Jump to content

Underground forum

Add links
From Wikipedia, the free encyclopedia
Underground Forum structure hierarchy

Underground forums (not to be confused with underground marketplaces) are online discussion communities that exist on both the clear web (such as HackForums, OGU) or in the dark web (such as dread, DarkForums, and historically RaidForums & Breached) accessible only through Tor or i2p, in which participants exchange information, tools, and services related to cybercrime and other illicit or semi-licit online activity. Topics discussed on underground forums range from malware development and the brokering of stolen data to fraud techniques, account compromise, forged identity documents, and various forms of digital abuse;[1] some forums also overlap with dark web marketplaces trading in physical contraband such as drugs and weapons. While some underground forums require invitation, vetting, or paid membership to access certain sections, many operate as open or semi-open communities that anyone willing to register can access.[1]

Underground forums are studied by computer security researchers, criminologists, and social scientists as a window into the organization, culture, and economics of cybercrime communities,[2][3] and as a potential source of early cyber threat intelligence (CTI). Participants often discuss new techniques and vulnerabilities before they are publicly disclosed, and forum discussion has been found to precede formal security reporting for a majority of tracked threat entities.[4]

History

[edit]

Underground forums trace their origins to bulletin board systems (BBS) and early internet relay chat (IRC) communities of the 1980s and 1990s, where hobbyist hackers and "phreakers" exchanged techniques and shared access to systems.[5] As the web matured during the 2000s, these communities moved to dedicated forum software and grew into large, persistent platforms with thousands to hundreds of thousands of registered members. Some forums, such as HackForums, have operated continuously for well over a decade and contain tens of millions of posts. A foundational empirical study of six such forums found that, unlike conventional online social networks, the pattern of communication among members did not simply encode pre-existing social relationships but instead captured dynamic trust relationships forged between mutually distrustful, pseudonymous parties.[2] A related study modeled the social-network structure connecting individual hackers, finding that a small number of well-connected members disproportionately shape the flow of knowledge and reputation through the community.[6]

Several members of such forums have been prosecuted for cybercrime offences, but some individuals associated with these communities have also gone on to legitimate security careers. For example, the security researcher Marcus Hutchins, later known for helping to halt the spread of the WannaCry ransomware attack in 2017, took part in underground forums as a teenager before starting his professional career in cybersecurity.[7]

[8][9]

Underground forums timeline


Structure and organization

[edit]

Underground forums are typically organized hierarchically. A site contains multiple boards (topic categories); each board contains multiple threads (discussion topics); and each thread contains a sequence of posts (individual messages) ordered by time, with the topic of a thread generally set by its first post.[1] Criminologists have characterized such forums as offender convergence settings, where market, social, and learning functions overlap within a single community.[3]

Many forums run reputation systems, escrow services, or vetting processes meant to reduce fraud between members engaged in illicit trade, since participants cannot fall back on legal recourse to resolve disputes. One influential analysis frames these mechanisms through the lens of common-pool resource governance, arguing that a forum's long-term sustainability depends on collective norms of exclusion and enforcement among its members.[10] Some forums maintain dedicated sections for processing transaction "contracts" between buyers and sellers, recording details such as the goods or services exchanged, the payment terms, and the reputation ratings of the parties involved.[11] Despite these mechanisms, qualitative case studies of individual forums have found that trust often remains hard to establish even among vetted members, with interactions frequently marked by suspicion and accusations of fraud.[12]

Underground forums vary considerably in scope and specialization. Some are broad, general-purpose cybercrime communities covering many topics; others focus narrowly on niches such as account compromise, search engine optimization (SEO) fraud, video game cheating, passive-income schemes, or romance scams (sometimes called "e-whoring"), a niche examined in a dedicated study of the practice on English-language forums.[13] Others are invitation-only and closely vetted. Darkode, described by a U.S. federal prosecutor as one of the most sophisticated English-speaking forums for criminal computer hackers, required prospective members to be nominated and vetted by existing members before admission, and was dismantled by the FBI in a coordinated international operation in July 2015.[12] Major forums operate in numerous languages, including English, Russian, German, Arabic, and Spanish, with linguistic and cultural conventions differing across communities.[1] Researchers have used topic-modelling methods to study these multilingual settings, including an analysis of a single Russian-English invite-only forum that examined whether its language divide splits members into distinct sub-communities.[14]

