Cybercrime forums play a central role in the cybercrime ecosystem, serving as hubs for the exchange of illicit goods, services, and knowledge. Previous studies have explored the market and social structures of these forums, but less is known about the behavioral dynamics of users, particularly regarding participants' disclosure of criminal activity. This study provides the first large-scale assessment of crime disclosure patterns in a major cybercrime forum, analysing over 3.5 million posts from nearly 300k users. Using a three-level classification scheme (benign, grey, and crime) and a scalable labelling pipeline powered by large language models (LLMs), we measure the level of crime disclosure present in initial posts, analyse how participants switch between levels, and assess how crime disclosure behavior relates to private communications. Our results show that crime disclosure is relatively normative: one quarter of initial posts include explicit crime-related content, and more than one third of users disclose criminal activity at least once in their initial posts. At the same time, most participants show restraint, with over two-thirds posting only benign or grey content and typically escalating disclosure gradually. Grey initial posts are particularly prominent, indicating that many users avoid overt statements and instead anchor their activity in ambiguous content. The study highlights the value of LLM-based text classification and Markov chain modelling for capturing crime disclosure patterns, offering insights for law enforcement efforts aimed at distinguishing benign, grey, and criminal content in cybercrime forums.
Figures & tables
Figure 1. The cumulative sum of initial posts, comments, private messages, and the number of users joining the forum.
Description
2015
2016 (Jan-May)
Newly registered users
480,380
118,705
Users commenting initial posts
232,130
93,529
Users writing private messages (UPM)
23,968
9,042
Users writing initial posts (UIP)
27,003
8,319
Intersection UPM and UIP
12,238
4,027
Private messages
336,559
171,155
Table 1. The Table provides an overview of user activity on the forum.
Figure 2. Overview of the processing steps of our methodology, starting with four preprocessing steps followed by three analysis methods.
Initial Post
Label
Please, I’m working into colors and edition in Photoshop CC 2015. Need some feedbacks, I’ll post the before and after! I’m trying to do it faster , so it’s not anything especial or professional.[…] BEFORE: CLICK HEREAFTER: CLICK HERE […] The quality is bad due to image res.
benign
So here’s an off-topic question, what’s your favorite movie or movie’s? I personally like the new Jurassic World, Zombie-land, and the R.E.D series.What about you?
benign
_URL_This is only really useful for Origin accounts as there are no accounts for the other sections.
grey
A· Inactive means inactive for 3+ months [..] NO PERSONAL ACCOUNTS- Only EUNE Accounts […] Only level 30 accounts with 60+ Champions Contact me via PM giving full info of the accounts
grey
I got this source code for a java rat and idk how to compile it to use it can someone help?
crime-related
hey guys :) That’s my share : ALL VERIFIED, CRACKED ACCOUNT URL +rep if you want more :)
crime- related
Table 2. The Table shows examples of initial posts for the disclosure labels, benign, grey, and crime-related. Some characters have been removed for better readability.
Mean (std)
Median
Variable
C1
C2
C1
C2
MWU Stat
active weeks
1.35 (0.98)
6.09 (5.70)
1.0
4.0
4.80⋅106 ***
max inactive weeks
0.54 (1.66)
16.56 (9.24)
0.0
15.0
1.32⋅106 ***
crime ip count
0.59 (1.34)
4.53 (10.23)
0.0
2.0
2.00⋅107 ***
grey ip count
0.90 (1.61)
7.59 (14.78)
0.0
3.0
1.51⋅107 ***
benign ip count
0.92 (1.71)
2.90 (6.86)
1.0
1.0
3.19⋅107 ***
Table 3. The table presents descriptive statistics for the variables underlying the two user clusters, Cluster 1 (C1) and Cluster 2 (C2). Reported measures include the mean, standard deviation, and median, along with the Mann–Whitney U test results and their statistical significance (***).
Label
# Initial Posts
# Comments to initial posts
Mean # comments per thread
Grey
49,278 (40.71%)
1,394,872 (41.37%)
32.86 (149.91)
Benign
36,328 (30.01%)
342,047 (10.14%)
12.08 (40.23)
Crime-related
30,944 (25.57%)
1,581,104 (46.90%)
58.00 (455.03)
Unclear
4,481 (3.70%)
53,405 (1.58%)
15.23 (46.85)
Table 4. Overview of the Crime Disclosure Labelling. The comments to a thread (initial post) have the same label as the initial post. The value in the brackets shows the corresponding percentage or standard deviation (last column on the right).
Figure 3. Diagram showing the the number of users who write initial posts per disclosure label and the overlap between users who write initial posts with different crime disclosure levels.
