The OSINT-based NABU project

The online trade in looted cultural objects has expanded over the past decades, moving away from clandestine spaces into mainstream, easily accessible platforms such as Facebook and Reddit (Leeson 2024). Due to their high visibility, social media sites, online marketplaces, and community forums are common channels for traffickers to advertise and sell artefacts taken from archaeological sites and cultural institutions. The fact that much of this occurs on the surface web (as opposed to the dark web) makes the trade easier for malicious actors to access and far more visible than before. However, it also presents opportunities for researchers and law enforcement to trace illicit sales using existing data collection and analysis tools.

How do we know this phenomenon exists? It takes just seconds to search social media or online marketplaces to find hundreds, or even thousands, of listings for ancient coins, sculptures, manuscripts, and other artefacts, many sourced from conflict or post-conflict regions.

Several factors have enabled this trade to persist and grow. Some sellers are hobbyists trading legitimate replicas, but many listings show signs of illicit origin: freshly unearthed objects still covered in soil, bulk lots of coins from known hotspots, artefacts with museum numbers still attached, or images taken directly at looting sites. Traffickers know that most platforms lack the expertise and resources to distinguish legal from illegal goods, and they frequently exploit that gap. For instance, sellers may describe ancient items as ‘old,’ ‘rare,’ ‘from a private collection,’ or ‘found in the family home,’ avoiding direct language that would trigger the removal of their posts. They may use regional dialects, emojis, or coded language to avoid detection. They may also neglect to post a photo of the object, instead providing a phone number where potential buyers can contact them directly through a more secure channel like WhatsApp or Telegram. Yet none of these methods is particularly sophisticated.

Most sellers on social media operate in open groups or public communities with thousands of members. Some even use standard marketplace categories designed for everyday goods or, in the case of online marketplaces like eBay or Catawiki, designated categories for antiquities. In large part, the illicit trade persists on the open web because enforcement capacity, of both the platform moderators and the police, is stretched too thin to perform due diligence checks on the sheer volume of suspicious listings.

In terms of so-called ‘source countries’ (where looted objects typically originate), nations like Italy, Greece, Syria, Iraq, Palestine, Sudan, Yemen, and Egypt have been particularly affected. Many of these countries have also experienced periods of sustained conflict and economic instability, which have negatively affected the governance of cultural heritage and handicapped efforts to prevent looting. As a result, archaeological sites became vulnerable to illicit digging while museums and libraries faced targeted theft. Once objects are removed, they can be photographed and posted online in minutes. Trafficking networks (linking looters on the ground with buyers via intermediaries like smugglers, dealers, and corrupt authorities) operate across national borders, making them difficult to dismantle using traditional enforcement methods.

Law enforcement agencies and cultural heritage organisations are working to keep up with these illicit activities through increasingly sophisticated monitoring systems. The Italian Carabinieri, for example, boasts one of the largest databases of stolen and missing cultural goods in the world, named Leonardo. This database is regularly checked by their Stolen Works of Art Detection System (SWOADS), which uses web crawling and automated image analysis to scour the web for stolen objects. The Carabinieri’s Command for the Protection of Cultural Heritage (TPC) is arguably the most effective specialised art crime unit in the world, having recovered over 3 million stolen artworks and artifacts since its inception in 1969 (Ragusa 2023). However, they are certainly the exception rather than the rule, as most police forces lack the resources to be able to achieve comparable results.

A growing number of research initiatives, such as the EU-funded RITHMS project (2022-2025), coordinated by the Italian Institute of Technology, are working to close this gap by tracking trafficking networks, gathering open-source intelligence, and analysing patterns in online sales. Working with law enforcement partners, they seek to gradually flesh out what has so far been a relatively under-documented phenomenon, as comprehensive data across platforms and countries remains limited. The problem is not only identifying the objects, but also understanding the networks behind them, the routes they follow, and the conditions that allow the trade to flourish.

With these challenges in mind, the NABU project was launched this month to collect data on the open sale of potentially illicit cultural goods, focusing on countries that have experienced sustained periods of conflict and instability, and whose law enforcement, as a result, lack significant resources to dedicate to the problem of cultural goods trafficking (Turaath Tech 2025).

Led by Turaath Tech, the project aims to document and analyse the online trade in cultural goods originating from Iraq, Sudan, Yemen, and Palestine by treating the internet as a primary source of evidence. Rather than relying on anecdotal reports or isolated takedown efforts, the project uses systematic data collection and quantitative analysis to understand how illicit antiquities circulate on the surface web. NABU’s approach combines open-source intelligence, automated scraping, and data mining to produce evidence-based reports that are then provided directly to law enforcement on the ground.