A particularly prominent category is data leak brokerage: forums dedicated to trading stolen databases obtained through breaches, exposing material such as account credentials, payment card numbers, and other personally identifiable information. This activity was documented in some of the earliest empirical studies of underground trade.[15] A crime-script analysis of thirteen English- and Russian-language stolen-data forums broke the underlying market into discrete stages, from the acquisition or manufacture of stolen data through advertisement, sale, and the subsequent laundering of proceeds.[16] Several of the largest and most heavily disrupted forums in the underground ecosystem, including RaidForums, BreachForums, and LeakBase, have specialized primarily in this activity, and have often become the first point of public exposure for a major corporate data breach before the affected organization itself discloses the incident.[17][18]

Other recurring categories of forum content include the sale or creation of forged identity documents, such as fake driver's licenses and passports, which are often advertised alongside related fraud services such as synthetic-identity kits. Weapons and illegal drugs are also discussed and advertised. The actual transactional trade in physical contraband such as drugs and firearms, however, is more commonly associated with dedicated dark web marketplaces, such as AlphaBay, than with discussion-oriented forums. The two types of site remain closely related: they frequently share infrastructure or escrow systems, and are sometimes hosted on the same domain or used interchangeably by participants.[19] Dread, a Reddit-style Tor-based forum, is a notable example of a discussion forum that sits at this overlap, hosting drug-related discussion, vendor reviews, and marketplace announcements alongside more conventional hacking and cybercrime content.[20]

Carding forums, a subtype dedicated to payment-card fraud, have also been studied comparatively; an analysis of five such forums found substantial variation between them in accessibility, membership growth, and the concentration of trading activity among a small number of highly active sellers.[21]

Anonymity and pseudonymity

[edit]
Onion routing, the technique underlying Tor, wraps traffic in successive encrypted layers so that no single relay knows both the origin and destination of a connection.

Anonymity is central to the operation of most underground forums, since the activity they host is frequently illegal. Forums hosted as Tor onion services rely on Tor's onion routing to hide both the physical location of the server and the identity of visitors connecting to it. Forums on the clear web instead depend mainly on member pseudonymity, because the server's own location and operator are usually traceable through standard infrastructure-identification techniques unless additional measures, such as bulletproof hosting, are used. Participants typically interact under persistent pseudonymous handles rather than real identities. Many forums encourage or require the use of PGP-signed messages, both to verify a user's identity across mirrors or address changes (see migration) and to encrypt sensitive communications, such as the details of a transaction, from other forum members or potential eavesdroppers.[11] Because pseudonyms can be reused across platforms, researchers have also developed stylometric techniques to link accounts belonging to the same individual across different forums, which raises further de-anonymization risks for participants who reuse writing habits or handles.[22]

Financial transactions on underground forums are conducted through cryptocurrency, historically Bitcoin, because of its pseudonymous nature and ease of use. However, the increasing sophistication of blockchain analysis used by law enforcement and commercial firms to de-anonymize Bitcoin transactions has driven a partial shift toward privacy-focused cryptocurrencies such as Monero on forums and marketplaces handling higher-value or higher-risk transactions.[11]

Notable examples

[edit]

A number of underground forums have achieved particular prominence, whether through their size, their longevity, or their role in major data breaches and law-enforcement investigations.

Hack Forums is one of the longest-running English-language hacking communities, having operated since 2007 and accumulated tens of millions of posts.[1]

RaidForums operated from 2015 to 2022 as one of the largest forums for trading stolen databases, with more than 500,000 registered users at the time of its disruption. The forum was seized by the FBI and Europol in April 2022 in a coordinated operation codenamed "Tourniquet", and its administrator, Diogo Santos Coelho, was arrested and charged with conspiracy, access device fraud, and aggravated identity theft.[23][24]

The RaidForums.com seizure notice, posted by U.S. and partner law-enforcement agencies in April 2022.

BreachForums emerged in March 2022 as a successor to RaidForums and became one of the leading English-language platforms for data-breach discussion and stolen-data trading. The forum has been disrupted by law enforcement several times, including the arrest of an administrator in March 2023, and was cited by the U.S. Department of Justice as a predecessor cybercrime marketplace in connection with the later seizure of the forum LeakBase.[17]

Darkode operated as an invitation-only, closely vetted forum until it was dismantled in a coordinated international law-enforcement operation in July 2015; researchers who studied its leaked database found that its rigorous, introduction-based admission process did not eliminate persistent distrust and fraud accusations among members.[12]