Figure 4. Markov chain visualization for Cluster 1. Circles represent disclosure levels of initial posts, while arrows indicate transition probabilities between levels.
Figure 5. Markov chain visualization for Cluster 2. Circles represent disclosure levels of initial posts, while arrows indicate transition probabilities between levels.
Variable
Estimate
Std. Error
OR
95% CI
Intercept
−2.45 ***
0.10
0.09
[0.07,0.11]
UnclearPosts
−0.04
0.06
0.96
[0.86,1.08]
GreyPosts
1.30 ***
0.03
3.68
[3.50,3.86]
BenignPosts
0.35 ***
0.02
1.42
[1.35,1.49]
CrimePosts
0.97 ***
0.03
2.64
[2.50,2.79]
Cluster 1
0.81 ***
0.07
2.25
[1.98,2.56]
Table 5. Results of the logistic regression model examining the likelihood of sending a private message (0 = no, 1 = yes). Among users who wrote an initial post (n = 33,127), 46% (n = 15,267) wrote at least one private message. The model has a RMcF2 of 0.164 .
Benign-dom. users n=3774
Crime-dom. users n=4664
Grey-dom. users n=7069
Benign-dom. users
0.23
0.27
0.50
Crime-dom. users
0.14
0.34
0.51
Grey-dom. users
0.12
0.25
0.63
Table 6. Matrix displaying the results of the assortative mixing analysis linking private-messaging ties to dominant public crime-disclosure profiles. Rows and columns represent users who predominantly write initial posts at each specific disclosure level.
The rapid expansion of artificial intelligence (AI) is raising concerns about its potential to transform cybercrime. Beyond empowering novice offenders, AI stands to intensify the scale and sophistication of attacks by seasoned cybercriminals. This paper examines the evolving relationship between cybercriminals and AI using a unique dataset from a cyber threat intelligence platform. Analyzing more than 160 cybercrime forum conversations collected over seven months, our research reveals how cybercriminals understand AI and discuss how they can exploit its capabilities. Their exchanges reflect growing curiosity about AI's criminal applications through legal tools and dedicated criminal tools, but also doubts and anxieties about AI's effectiveness and its effects on their business models and operational security. The study documents attempts to misuse legitimate AI tools and develop bespoke models tailored for illicit purposes. Combining the diffusion of innovation framework with thematic analysis, the paper provides an in-depth view of emerging AI-enabled cybercrime and offers practical insights for law enforcement and policymakers.
Benoît Dupont, Chad Whelan, Serge-Olivier Paquette
International Centre for Comparative Criminology, Université de Montréal, Canada · Deakin Centre for Cyber Research and Innovation, Deakin University, Australia · Flare Systems, Canada
Online scam behavior is inherently multi-stage, and the lifecycle includes temporally ordered rails and events rather than isolated signals. Existing works analyze characteristics of scam types and rails, but they do not track scam trends across years. Moreover, the work on the relations between rails is hampered due to the lack of open-source datasets with annotations and coverage of different scam types. To address these gaps, we build a dataset to analyze the yearly trend of scam characteristics and rail paths using Reddit self-disclosure narratives from 2023 to 2025. We collect 21,304 posts from scam-related subreddits with at least one rail among identity, communication, platform, and payment for trend analysis by heuristic annotation. Then, we label 1,800 posts containing explicit or recoverable scam chains by an LLM-assisted method for scam path analysis. The method is evaluated with human annotation. Lastly, we run a topic model on the comments of the posts to analyze the community support behavior. The results reveal that scam processes are predominantly multi-rail. Across years, different scam types and rail components dominate. Different scam types vary systematically in path complexity. Reddit support behaviors have become more detailed over time. This work supports synthetic scam chain data simulation and AI-related scam risk assessment, though findings may not generalise to other platforms.
This research investigated how online criminal activities can be better understood and connected using data-driven machine learning methods. Many illegal activities, such as human trafficking and illicit trade, have moved to online platforms where offenders hide behind anonymous accounts and frequently change identities. This makes it difficult for authorities to understand how large these networks are and how different online profiles may be linked. The research shows that people tend to maintain consistent patterns in how they write advertisements and present images online, even when they try to stay anonymous. By analysing these patterns across large collections of online advertisements, the research demonstrates how to link related accounts and identify repeated behaviour across illegal online markets. In addition, the research also addresses how such methods should be used responsibly. It proposes clear guidelines to ensure that privacy, fairness, and transparency are respected when these tools are applied. Overall, the research provides practical ways to support law enforcement investigations while emphasising careful and ethical use.