{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,8]],"date-time":"2026-04-08T21:00:11Z","timestamp":1775682011949,"version":"3.50.1"},"reference-count":71,"publisher":"Oxford University Press (OUP)","issue":"1","license":[{"start":{"date-parts":[[2022,7,15]],"date-time":"2022-07-15T00:00:00Z","timestamp":1657843200000},"content-version":"vor","delay-in-days":195,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2022,1,28]]},"abstract":"<jats:title>Abstract<\/jats:title>\n               <jats:p>Many activities related to cybercrime operations do not require much secrecy, such as developing websites or translating texts. This research provides indications that many users of a popular public internet marketing forum have connections to cybercrime. It does so by investigating the involvement in cybercrime of a population of users interested in internet marketing, both at a micro and macro scale. The research starts with a case study of three users confirmed to be involved in cybercrime and their use of the public forum. It provides a first glimpse that some business with cybercrime connections is being conducted in the clear. The study then pans out to investigate the forum population's ties with cybercrime by finding crossover users, that is, users from the public forum who also comment on cybercrime forums. The cybercrime forums on which they discuss are analyzed and the crossover users\u2019 strength of participation is reported. Also, to assess if they represent a sub-group of the forum population, their posting behavior on the public forum is compared with that of non-crossover users. This blend of analyses shows that (i) a minimum of 7.2% of the public forum population are crossover users that have ties with cybercrime forums; (ii) their participation in cybercrime forums is limited; and (iii) their posting behavior is relatively indistinguishable from that of non-crossover users. This is the first study to formally quantify how users of an internet marketing public forum, a space for informal exchanges, have ties to cybercrime activities. We conclude that crossover users are a substantial part of the population in the public forum, and even though they have thus far been overlooked, their aggregate effect in the ecosystem must be considered. This study opens new research questions on cybercrime participation that should consider online spaces beyond their cybercrime branding.<\/jats:p>","DOI":"10.1093\/cybsec\/tyac010","type":"journal-article","created":{"date-parts":[[2022,7,18]],"date-time":"2022-07-18T13:29:15Z","timestamp":1658150955000},"source":"Crossref","is-referenced-by-count":7,"title":["Entanglement: cybercrime connections of a public forum population"],"prefix":"10.1093","volume":"8","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-8275-8445","authenticated-orcid":false,"given":"Masarah","family":"Paquet-Clouston","sequence":"first","affiliation":[{"name":"School of Criminology, Universit\u00e9 de Montr\u00e9al , 2900 Edouard Montpetit Blvd, Montr\u00e9al, Quebec H3T 1J4, Canada"},{"name":"GoSecure, 630 Ren\u00e9-L\u00e9vesque Blvd W #2630 , Montreal, Quebec H3B 1S6, Canada"}]},{"given":"Serge-Olivier","family":"Paquette","sequence":"additional","affiliation":[{"name":"Secureworks, 1 Concourse Pkwy #500 , Atlanta, GA 30328, USA"}]},{"given":"Sebastian","family":"Garcia","sequence":"additional","affiliation":[{"name":"Artificial Intelligence Center (AIC), Czech Technical University , Karlovo n\u00e1m. 13, 120 00 Nov\u00e9 M\u011bsto, Prague, Czech Republic"}]},{"given":"Maria Jos\u00e9","family":"Erquiaga","sequence":"additional","affiliation":[{"name":"Cisco Systems, Karlovo n\u00e1m. 2097\/10 , 120 00 Nov\u00e9 M\u011bsto, Prague, Czech Republic"}]}],"member":"286","published-online":{"date-parts":[[2022,7,15]]},"reference":[{"key":"2023052911513863300_bib1","doi-asserted-by":"crossref","first-page":"961","DOI":"10.1007\/978-3-319-78440-3_65","article-title":"Organized financial cybercrime: criminal cooperation, logistic bottlenecks, and money flows","volume-title":"Palgrave Handbook of International Cybercrime and Cyberdeviance","author":"Leukfeldt","year":"2020"},{"key":"2023052911513863300_bib2","doi-asserted-by":"crossref","first-page":"253","DOI":"10.1007\/s10610-017-9356-z","article-title":"Criminals seeking ict-expertise: an exploratory study of dutch cases","volume":"24","author":"Bijlenga","year":"2018","journal-title":"Eur J Crim Pol Res"},{"key":"2023052911513863300_bib3","doi-asserted-by":"crossref","first-page":"587","DOI":"10.1080\/08985626.2013.814717","article-title":"Ethnic entrepreneurship: the myths of informal and illegal enterprises in the UK","volume":"25","author":"Ojo","year":"2013","journal-title":"Entrepreneurship Reg Dev"},{"key":"2023052911513863300_bib4","first-page":"403","article-title":"The informal economy","volume-title":"Handbook of Economic Sociology","author":"Haller","year":"2010"},{"key":"2023052911513863300_bib5","first-page":"11","article-title":"World underneath: the