Why forums?

Sociological Research Online

Illicit market exchanges in cybercriminal markets are plagued by problems of verifiability and enforceability: trust is one way to ensure reliable exchange. It is fragile and hard to establish. One way to do that is to use the administrative structure of the digital market to control transactions. This is common among a specific type of market – darknet cryptomarkets. These are sites for the sale of illicit goods and services, hosted anonymously using the Tor darknet. However, reliance by users on the technology and the market administrators exposes users to excessive risk. We examine a case of a market that rejects several key technological features now common in cryptomarkets but that is nonetheless reliable and robust. We apply a techno-social approach that looks at the way participants use and combine technologies with trust relationships. The study was designed to capture the interactional context of the illicit market. We aimed to examine both person-to-person interaction and ...

International Journal of Drug Policy, 2019

Introduction: This article analyses the factors of trust, logistics, and conflict on darknet markets (DNMs) and forums that are dedicated to selling illicit drugs. The analysis is conducted by utilising Elias (1978) theoretical concept of 'figuration,' which refers to the communicative constellations that eventuate between actors. Methods: A qualitative content analysis was applied to a sample collected from darknet forums related to darknet markets, independent forums with trade sections, and separate vendor shops. The main categories trust, logistics, and conflict are analysed, and certain subcategories are also explored, including operational security (opsec), vouching, and shilling. These terms are commonly used to describe the trading of drugs on the darknet. Results: Users of DNMs and forums discuss vendors, their products, and security-related features. Vouching and shilling are attempts to strengthen trust, logistics are used to secure the trade, while conflicts reflected in forum discussion threads often arise when logistics fail. Logistics may fail due to different reasons and actors involved in the associated figurations. The (anticipated) presence of actors in disguise is crucial for all of the main categories. Conclusion: Notions of trust, logistics, and conflict express attempts to cope with or circumvent risks imposed on users of DNMs by other users (e.g., scamming) or law enforcement (e.g., the interception of packages). Due to the illicit nature of the trade, these notions have to be constantly negotiated through digital communication.

Journal of Cybersecurity

Many activities related to cybercrime operations do not require much secrecy, such as developing websites or translating texts. This research provides indications that many users of a popular public internet marketing forum have connections to cybercrime. It does so by investigating the involvement in cybercrime of a population of users interested in internet marketing, both at a micro and macro scale. The research starts with a case study of three users confirmed to be involved in cybercrime and their use of the public forum. It provides a first glimpse that some business with cybercrime connections is being conducted in the clear. The study then pans out to investigate the forum population's ties with cybercrime by finding crossover users, that is, users from the public forum who also comment on cybercrime forums. The cybercrime forums on which they discuss are analyzed and the crossover users’ strength of participation is reported. Also, to assess if they represent a sub-grou...

AoIR Selected Papers of Internet Research – 2024, 2025

Global Crime, 2015

Research examining offender risk reduction strategies within illicit markets focus primarily on those operating in the real world for drugs and stolen goods. Few have considered the strategies that may be used by individuals in virtual illicit markets that are hidden from public view. This study addresses this gap through a grounded theory analysis of posts from 10 Russian and three English language web forums selling stolen data to engage in identity theft and fraud. The findings indicate that buyers employ multiple strategies to reduce their risk of loss from unreliable vendors, along with resources provided by forum administrators to manage relationships between participants. The implications of this study for law enforcement and offender decision-making research are also discussed.

Proceedings of SMSociety 20, 2020

This study aims to understand communicative activities of an illicit cyber-trade community on an anonymous social platform, Reddit. Based on the communication-as-constitutive of organization (CCO) perspective, the study identifies participants with different levels of engagement, and examines how their discursive engagement collectively reflects the ways in which illicit market users co-orient themselves to respond to a crisis event (i.e., market shutdown). The empirical case for this study is a subreddit channel dedicated to what was once the largest dark web market: r/AlphabayMarket. We examine two month period's posting activities until market was permanently shut down in July 2017. Our analysis comprises three parts. First, a social network analysis was conducted to identify key and non-key players in the community. Second, a structural topic modeling was computed to inductively infer topic clusters. Third, posts were manually reviewed to articulate the process of co-orientation manifest in the results of topic modeling. CCS CONCEPTS • Security and privacy → Human and societal aspects of security and privacy.

This paper presents the results of a qualitative study on discussions about two major law enforcement interventions against Dark Net Market (DNM) users extracted from relevant Reddit forums. We assess the impact of Operation Hyperion and Operation Bayonet (combined with the closure of the site Hansa) by analyzing posts and comments made by users of two Reddit forums created for the discussion of Dark Net Markets. The operations are compared in terms of the size of the discussions, the consequences recorded, and the opinions shared by forum users. We find that Operation Bayonet generated a higher number of discussions on Reddit, and from the qualitative analysis of such discussions it appears that this operation also had a greater impact on the DNM ecosystem.

Social Science Computer Review, 2020

Cybercriminals operate in obscurity to avoid detection of their illegal deeds. This fact makes studying them more difficult. Many cybercriminals meet in illicit online market places such as carding forums. The forums are often visible, but the actual transactions are carried out in private messages beyond view. However, there is no honor among thieves, and sometimes a carding forum server database will be hacked and leaked to the public. Existing research has been conducted on such leaked databases, but much of it is quantitative, rather than offering any qualitative interpretation into the nature of the forum user base. This research sought to analyze two such leaked carding forum databases by applying hierarchical clustering of 10,714 registered user accounts, grouping users based on 19 variables consisting of comment history style, site engagement activity, and explicit status markers. The results yielded 16 categories of users from four different domains composed of general consumers, location-based consumers, producers, and an "other" category. Following categorization, qualitative analyses were conducted to further shed insight into the nature of the two forums.

