Researchers have studied the popularity of hacker forums

[Tomcat]

Recently, specialists from Digital Shadows noticed that the operators of the English-language carder forum Altenen grab the number of visitors to their site, as well as income, based on data obtained from the analytical service HypeStat. Altenen administrators have clearly shared this information in the hopes of promoting themselves and attracting more visitors. Looking at this, the researchers decided to independently study the traffic of other popular resources for cybercriminals and compare the information received with their own impressions of these sites.

In addition to Altenen, the researchers analyzed data from such English-language forums as RaidForums, Nulled, Cracked TO and Cracking King, the German-language forum Crimenetwork, as well as the Russian-language resources Exploit and XSS. The data for analysis was taken from open sources (from HypeStat and Alexa) and included the resource rating, the number of unique visitors per day, the geography of visits, traffic sources, and an estimate of daily income. Of course, the statistics collected do not include visits to .onion domains, so the data cannot be called comprehensive.

It turned out that sites like Altenen, Nulled, Exploit and XSS have shown significant growth in traffic over the past 90 days, with administrators of some of these resources using statistics to promote their services. According to researchers at Digital Shadows, sites clearly used bots and cheats to manipulate the number of visitors and increase their rankings.

“In particular, the sharp increase in Altenen's rating looks too good to be true, as no other forum that we consider popular, such as RaidForums, has shown such growth over the same period of time,” the experts write.

The collected traffic data shows that the average time spent by users on hacking forums ranges from 6 to 22 minutes. However, Digital Shadows experts believe that these numbers may not be very accurate either. The fact is that users, for example, spend on average less than 8 minutes on Exploit, but this is a completely closed forum, it is not visited by random people, and in fact they probably spend much more time on the site.

In terms of ad revenues, researchers believe that analytics services do not reflect the actual economics of forums at all, as hacker sites can make money from paid memberships and some receive commissions on every transaction.

The experts summarize that the key takeaway from this analysis is that traffic metrics can be manipulated, including through bots and VPNs, and some hacking platforms use statistics to gain attention. Moreover, it is hardly possible to draw up a real picture of what is happening based on such figures.

“When evaluating forums, context is critical. The figures by themselves do not give a complete picture and idea of the content of the forum and its users, as well as the real economy of the resource, and do not explain the fluctuations in the number of visitors.
It takes a lot of manual labor and time to get a deep understanding of the cybercriminal underground. You can't make a picture based only on site traffic figures. Such studies once again emphasize the need for constant human participation in the process, the importance of combining manual and automatic approaches. Big data analysis can give a general idea of what is happening, but without intelligence work, many important details and nuances will be missed, ”sums up Digital Shadows expert Kacey Clark.