XSS (formerly DaMaGeLaB), active since 2013 and one of the two central Russian-language forums alongside Exploit, dealt in exploit sales, malware, access-broker listings, and ransomware-related services, and ran an associated encrypted Jabber server used by cybercriminals to communicate. On 22 July 2025, the forum's suspected administrator was arrested in Kyiv, Ukraine, in a joint operation led by the French police and the Paris prosecutor's office together with Ukrainian authorities and Europol, following a four-year investigation. Europol said the suspect had been active in cybercrime for nearly two decades and had made more than €7 million, mainly from advertising and facilitation fees, while also acting as a trusted third party who arbitrated disputes and guaranteed transactions between members.[25][26]

Altenen is a forum specializing in financial crime, particularly "carding" (credit-card fraud), trading tools and guides for bypassing payment security alongside stolen card and identity data, and has been used as a case-study forum in academic carding-market research.[21] In 2018, its operator, identified in press reporting as Hilmi Git, a resident of Hebron in the West Bank, was arrested by Israeli police and indicted on charges connected to running the site and a related forum, Alboraaq.com, together said to have more than 1.3 million users; Israeli authorities estimated that the sites had facilitated fraud involving more than 20,000 stolen cards and around $31 million in related money laundering.[27] The forum has continued to operate under successor domains since the arrest.[28]

Nulled and Cracked, two large general-purpose forums trading in stolen credentials, cracked software, hacking tools, and access to compromised accounts, were seized in January 2025 as part of a coordinated international operation, "Operation Talent", led by German federal police (the Bundeskriminalamt) with Europol and participation from the FBI and law-enforcement agencies in Australia, France, Greece, Italy, Romania, and Spain. The action seized twelve domains associated with the two forums along with related infrastructure, including the payment processor Sellix and the hosting provider StarkRDP, and led to the arrest of two suspects, including a Nulled administrator, Lucas Sohn, who was charged in the United States with access device fraud and identity fraud offences.[29][30]

Other forums documented in security-industry reporting include Dread (a Reddit-style Tor-based discussion forum that emerged following repeated takedowns of darknet markets) and DarkForums, which grew rapidly during 2025 by absorbing much of the user base displaced by the BreachForums and Nulled/Cracked disruptions.[20]

[edit]

Whether interacting with an underground forum is legal depends heavily on the jurisdiction and on the specific nature of the interaction, rather than on the existence of the forum itself. In the United States and most other Western democracies, merely accessing the Tor network or browsing a publicly viewable underground forum is generally not, by itself, a criminal act. Legal analyses commonly draw a distinction between passive access to forum content and active participation in illegal transactions, such as purchasing stolen data or hiring services, which can expose a visitor to prosecution under statutes such as the U.S. Computer Fraud and Abuse Act (CFAA).[31] The applicable statutes vary by the nature of the underlying activity rather than by the forum itself: trading in stolen data, credentials, or hacking tools is typically prosecuted under computer-crime statutes such as the CFAA;[31] the trade in physical contraband documented on some forums and adjoining marketplaces (for example, illegal drugs and firearms) instead falls under separate, often more severe, narcotics-trafficking and firearms-trafficking statutes; and trade in forged identity documents falls under document-fraud and identity-theft statutes. A single forum, or even a single transaction thread, can therefore implicate several distinct bodies of law at once. Certain categories of content remain illegal to access regardless of jurisdiction or framing, most notably child sexual abuse material, which is criminalized in the United States under 18 U.S.C. §§ 2252 and 2252A;[32] the statute defines the offense to include not only possession but knowingly accessing such material with intent to view it, and courts have applied this provision to material found only in a browser's automatically generated cache, without evidence that the defendant deliberately saved it.[33]

The picture differs substantially in countries that restrict anonymity-enhancing technologies as a matter of policy. Russia and China have each taken measures to block or restrict the Tor network at the national level. Russia's communications regulator, Roskomnadzor, began blocking direct connections to Tor in December 2021,[34] and China's national internet filtering system (the Great Firewall) has used deep packet inspection to dynamically detect and block even unlisted "bridge" relays since late 2011.[35] Iran has similarly moved to block direct Tor connections, particularly during periods of political unrest, though users in all three countries can often still connect using bridges and pluggable transports designed to evade this kind of detection.[36] In these jurisdictions, the mere act of circumventing such restrictions to reach Tor, independent of what is subsequently viewed or done, can itself carry legal risk.[37][38]

Migration, disruption, and resilience

[edit]

Underground forums, particularly those reached through Tor, face a number of recurring threats to their availability and continuity, which shape both how they operate and how they are studied.