Drug and Alcohol Review, 2015

Journal of Economic Perspectives, 2009

This paper will focus on online crime, which has taken off as a serious industry since about 2004. Until then, much of the online nuisance came from amateur hackers who defaced websites and wrote malicious software in pursuit of bragging rights. But now criminal networks have emerged—online black markets in which the bad guys trade with each other, with criminals taking on specialized roles. Just as in Adam Smith's pin factory, specialization has led to impressive productivity gains, even though the subject is now bank card PINs rather than metal ones. Someone who can collect bank card and PIN data, electronic banking passwords, and the information needed to apply for credit in someone else's name can sell these data online to anonymous brokers. The brokers in turn sell the credentials to specialist cashiers who steal and then launder the money. We will examine the data on online crime; discuss the collective-action aspects of the problem; demonstrate how agile attackers shi...

American Journal of Sociology, 2021

How do illegal markets grow and develop? Using unique transactionlevel data on 7,205 market actors and 16,847 illegal drug exchanges on a "darknet" drug market, the authors evaluate the network processes that shape online illegal drug trade and promote the growth of online illegal drug markets. Contrary to past research on online markets, the authors argue that the high-risk context of illegal trade enhances market actors' reliance on social relationships that emerge endogenously from transaction networks. The findings reveal a highly structured trade network characterized by dense clustering and frequent recurrent drug exchange. Dynamic network models reveal that both embeddedness and closure in exchange structure increase the hazard rate of illegal drug trade, with effect sizes comparable to formal reputations. These effects are pronounced in the early stages of market development but wane once the market reaches maturity. These findings demonstrate the powerful, temporally contingent, influence of transaction networks on illegal trade in online markets and reveal how endogenous networks of economic relations can promote risky exchange under conditions of relative anonymity and illegality. Governments play a key role in market development. States define the type of products for sale as well as the rules governing exchange. Markets also rely on

Socio-Economic Review, 2021

Although economic sociology emphasizes the role of social networks for shaping economic action, little research has examined how network governance structures affect prices in the unregulated and high-risk social context of online criminal trade. We consider how overembeddedness-a state of excessive interconnectedness among market actors-arises from endogenous trade relations to shape prices in illegal online markets with aggregate consequences for short-term gross illegal revenue. Drawing on transaction-level data on 16 847 illegal drug transactions over 14 months of trade in a 'darknet' drug market, we assess how repeated exchanges and closure in buyervendor trade networks nonlinearly influence prices and short-term gross revenue from illegal drug trade. Using a series of panel models, we find that increases in closure and repeated exchange raise prices until a threshold is reached upon which prices and gross monthly revenue begin to decline as networks become overembedded. Findings provide insight into the network determinants of prices and gross monthly revenue in illegal online drug trade and illustrate how network structure shapes prices in criminal markets, even in anonymous trade environments.

OVER THE PAST FEW YEARS, RESEARCHERS HAVE DESCRIBED THE CONSTANT growth of a complex virtual criminal underworld in which personal and financial data is bought and sold (Holt and Lampke 2010; Franklin et al. 2007; Thomas and Martin 2006). Hundreds if not thousands of vendors compete at any point in time to sell Visa, MasterCard and American Express numbers, very often at a low rate. Yet, the economic impact of these markets can be measured in billions of dollars (Anderson et al. 2013). This chapter discusses how law enforcement agencies have targeted and investigated this criminal underground. While a traditional investigate-then-arrest methodology has been the method of choice of these agencies, researchers (Mell 2012; Motoyama et al. 2011) have argued that law enforcement agencies should move to a disruption model in order to increase their efficiency and increase the impact of the operations. This study seeks to understand the formation of trust of ties and business ties to enhance our ability to launch disruption attack on the criminal underground. We find that even small disruption operations may have an important impact on the activity of the offenders involved in the theft and resale of stolen financial information.

This study examines the signals of trust in stolen data advertisements by analysing the structural and situational factors that influence the type of feedback sellers receive. Specifically, this article explores the factors associated with positive and negative buyer feedback from the purchase of stolen credit card data in a series of advertisements from a sample of Russian and English language forums where individuals buy and sell personal information. The results of zero-inflated Poisson regression models suggest that the sellers may influence their likelihood of receiving feedback by specifying the type of payment mechanism, choosing the advertisement language and selecting the type of market they operate within. The implications of this study for our understanding of online illicit markets, criminological theory and policy-making will be explored in depth.

Pastrana, S., Thomas, D. R., Hutchings, A., & Clayton, R. (2018). CrimeBB: Enabling cybercrime research on underground forums at scale. Lyon: ACM International World Wide Web (WWW) Conference., 2018

Underground forums allow criminals to interact, exchange knowledge, and trade in products and services. They also provide a pathway into cybercrime, tempting the curious to join those already motivated to obtain easy money. Analysing these forums enables us to better understand the behaviours of offenders and pathways into crime. Prior research has been valuable, but limited by a reliance on datasets that are incomplete or outdated. More complete data, going back many years, allows for comprehensive research into the evolution of forums and their users. We describe CrimeBot, a crawler designed around the particular challenges of capturing data from underground forums. CrimeBot is used to update and maintain CrimeBB, a dataset of more than 48m posts made from 1m accounts in 4 different operational forums over a decade. This dataset presents a new opportunity for large-scale and longitudinal analysis using up-to-date information. We illustrate the potential by presenting a case study using CrimeBB, which analyses which activities lead new actors into engagement with cybercrime. CrimeBB is available to other academic researchers under a legal agreement, designed to prevent misuse and provide safeguards for ethical research.