The project emphasises that insights can be generated using existing research methods, such as web scraping, keyword analysis, and pattern recognition. A combination of web scraping and manual verification is used to gather posts, images, metadata, comments, seller profiles, and price information, using methods that have proven successful in other initiatives such as RITHMS and the ATHAR project (Leeson et al 2024; Al-Azm & Paul 2019). Each item is processed through a data cleaning pipeline that standardises fields and removes duplicates. The aim is to create a multilingual, multi-platform dataset that reflects the active online market in the countries under focus.

A key element of NABU’s methodology is classification. Posts are categorised according to object type, material, claimed origin, platform, and various risk indicators. The system assigns confidence scores that reflect how likely an item is to be illicit based on visual markers, keywords, and other contextual cues. While NABU does not make legal determinations, it highlights patterns that may be valuable for law enforcement partners.

Network analysis is another central component. Trafficking is rarely the work of isolated individuals; rather, it also involves brokers, intermediaries, transporters, and collectors. By mapping connections among user accounts, comment threads, repeated interactions, and shared images, NABU identifies clusters of activity and tracks how goods move through the digital ecosystem. This approach helps distinguish casual hobbyist exchanges from structured, long-running networks that operate across borders.

The first, 12-month phase of the NABU project concentrates on Iraq, where decades of conflict, economic pressure, and weak regulatory environments have made archaeological sites and cultural institutions especially vulnerable to looting. Iraq is also one of the most active countries in the online trade of antiquities, making it a practical starting point for a data-driven monitoring effort. By focusing initial resources on a single country, the project aims to build a replicable model that can later be expanded to other regions with similar risks and online market dynamics (namely Sudan, Yemen, and Palestine). Compared to European countries, which have been the focus of previous projects such as RITHMS, Iraq presents both opportunities and challenges for digital monitoring.

On one hand, the country’s rich archaeological landscape means that artefacts circulating online can often be linked to specific regions, periods, or site types. On the other hand, the volume of online listings associated with Iraq is high, and many posts use coded language, regional dialects, or indirect references to avoid detection; sellers may also attribute cultural goods of Iraqi origin to neighbouring countries, such as Türkiye, Iran, or Saudi Arabia, to avoid platforms flagging listings based on location. This makes Iraq an ideal test environment for refining NABU’s scraping tools, classification systems, and data analysis techniques.

During the first phase, the project prioritises collecting data from major surface web platforms commonly used by sellers operating in or around Iraq. These include Facebook groups, Telegram channels, local marketplace sites, and online forums. The team at Turaath Tech is gathering posts, images, metadata, seller information, and price indicators, then processing these through the NABU pipeline. The goal is to produce a working dataset that reveals how Iraqi artefacts are marketed, who the key actors are, and what patterns shape the trade.

This phase also includes the development and testing of risk indicators specific to Iraq. These reflect common traits of illicit objects, such as bulk coin lots from known hotspots, artefacts photographed with soil still attached, or posts referencing excavations near well-documented archaeological zones. By evaluating which indicators are most reliable in the Iraqi context, the team will establish a baseline methodology that can be adapted for other countries. Mapping connections among sellers of suspect objects can also highlight brokers who repeatedly appear across listings, identify cross-platform links, and detect patterns of reposting that suggest the movement of artefacts through multiple hands. The Iraq phase will therefore also allow the team to refine methods for identifying clusters of activity and distinguishing casual actors from organised networks.

While Iraq is the initial focus, the long-term plan is broader. Later phases of NABU will expand the same methodological framework to track the online sale of cultural goods from Sudan, Yemen, and Palestine. Each of these regions presents distinct challenges. In Yemen, ongoing conflict and economic instability have fuelled significant looting, with a growing online presence that mirrors some Iraqi patterns but also uses unique channels. Sudan’s political instability and large archaeological landscape create vulnerabilities that traffickers exploit, while Palestinian cultural goods circulate through complex networks shaped by movement restrictions and fragmented governance. As the project transitions into these later phases, tools refined in the Iraqi context will be adapted for additional sources, user requirements, and object types appropriate for each new country. The phased approach ensures that methodological weaknesses can be identified early and corrected before scaling up. It also allows for comparative analysis across countries, highlighting shared trafficking routes, overlapping networks, or platform behaviours that span the region.

Ultimately, the first phase in Iraq is designed to provide a solid operational model. By establishing effective scraping processes, classification systems, and analytical workflows, the project will be in a strong position to expand into Sudanese, Yemeni, and Palestinian contexts. The goal is to build a regional picture of online antiquities trafficking that can support more targeted interventions, policy responses, and heritage protection efforts in the years ahead.