origins, dynamics and effects of the informal economy","volume-title":"The Informal Economy: Studies in Advanced and Less Developed Countries","author":"Castell","year":"1989"},{"key":"2023052911513863300_bib6","doi-asserted-by":"crossref","first-page":"40","DOI":"10.18061\/1811\/51127","article-title":"Theorising illegal rural enterprise: is everyone at it?","volume":"1","author":"McElwee","year":"2011","journal-title":"Int J Rural Crime"},{"key":"2023052911513863300_bib7","first-page":"1","article-title":"Measuring the changing cost of cybercrime","volume-title":"Workshop on the Economics of Information Security","author":"Anderson"},{"key":"2023052911513863300_bib8","first-page":"1009","article-title":"Plug and prey? Measuring the commoditization of cybercrime via online anonymous markets","author":"Van\u00a0Wegberg","year":"2018","journal-title":"Twenty-Seventh USENIX Security Symposium"},{"key":"2023052911513863300_bib9","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1109\/eCRS.2013.6805778","article-title":"Honor among thieves: a common's analysis of cybercrime economies","volume-title":"APWG eCrime Researchers Summit","author":"Afroz","year":"2013"},{"key":"2023052911513863300_bib10","first-page":"1","article-title":"Cybercrime is (often) boring: maintaining the infrastructure of cybercrime economies","author":"Collier","year":"2020","journal-title":"Workshop on the Economics of Information Security"},{"key":"2023052911513863300_bib11","doi-asserted-by":"crossref","first-page":"9","DOI":"10.1016\/S1361-3723(13)70053-8","article-title":"Cybercrime as a service: a very modern business","volume":"6","author":"Manky","year":"2013","journal-title":"Comput Fraud Secur"},{"key":"2023052911513863300_bib12","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/3199674","article-title":"Systematically understanding the cyber attack business: a survey","volume":"51","author":"Huang","year":"2018","journal-title":"ACM Comput Surv"},{"key":"2023052911513863300_bib13","doi-asserted-by":"crossref","DOI":"10.4159\/9780674989047","volume-title":"Industry of Anonymity: Inside the Business of Cybercrime","author":"Lusthaus","year":"2018"},{"key":"2023052911513863300_bib14","first-page":"1","article-title":"Framing dependencies introduced by underground commoditization","volume-title":"Workshop on the Economics of Information Security","author":"Thomas","year":"2015"},{"key":"2023052911513863300_bib15","doi-asserted-by":"crossref","first-page":"596","DOI":"10.1093\/bjc\/azu106","article-title":"A crime script analysis of the online stolen data market","volume":"55","author":"Hutchings","year":"2015","journal-title":"Br J Criminol"},{"key":"2023052911513863300_bib16","doi-asserted-by":"crossref","first-page":"3","DOI":"10.1257\/jep.23.3.3","article-title":"The economics of online crime","volume":"23","author":"Moore","year":"2009","journal-title":"J Econ Perspect"},{"key":"2023052911513863300_bib17","first-page":"1","article-title":"Measuring cybercrime as a service (CaaS) offerings in a cybercrime forum","author":"Akyazi","year":"2021","journal-title":"Workshop on the Economics of Information Security"},{"key":"2023052911513863300_bib18","doi-asserted-by":"crossref","first-page":"88","DOI":"10.1016\/j.forsciint.2017.05.021","article-title":"A geographical analysis of trafficking on a popular darknet market","volume":"277","author":"Bros\u00e9us","year":"2017","journal-title":"Forensic Sci Int"},{"key":"2023052911513863300_bib19","doi-asserted-by":"crossref","DOI":"10.1057\/9781137399052","volume-title":"Drugs on the Dark Net: How Cryptomarkets are Transforming the Global Trade in Illicit Drugs","author":"Martin","year":"2014"},{"key":"2023052911513863300_bib20","first-page":"704","article-title":"Cybercriminal networks, social ties and online forums: social ties versus digital ties within phishing and malware networks","volume":"57","author":"Leukfeldt","year":"2017","journal-title":"Br J Criminol"},{"key":"2023052911513863300_bib21","doi-asserted-by":"crossref","first-page":"39","DOI":"10.1007\/s10611-016-9663-1","article-title":"Origin, growth and criminal capabilities of cybercriminal networks. an international empirical analysis","volume":"67","author":"Leukfeldt","year":"2017","journal-title":"Crime Law Soc Chang"},{"key":"2023052911513863300_bib22","doi-asserted-by":"crossref","first-page":"21","DOI":"10.1007\/s10611-016-9662-2","article-title":"A typology of cybercriminal networks: from low-tech all-rounders to high-tech specialists","volume":"67","author":"Leukfeldt","year":"2017","journal-title":"Crime Law Soc Chang"},{"key":"2023052911513863300_bib23","doi-asserted-by":"crossref","first-page":"1387","DOI":"10.1177\/0002764217734267","article-title":"The use of online crime markets by cybercriminal networks: a view from within","volume":"61","author":"Leukfeldt","year":"2017","journal-title":"Am Behav Sci"},{"key":"2023052911513863300_bib24","doi-asserted-by":"crossref","first-page":"644","DOI":"10.1108\/03068290810896262","article-title":"Does the