Onion address changes

[edit]

Onion services do not have stable, human-readable domain names by design. When a forum's onion address is compromised, seized, or voluntarily rotated for security reasons, administrators must redistribute a new address to their user base, typically through announcements on associated clear-web channels, social media, or cryptographically signed messages (for example, PGP-signed posts) that let members verify the new address is genuine rather than a phishing clone. This redistribution process is itself a point of vulnerability, since impersonators frequently set up fraudulent mirror sites at similar-looking addresses to harvest credentials from users trying to relocate to a forum's "official" new address.[39]

Law enforcement takedowns

[edit]
The FBI seizure notice that replaced the Silk Road marketplace homepage following its 2013 takedown.

International law-enforcement operations have disrupted several major underground forums in recent years, typically through coordinated, multi-country actions that seize forum domains and backend infrastructure, replace the original website with a seizure notice, and frequently result in arrests of forum administrators. Notable examples include the 2015 dismantlement of Darkode,[12] the 2022 seizure of RaidForums (Operation Tourniquet, led by the FBI, the UK's National Crime Agency, and Europol),[23] the 2023 arrest of a BreachForums administrator, the January 2025 seizure of Nulled and Cracked in Operation Talent,[29] the July 2025 arrest of the suspected XSS administrator,[25] and the takedown of the forum LeakBase in a 14-country operation coordinated by Europol that captured the forum's full database, including private messages and member IP logs.[17]

Such takedowns rarely eliminate the underlying community permanently; displaced members typically migrate to successor or rival forums within days to weeks,[20] a recurring pattern that security researchers have likened to a game of "whack-a-mole".[40] This is one reason researchers caution against treating any single forum as a stable, long-term monitoring target, and recommend tracking specific threat actors and their migration patterns across multiple platforms instead.[4]

Distributed denial-of-service attacks

[edit]
Distributed denial-of-service attack

Underground forums are frequent targets of distributed denial-of-service (DDoS) attacks, originating from rival forums, disgruntled former members, or other threat actors seeking to disrupt a competitor. Such attacks can force forums offline for extended periods. In at least one documented case, downtime caused by a combination of technical outages was initially misinterpreted by the community as evidence of a law-enforcement seizure, illustrating the ambiguity that unexplained downtime creates within these communities.[24]

Migration to private messaging platforms

[edit]

Some research suggests that the cybercrime community's reliance on traditional web-based forums is partially migrating to private channels on platforms such as Telegram. A 2024 study analyzing two decades of forum and security-report data found that the lead-time advantage of underground forums as an early-warning CTI source diminished after around 2012, a trend the authors attributed in part to threat actors becoming aware that forums were being monitored by researchers and law enforcement, and to a partial migration of sensitive communication to more private channels.[4] The authors suggested that the CTI research community should expand monitoring to these additional emerging platforms to compensate for the shift, though the extent of this migration, and how much of it reflects a genuine relocation of activity rather than the use of multiple parallel channels alongside continued forum use, remains an open question requiring further study.[4] A separate crime-script study of illicit data markets that have emerged on Telegram itself found that these channels replicate much of the escrow, vendor-reputation, and dispute-handling functionality of traditional underground forums, suggesting that migration to private platforms need not entail a loss of market structure.[41] Separately, researchers studying private (non-public) forum interactions have noted that public posts alone can understate the true volume and nature of underground trade, since a substantial share of transactions are negotiated through private messages that passive, public-only data collection cannot see.[42]

Content and characteristics

[edit]

Content on underground forums has several characteristics that distinguish it from more formal or curated text:

  • Informal language: posts often contain slang, abbreviations, leetspeak, and grammatical irregularities.[1]
  • Deliberate obfuscation: participants may intentionally misspell or alter sensitive details, such as indicators of compromise, to evade moderation or automated monitoring.[43]
  • Mixed relevance: only a fraction of posts on any given forum concern serious criminal activity; much of the content is off-topic discussion or low-value posts, a pattern confirmed by recent large-scale content-labelling studies of millions of forum posts.[44]
  • Ephemerality: forums are frequently seized by law enforcement, voluntarily shut down, or migrate to new domains, which complicates long-term study.[40]

Role in cyber threat intelligence

[edit]

