The shady economy: Understanding the difference in trading activity from underground forums in different layers of the Web

Abstract

Underground forums are discussion outlets where criminal communities exchange knowledge about online malicious activities and trade illegal goods and services that promote an underground economy based on malicious software, stolen personal information, tools for financial fraud, drugs and more. Prior work has investigated the interactions between criminals and the type of assets traded in Surface Web forums. At the same time, research evidence suggests cybercriminals are moving their operations to the Dark Web to avoid getting caught and similar research has been carried out in Dark Web forums from different perspectives. However, there is no empirical evidence on how forum criminal activity related to the underground economy takes place in both Web environments. To address this problem, we conduct a quantitative exploratory analysis about the trading activity taking place in four prominent forums in the Surface Web and four in the Dark Web based on the type of posts found in the forums. Then, we compare the data to find differences in the malicious activity observed. Our results show that trading activity is higher in Dark Web forums compared to the Surface Web. We also find that different types of transactions, products and prices vary according to the Web environment.