Go See a Specialist? Predicting Cybercrime Sales on Online Anonymous Markets from Vendor and Product Characteristics

Abstract

Many cybercriminal entrepreneurs lack the skills and techniques to provision certain parts of their business model, leading them to outsource these parts to specialized criminal vendors. Online anonymous markets, from Silk Road to AlphaBay, have been used to search for these products and contract with their criminal vendors. While one listing of a product generates high sales numbers, another identical listing fails to sell. In this paper, we investigate which factors determine the performance of cybercrime products.To answer this question, we analyze scraped data on the businessto-business cybercrime segments of AlphaBay (2015-2017), consisting of 7,543 listings from 1,339 vendors, sold at least 126,934 times. We construct new variables to capture product differentiators and price. We capture the influence of vendor characteristics by identifying five distinct vendor profiles based on latent profile analysis of six properties. We leverage these product and vendor characteristics to empirically predict the performance of cybercrime products, whilst controlling for the lifespan and type of solution. Consistent with earlier insights into carding forums, we identify prevalent product differentiators to be influencing the relative success of a product. While all these product differentiators do correlate significantly with product performance, their explanatory power is lower than that of vendor profiles. When outsourcing, the vendor seems to be of more importance to the buyers than product differentiators.

Turning Up the Dial

“…Types of Products and Services. As Wegberg et al [25] found product characteristics influence sales volumes, we investigate the types of products or services being marketed. We qualitatively analyse threads associated with public transactions, which serve as advertisements for a given product or service, to reveal the extent product type drives trade.…”

Get Rich or Keep Tryin’ Trajectories in dark net market vendor careers

“…For each of the listings posted by vendors on these markets, the dataset contains information as the title, descriptions, advertised prices, timestamps, and most importantly the feedbacks on each item. Previous research has shown that feedbacks have proven to be a good proxy for sales, and provide a structural lower bound of sales [2], [4], [7], [19]. Combining both datasets enables us to link numerous pseudonyms across multiple dark markets and aggregate careers through the proxy of PGP-keys.…”

“…Prior research has been done on analyzing a broad spectrum of criminal career trajectories -ranging from burglars, to homicide offenders and even mafia organizations [23]- [27]. From earlier work we know that vendors have individual characteristics, which influence their success on dark net markets and ultimately determine the length and strength of their career [4].…”

“…In order to gain insights in dark net market vendor careers, we combine methodologies used for market analysis, such as sales activity based on feedbacks [4], with methods which are used within dark net market migration research [5]. Combining these methods have allowed us to analyse the careers of vendors within the dark market ecosystem and gain insights into their characteristics.…”

Beneath the radar: Exploring the economics of business fraud via underground markets

“…Previous studies have focused on the profits made by the criminals facilitating digital products from business-tobusiness [10], [11] but neglected the trades in these markets targeting directly consumers. On the other hand, a handful number of qualitative studies focused on understanding criminals and victims of particular types of fraud without quantifying its financial impact (e.g., airline ticketing fraud [12]).…”