Because participants on underground forums frequently discuss new exploits, malware, and attack techniques before such activity is documented in formal security reports, these forums are considered a potentially valuable early-warning source for security researchers and threat intelligence teams. Research analyzing two decades of forum and security-report data found that discussions on hacker forums preceded official security reporting for a majority of identified threat entities, particularly in earlier years, though this lead-time advantage diminished after around 2012 as forum activity faced increased law-enforcement and researcher scrutiny and threat actors moved some communication to other platforms, such as Telegram.[4] A subsequent 2025 study proposed dynamic clustering methods to rank security events extracted from hacker-forum discussions, aiming to further reduce the manual effort required to surface actionable intelligence from high-volume forum data.[45]

Extraction methods

[edit]

Extracting usable intelligence from forum content is technically challenging because of its volume, noise, and adversarial nature, which has motivated research into automated extraction methods based on natural language processing (NLP).

Named entity recognition. Named entity recognition (NER) models are commonly used to identify security-relevant entities in forum posts, such as malware names, vulnerability identifiers (for example, CVE numbers), threat actor aliases, and indicators of compromise. Early approaches relied on rule-based methods and security-specific dictionaries; more recent work applies machine learning and transformer-based models, such as BERT, fine-tuned on cybersecurity text to better handle domain jargon.[4] Related work has also used topic modeling to automatically surface discussion of specific software vulnerabilities within forum threads, without relying on predefined entity dictionaries.[46]

Classification and filtering. Because most forum content is not security-relevant, classification models are commonly used to filter posts or threads before more resource-intensive extraction steps are applied. One early framework in this vein catalogued the technical and social "assets" (tools, skills, and services) that hackers advertise on underground forums, as a basis for downstream filtering and analysis.[47] More recent work has applied large language models to label or summarize forum content at scale, for example using a system built on a GPT model to extract structured threat-intelligence variables from forum conversations with only natural-language instructions.[48]

Active elicitation. The methods described above are predominantly passive: they analyze content that forum participants have already posted, without the researcher or analyst interacting with the community. A separate and emerging line of work instead relies on active data collection, in which a researcher or analyst engages directly with forum members, posing questions, requesting samples, or initiating transactions to elicit intelligence that would not otherwise be volunteered; recent work has also explored deploying large language model agents to engage cybercriminals directly in chat-based settings.[49] Such engagement is typically carried out through a fictitious online persona, sometimes called a "sock puppet" account, built up over time to gain the trust, reputation, or forum-specific privileges (such as invite codes to gated sub-sections) needed to reach restricted material. Active elicitation raises additional methodological and ethical considerations beyond those of passive collection: maintaining a credible persona over an extended period can blur the line between observation and participation in the community being studied, and the broader social-science literature on covert and undercover research has examined the legal risk, psychological strain, and ethical limits this can involve.[50][51] Frameworks developed specifically for darknet and underground-forum research, such as the DICE-E framework, have proposed structured guidance for the identification, collection, and evaluation of data from these environments while accounting for these ethical dimensions.[52] Researchers conducting active or sustained passive collection also face the practical risk of detection, since experienced administrators and members are often aware that their communities are monitored and may try to identify and exclude researcher or law-enforcement accounts, which has motivated work on stealthy, low-footprint collection techniques.[53]

Cross-referencing with formal sources. Several studies have compared the timing of entity mentions in forum discussions against their appearance in subsequently published security reports or news articles, to quantify the extent to which forums function as an early-warning signal.[4]

Applications

[edit]

Threat intelligence derived from underground forums has been applied to several use cases, including early identification of newly disclosed exploits or attack techniques, profiling of threat actors' roles and activity patterns, tracking of discussions referencing specific software vulnerabilities ahead of formal disclosure, and supply-chain analysis tracing how cybercrime tools and stolen data move between forum participants.[1]

Limitations

[edit]

The proportion of genuinely actionable intelligence within forum content is typically low relative to the overall volume of posts, which requires substantial filtering.[44] Deliberate obfuscation by threat actors aware of monitoring can reduce extraction reliability, and the diminishing early-warning advantage of forums since the early 2010s, attributed to increased scrutiny and the migration of some threat-actor communication to other platforms, has led researchers to suggest expanding CTI monitoring to additional emerging platforms.[4] Passive, public-post-only data collection can also understate genuine trading activity, since much of it occurs through private messages that standard scraping methods do not capture.[42]

Data collection and ethics

[edit]

Researchers studying underground forums generally emphasize passive, read-only data collection, institutional ethical review, and data-sharing agreements that restrict redistribution, given the potential for collected data to include personal information, evidence of ongoing criminal activity, or content that could cause harm if mishandled.[1]

