dedicated to trading stolen and counterfeit checks.

The label on the envelope bears not only the shipping date but also the Wyoming address where it was sent. Armed with this information, anyone can retrieve related details by searching online. We found an apartment complex at that address with several units for rent.

A forged or stolen check alongside the envelope used to mail it to the person who bought it on the dark web.
Screen capture by David Maimon, CC BY-NC-ND

Guns, drugs and rentals

We also found that criminal vendors use mule addresses as their sender address. In one example, we found a video, uploaded in April 2023, of an assault rifle shipped from an Arizona address. At the time, that property was for sale.

The video displays an assault rifle apparently shipped from that address after being purchased online on an underground gun market. At the time, that property was for sale.

An illegal firearm vendor uploaded a video of an assault rifle being shipped to a customer.
Screen capture by David Maimon, CC BY-NC-ND, CC BY-NC-ND

We found a similar video documenting the punctual delivery of what we believe to be illegal drugs. Considering that the video has been circulating in illegal drugs markets that we monitor, it’s reasonable to assume that the package contains narcotics or prescription drugs.

The footage portrays a satisfied customer who has just gotten the drugs. We looked up the recipient’s address, which is discernible in the video.

It’s a property in North Las Vegas, Nevada, which was listed for sale at the time of delivery – although it seems to have later been sold. The anticipated delivery date, March 28, 2023, coincided with the day the package in the video was received.

One of the illegal digital marketplaces we identified is a hub for prescription- sales of OxyContin, Viagra, Adderall and Valium. It’s linked to an administrator who presides over several Telegram channels.

The administrator has shared photos on those channels that allowed us to see tracking numbers associated with packages they’d mailed. By collating the tracking numbers from April 20 to May 23, 2023, we compiled a comprehensive database of those addresses and the statuses of those properties when the packages were delivered.

We found that 72% of the 650 deliveries in this database were to properties listed for sale, and the rest were to properties unoccupied for other reasons. The average time that elapsed between a property listing and an illicit package being delivered there was nine days.

Be on guard

We haven’t yet learned of any criminals who were convicted of criminally using mule addresses to deliver illegal packages.

Because criminals take advantage of vacant residential properties listed for sale or rent by unsuspecting homeowners to protect their anonymity, we believe that it’s important for landlords and people who are selling or renting homes to protect themselves from these crimes of commerce.

Some of the same strategies that enhance safety in other regards can help, such as installing surveillance cameras and employing property managers.

David Maimon receives funding from Department of Homeland Security and other private organizations.

Saba Aslanzadeh does not work for, consult, own shares in or receive funding from any company or organisation that would benefit from this article, and has disclosed no relevant affiliations beyond their academic appointment.