Criminologists studying dark web criminal vendors found that 72% of 650 tracked illegal package deliveries went to properties listed for sale at the time of delivery. The remaining 28% went to properties vacant for other reasons. The average time between a property being listed for sale and an illegal package being delivered there was just 9 days. Items delivered this way included stolen checks, illegal firearms, narcotics, and prescription drugs.
How Researchers Found the Evidence
The research took advantage of something criminals do to build their reputation in underground markets: they share proof.
Criminal vendors on Telegram channels routinely post photographs and videos of packages they’ve sent, alongside the illegal items inside them. It’s their way of proving to potential buyers that they deliver as promised. They want reviews and repeat customers, so they document their work.
The researchers monitored thousands of these posts across illegal Telegram channels and dark web markets over a two-year period. Each image or video that included a shipping label, a tracking number, or a visible address gave them a data point.
By systematically collecting those data points, they built a database of 650 verified deliveries. Then they looked up each delivery address to determine the status of the property at the time the package arrived.
The results were consistent: the overwhelming majority of illegal packages went to properties that were on the market , for sale, for rent, or simply unoccupied.
What Was Actually Being Shipped
The research captured three categories of illegal deliveries in detail, each representing a different criminal market that uses the same technique.
Stolen and forged checks. In one documented case, a photo posted on a Telegram channel dedicated to check fraud showed a forged check alongside the envelope used to mail it. The envelope bore a Wyoming address. When researchers searched for that address, they found an apartment complex with multiple vacant units available for rent. The package had gone to an empty unit in a building where nobody was expecting it and somebody picked it up.
Illegal firearms. A video uploaded in April 2023 showed an assault rifle apparently being prepared for shipment from an Arizona address. When researchers checked, that property was listed for sale. The same operational logic applied: a vacant home for sale has no residents who would notice a package arriving, and it’s easy to access without raising suspicion. Dark web gun markets use this method to ship weapons to buyers who want to avoid any trace of the transaction.
Drugs. One of the most specific examples in the research involved a delivery to North Las Vegas, Nevada. A video circulating in illegal drug markets showed a package being received by a customer. The anticipated delivery date shown was March 28, 2023. When researchers checked the address, the property was listed for sale at that time and appeared to have been sold shortly after. The timing matched precisely. The property wasn’t someone’s home , it was an empty house between owners, used as a temporary collection point.
The drug markets the researchers monitored included one operating as a hub for prescription drugs: OxyContin, Viagra, Adderall, and Valium were all listed alongside an administrator who managed several connected Telegram channels.
Why Vacant Properties Are the Ideal Delivery Point
The logic is straightforward, and it’s why the technique is spreading.
A home listed for sale or rent is often completely empty. Nobody lives there. There are no neighbours who know the occupant well enough to notice an unfamiliar face picking up a parcel. Real estate listings are publicly searchable , anyone can identify a vacant property from a computer without visiting it. And the window between listing and move-in gives criminals a predictable, risk-free delivery timeline.
Nine days. That’s how long, on average, it took from a property being listed to an illegal package showing up there. Criminal vendors aren’t waiting long. They’re identifying fresh listings, using them immediately, and moving on.
As we covered earlier this year when cybersecurity researchers at Flare documented how dark web tutorials teach criminals to find and use mule addresses, the full criminal playbook includes USPS Informed Delivery registration at vacant addresses, mail forwarding requests, and fake identities to redirect correspondence. The criminologists’ research confirms the same core method but provides something the Flare documentation couldn’t: empirical data on how widespread it actually is.
The Cryptocurrency and Anonymity Layer
None of this works without the payment anonymity layer underneath it. Cash can’t be used for dark web purchases. Credit cards create bank records. Cryptocurrency and particularly cryptocurrency run through mixing and tumbling services , eliminates the financial paper trail.
As we’ve seen in every major dark web prosecution, including the Empire Market case where co-creator Raheim Hamilton received 40 years for a $430 million operation, cryptocurrency forensics eventually catches up with major operators. But at the individual buyer level, for a single package, the combination of Tor browsing, cryptocurrency payment, and a mule address for delivery creates a chain that’s genuinely difficult to trace.
This is why the practice has persisted. No prosecution of a buyer specifically for using a mule address delivery has been documented in the research. The crime is in what’s inside the package, but connecting the package to its actual recipient is the investigative challenge.
What Property Owners and Sellers Can Do
The research has a practical implication that the criminologists specifically address: property owners whose homes are listed for sale or rent may be unknowingly hosting illegal deliveries and not know it for months.
Several steps make a listed property a significantly harder target.
Install visible surveillance cameras before listing. A camera at the entrance or covering the doorstep changes the risk calculation for anyone planning to use the property as a collection point. It also creates a record if a delivery is made.
Use a property manager or regular check-ins. An empty property that’s visibly monitored , with someone opening the door, checking the mailbox, or appearing regularly , looks occupied enough to deter use as a mule address.
Register for mail holds and monitor deliveries. If your property address is inactive, request a mail hold through USPS at usps.com or set up USPS Informed Delivery to monitor what’s arriving there. Any unexpected packages appearing at a vacant property are worth investigating.
Brief your real estate agent. The address of a listed property becomes publicly searchable the moment it appears on a platform. Agents showing the property can look for signs of unexpected deliveries or unfamiliar individuals present at the property between showings.
For anyone discovering unexpected packages at a property they own or manage, the correct response is to contact local law enforcement without handling the package, rather than opening it or disposing of it.
Why This Should Matter to Everyone
The mule address problem is essentially the physical endpoint of the dark web supply chain. The platform exists online. Payment happens through cryptocurrency. But the product drugs, guns, fraudulent documents , has to travel through the ordinary postal and parcel system to arrive somewhere.
Vacant homes are the bridge between the digital criminal economy and the real world. The Telegram channels the researchers monitored are the same channels used to sell fentanyl and methamphetamine through operations like Icy White North, the Canadian dark web drug network dismantled by York Regional Police in September 2026. The delivery mechanism is the same. So is the category of harm.
The criminologists note they haven’t found any prosecutions specifically for using mule addresses. That gap is part of what makes the technique attractive. The research is partly an effort to put that gap on record and prompt property owners — and law enforcement , to pay more attention to the doorsteps of empty homes
Frequently Asked Questions
What is a mule address?
A vacant residential property, usually listed for sale or rent , used by criminals to receive illegal packages without revealing their real home address. The buyer or a middleman picks the package up from the doorstep.
What types of items are delivered to mule addresses?
Stolen and forged checks, illegal firearms, controlled substances like fentanyl and prescription drugs, counterfeit currency, cloned credit cards, and fake identity document.
How do criminals find vacant properties?
They search public real estate platforms for recently listed homes and apartments. The listings are publicly searchable, and vacant properties are easy to access between showings.
How common is this practice?
Researchers tracked 650 verified illegal deliveries and found 72% went to properties listed for sale at the time. The average gap between a property being listed and an illegal package arriving there was just 9 days.
Has anyone been prosecuted specifically for using a mule address?
Not yet. The researchers note they have not found any documented convictions specifically for the mule address delivery method. The crime is in what’s inside the package, but connecting a package to its actual recipient remains a challenge.
What can property owners do to protect themselves?
Install visible surveillance cameras before listing, use a property manager for regular check-ins, register for USPS Informed Delivery at the address, and brief your real estate agent to watch for unexpected packages between showings.