To reduce the need for individual research groups to scrape forums independently, some institutions maintain curated forum datasets under controlled access. A well-known example is CrimeBB, maintained by the Cambridge Cybercrime Centre at the University of Cambridge, which aggregates data from dozens of underground forums across multiple languages, comprising tens of millions of posts collected over more than a decade.[1] Access to CrimeBB and similar datasets is typically granted to academic researchers only after they sign an agreement intended to limit misuse. Dedicated tools, such as the POSTCOG platform, have also been developed to let non-technical researchers search and analyze such datasets without requiring direct programming access.[54]

See also

[edit]

References

[edit]
  1. 1 2 3 4 5 6 7 8 9 Pastrana, Sergio; Thomas, Daniel R.; Hutchings, Alice; Clayton, Richard (2018). CrimeBB: Enabling Cybercrime Research on Underground Forums at Scale. Proceedings of the 2018 World Wide Web Conference (WWW '18). doi:10.1145/3178876.3186178.
  2. 1 2 Motoyama, Marti; McCoy, Damon; Levchenko, Kirill; Savage, Stefan; Voelker, Geoffrey M. (2011). An Analysis of Underground Forums. Proceedings of the 2011 ACM SIGCOMM Internet Measurement Conference (IMC). pp. 71–80. doi:10.1145/2068816.2068824.
  3. 1 2 Soudijn, Melvin R. J.; Zegers, Birgit C. H. T. (2012). "Cybercrime and virtual offender convergence settings". Trends in Organized Crime. 15 (2): 111–129. doi:10.1007/s12117-012-9159-z.
  4. 1 2 3 4 5 6 7 8 Paladini, Tommaso; Ferro, Lara; Polino, Mario; Zanero, Stefano; Carminati, Michele (2024). You Might Have Known It Earlier: Analyzing the Role of Underground Forums in Threat Intelligence. 27th International Symposium on Research in Attacks, Intrusions and Defenses (RAID). pp. 368–383. doi:10.1145/3678890.3678930.
  5. ↑ Pastrana, Sergio; Hutchings, Alice; Caines, Andrew; Buttery, Paula (2018). Characterizing Eve: Analysing Cybercrime Actors in a Large Underground Forum. Research in Attacks, Intrusions, and Defenses (RAID). doi:10.1007/978-3-030-00470-5_10.
  6. ↑ Décary-Hétu, David; Dupont, Benoît (2012). "The social network of hackers". Global Crime. 13 (3): 160–175. doi:10.1080/17440572.2012.702523.
  7. ↑ Greenberg, Andy (12 May 2020). "The Confessions of Marcus Hutchins, the Hacker Who Saved the Internet". Wired. Retrieved 2 July 2026.
  8. ↑ Christin, Nicolas (2013). Traveling the Silk Road: A Measurement Analysis of a Large Anonymous Online Marketplace. Proceedings of the 22nd International Conference on World Wide Web (WWW). doi:10.1145/2488388.2488408.
  9. ↑ "Ross Ulbricht, the Creator and Owner of the Silk Road Website, Found Guilty in Manhattan Federal Court on All Counts" (Press release). Federal Bureau of Investigation, New York Field Office. February 5, 2015.
  10. ↑ Afroz, Sadia; Garg, Vaibhav; McCoy, Damon; Greenstadt, Rachel (2013). Honor Among Thieves: A Common's Analysis of Cybercrime Economies. 2013 APWG eCrime Researchers Summit. pp. 1–11. doi:10.1109/eCRS.2013.6805778.
  11. 1 2 3 "Cambridge Cybercrime Centre: Description of available datasets". Cambridge Cybercrime Centre, University of Cambridge.
  12. 1 2 3 4 Dupont, Benoît; Côté, Anne-Marie; Boutin, Jean-Ian; Fernandez, José (2017). "Darkode: Recruitment Patterns and Transactional Features of "the Most Dangerous Cybercrime Forum in the World"". American Behavioral Scientist. 61 (11): 1219–1243. doi:10.1177/0002764217734263.
  13. ↑ Hutchings, Alice; Pastrana, Sergio (2019). Understanding eWhoring. 2019 IEEE European Symposium on Security and Privacy (EuroS&P). pp. 201–214. doi:10.1109/EuroSP.2019.00024.
  14. ↑ Mischinger, Mariella; Ghafouri, Vahid; Pastrana, Sergio; Suarez-Tangil, Guillermo (2026). "Investigating and Comparing Discussion Topics in Multilingual Underground Forums". arXiv:2603.21849 [cs.SI].
  15. ↑ Holt, Thomas J.; Lampke, Eric (2010). "Exploring stolen data markets online: products and market forces". Criminal Justice Studies. 23 (1): 33–50. doi:10.1080/14786011003634415.
  16. ↑ Hutchings, Alice; Holt, Thomas J. (2015). "A Crime Script Analysis of the Online Stolen Data Market". The British Journal of Criminology. 55 (3): 596–614. doi:10.1093/bjc/azu106.
  17. 1 2 3 "United States Leads Dismantlement of One of the World's Largest Hacker Forums" (Press release). U.S. Department of Justice, Office of Public Affairs. March 4, 2026.
  18. ↑ "Major data leak forum dismantled in global action against cybercrime forum". Europol.
  19. ↑ "Criminal network distributing fake dark web documents busted". Europol. March 6, 2023.
  20. 1 2 3 "Top 8 Deep Web and Dark Web Forums". KELA Cyber Threat Intelligence.
  21. 1 2 Haslebacher, Andreas; Onaolapo, Jeremiah; Stringhini, Gianluca (2017). All Your Cards Are Belong To Us: Understanding Online Carding Forums. 2016 APWG Symposium on Electronic Crime Research (eCrime). arXiv:1607.00117.
  22. ↑ Afroz, Sadia; Islam Caliskan, Aylin; Stolerman, Ariel; Greenstadt, Rachel; McCoy, Damon (2014). Doppelgänger Finder: Taking Stylometry to the Underground. 2014 IEEE Symposium on Security and Privacy. pp. 212–226. doi:10.1109/SP.2014.21.
  23. 1 2 Krebs, Brian (April 12, 2022). "RaidForums Gets Raided, Alleged Admin Arrested". Krebs on Security.
  24. 1 2 "RaidForums hacking forum seized by police, owner arrested". BleepingComputer. April 12, 2022.
  25. 1 2 "Key figure behind major Russian-speaking cybercrime forum targeted in Ukraine" (Press release). Europol. July 23, 2025.
  26. ↑ Ropek, Lucas (July 23, 2025). "Authorities in Ukraine nab alleged admin of Russian-language cybercrime forum". CyberScoop.
  27. ↑ "Hebron Resident Indicted for Multi-Million Bitcoin and Credit Card Fraud". CTech (Calcalist). May 22, 2018.
  28. ↑ "Major Carding Site Replacement: How Altenen.nz Rose From the Ashes of Altenen.com". Rapid7.
  29. 1 2 "Cracked and Nulled Marketplaces Disrupted in International Cyber Operation" (Press release). U.S. Department of Justice, Office of Public Affairs. January 30, 2025.
  30. ↑ Gatlan, Sergiu (January 30, 2025). "Police seizes Cracked and Nulled hacking forum servers, arrests suspects". BleepingComputer.
  31. 1 2 "18 U.S. Code § 1030 – Fraud and related activity in connection with computers". Legal Information Institute, Cornell Law School.
  32. ↑ "18 U.S. Code § 2252A – Certain activities relating to material constituting or containing child pornography". Legal Information Institute, Cornell Law School.
  33. ↑ United States v. Romm, 455 F.3d (9th Cir. 2006).
  34. ↑ "Responding to Tor censorship in Russia". The Tor Project. December 2021.
  35. ↑ Winter, Philipp; Lindskog, Stefan (2012). How the Great Firewall of China is Blocking Tor. 2nd USENIX Workshop on Free and Open Communications on the Internet (FOCI).
  36. ↑ "Staying ahead of censors in 2025: What we've learned from fighting censorship in Iran and Russia". The Tor Project.
  37. ↑ "Responding to Tor censorship in Russia". The Tor Project. December 2021.
  38. ↑ "Staying ahead of censors in 2025: What we've learned from fighting censorship in Iran and Russia". The Tor Project.
  39. ↑ Barr-Smith, Frederick; Wright, Joss (2020). Phishing With A Darknet: Imitation of Onion Services (PDF). 2020 APWG Symposium on Electronic Crime Research (eCrime).
  40. 1 2 Décary-Hétu, David; Giommoni, Luca (2017). "Do police crackdowns disrupt drug cryptomarkets? A longitudinal analysis of the effects of Operation Onymous". Crime, Law and Social Change. 67 (1): 55–75. doi:10.1007/s10611-016-9644-4.
  41. ↑ Garkava, Taisiia; Moneva, Asier; Leukfeldt, E. Rutger (2024). "Stolen data markets on Telegram: a crime script analysis and situational crime prevention measures". Trends in Organized Crime. doi:10.1007/s12117-024-09532-6.
  42. 1 2 Overdorf, Rebekah; Troncoso, Carmela; Greenstadt, Rachel; McCoy, Damon (2018). "Under the Underground: Predicting Private Interactions in Underground Forums". arXiv:1805.04494 [cs.CR].
  43. ↑ Seyler, Dominic; Liu, Wei; Wang, XiaoFeng; Zhai, ChengXiang (2021). "Towards Dark Jargon Interpretation in Underground Forums". Advances in Information Retrieval (ECIR 2021). arXiv:2011.03011. doi:10.1007/978-3-030-72240-1_40.
  44. 1 2 Hoheisel, Raphael; Meurs, Tom; Wientjes, Jai; Junger, Marianne; Abhishta, Abhishta; Paquet-Clouston, Masarah (2026). "Assessing Crime Disclosure Patterns in a Large-Scale Cybercrime Forum". arXiv:2603.01624 [cs.CY].
  45. ↑ Ech-Chammakhy, Younes; Motii, Amine; Rabii, Abdellah; Chbili, Jaafar (2025). EventHunter: Dynamic Clustering and Ranking of Security Events from Hacker Forum Discussions. 28th International Symposium on Research in Attacks, Intrusions and Defenses (RAID). pp. 552–565. doi:10.1109/RAID67961.2025.00044.
  46. ↑ Moreno-Vera, Felipe (2023). Inferring Discussion Topics about Exploitation of Vulnerabilities from Underground Hacking Forums. 2023 14th International Conference on Information and Communication Technology Convergence (ICTC). pp. 816–821. arXiv:2405.04561. doi:10.1109/ICTC58733.2023.10393244.
  47. ↑ Samtani, Sagar; Chinn, Ryan; Chen, Hsinchun (2015). Exploring Hacker Assets in Underground Forums. IEEE International Conference on Intelligence and Security Informatics (ISI). pp. 31–36. doi:10.1109/ISI.2015.7165935.
  48. ↑ Clairoux-Trépanier, Vanessa; Beauchamp, Isa-May; Ruellan, Estelle; Paquet-Clouston, Masarah; Paquette, Serge-Olivier; Clay, Eric (2024). "The Use of Large Language Models (LLM) for Cyber Threat Intelligence (CTI) in Cybercrime Forums". arXiv:2408.03354 [cs.CR].
  49. ↑ Yao, Yifan; Wang, Baojuan; Duan, Jinhao; Xu, Kaidi; Guo, ChuanKai; Sun, Zhibo Eric; Zhang, Yue (2025). "The Imitation Game: Using Large Language Models as Chatbots to Combat Chat-Based Cybercrimes". arXiv:2512.21371 [cs.CR].
  50. ↑ Calvey, David (2008). "The Art and Politics of Covert Research: Doing 'Situated Ethics' in the Field". Sociology. 42 (5): 905–918. doi:10.1177/0038038508094569.
  51. ↑ Calvey, David (2019). "Covert Research". In Atkinson, Paul; Delamont, Sara; Cernat, Alexandru; Sakshaug, Joseph W.; Williams, Richard A. (eds.). SAGE Research Methods Foundations. London: SAGE Publications Ltd. doi:10.4135/9781526421036758689.
  52. ↑ Benjamin, Victor; Valacich, Joseph S.; Chen, Hsinchun (2019). "DICE-E: A Framework for Conducting Darknet Identification, Collection, Evaluation with Ethics". MIS Quarterly. 43 (1). doi:10.25300/MISQ/2019/13808.
  53. ↑ Campobasso, Michele; Burda, Pavlo; Allodi, Luca (2019). CARONTE: Crawling Adversarial Resources Over Non-Trusted, High-Profile Environments. 2019 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW). arXiv:2009.08148. doi:10.1109/EuroSPW.2019.00055.
  54. ↑ Pete, Ildiko; et al. (2022). POSTCOG: A Tool for Interdisciplinary Research into Underground Forums at Scale. pp. 93–104. doi:10.1109/EuroSPW55150.2022.00016.
[edit]
Retrieved from "https://en.wikipedia.org/w/index.php?title=Underground_forum&oldid=1365823377"