informal economy link to organised crime?","volume":"35","author":"Ponsaers","year":"2008","journal-title":"Int J Soc Econ"},{"key":"2023052911513863300_bib25","first-page":"1","article-title":"The informal economy: threat and opportunity in the city","author":"Shapland","year":"2004"},{"key":"2023052911513863300_bib26","doi-asserted-by":"crossref","first-page":"505","DOI":"10.1080\/08865655.2015.1101704","article-title":"Informality, illegality, and criminality in Mexico's border communities","volume":"30","author":"Sabet","year":"2015","journal-title":"J Borderl Stud"},{"key":"2023052911513863300_bib27","doi-asserted-by":"crossref","first-page":"651","DOI":"10.1108\/03068290810896271","article-title":"A matrix approach to informal markets: towards a dynamic conceptualisation","volume":"35","author":"Walle","year":"2008","journal-title":"Int J Soc Econ"},{"key":"2023052911513863300_bib28","first-page":"1","article-title":"Competition, efficiency and market structure in online digital markets. An overview and policy implications","volume":"2","author":"Cambini","year":"2011","journal-title":"Eur Rev Ind Econ Pol"},{"key":"2023052911513863300_bib29","first-page":"1","article-title":"A note on informal economy and ICT","volume":"85","author":"Rangaswamy","year":"2019","journal-title":"Electron J Inf Syst Dev Count"},{"key":"2023052911513863300_bib30","doi-asserted-by":"crossref","first-page":"179","DOI":"10.1108\/S2040-724620150000005014","article-title":"Dark matters: the institutional entrepreneurship of illicit and illegal cyberspace","volume-title":"Exploring Criminal and Illegal Enterprise: New Perspectives on Research, Policy & Practice","author":"Dobson","year":"2015"},{"key":"2023052911513863300_bib31","doi-asserted-by":"crossref","DOI":"10.1007\/978-3-642-11522-6","volume-title":"The Global Cybercrime Industry: Economic, Institutional and Strategic Perspectives","author":"Kshetri","year":"2010"},{"key":"2023052911513863300_bib32","author":"Schmidt","year":"2017","journal-title":"Digital Labour Markets in the Platform Economy. Mapping the Political Challenges of Crowd Work and Gig Work"},{"key":"2023052911513863300_bib33","first-page":"335","article-title":"Work in the platform economy: beyond lower transaction costs","volume":"52","author":"Drahokoupil","year":"2017","journal-title":"Inter Econ"},{"key":"2023052911513863300_bib34","first-page":"1","article-title":"The platform economy and the disruption of the employment relationship","volume":"5","author":"Drahokoupil","year":"2016"},{"key":"2023052911513863300_bib35","doi-asserted-by":"crossref","first-page":"17","DOI":"10.1109\/ECRIME.2017.7945050","article-title":"Characterizing key stakeholders in an online black-hat marketplace","volume-title":"APWG Symposium on Electronic Crime Research (eCrime)","author":"Farooqi","year":"2017"},{"key":"2023052911513863300_bib36","doi-asserted-by":"crossref","DOI":"10.1007\/978-3-642-39498-0_13","article-title":"Analysis of ecrime in crowd-sourced labor markets: mechanical Turk vs. Freelancer","volume-title":"The Economics of Information Security and Privacy","author":"Garg","year":"2013"},{"key":"2023052911513863300_bib37","first-page":"14","article-title":"Dirty jobs: the role of freelance labor in web service abuse","author":"Motoyama","year":"2011","journal-title":"Proceedings of the 20th USENIX conference on Security"},{"key":"2023052911513863300_bib38","volume-title":"The role of informal workers in online economic crime","author":"Paquet-Clouston","year":"2021"},{"key":"2023052911513863300_bib39","first-page":"406","article-title":"Geost botnet. operational security failures of a new android banking threat","author":"Shirokova","year":"2019","journal-title":"IEEE European Symposium on Security and Privacy Workshops"},{"key":"2023052911513863300_bib40","first-page":"1","volume-title":"Geost Botnet. The Story of the Discovery of a New Android Banking Trojan from an OpSec Error","author":"Garcia","year":"2019"},{"key":"2023052911513863300_bib41","author":"Virus Total"},{"key":"2023052911513863300_bib42","author":"Flare Systems"},{"key":"2023052911513863300_bib43","doi-asserted-by":"crossref","first-page":"35","DOI":"10.5334\/bax.c","article-title":"Why is participation inequality important?","volume-title":"European Handbook of Crowdsourced Geographic Information","author":"Haklay","year":"2016"},{"key":"2023052911513863300_bib44","doi-asserted-by":"crossref","first-page":"87","DOI":"10.1016\/j.drugpo.2018.01.003","article-title":"Assessing market competition and vendors\u2019 size and scope on alphabay","volume":"54","author":"Paquet-Clouston","year":"2018","journal-title":"Int J Drug Pol"},{"key":"2023052911513863300_bib45","doi-asserted-by":"crossref","first-page":"110","DOI":"10.1016\/j.chb.2014.05.022","article-title":"Understanding lurkers in online communities: a literature review","volume":"38","author":"Sun","year":"2014","journal-title":"Comput Hum Behav"},{"key":"2023052911513863300_bib46","first-page":"355","article-title":"Who are the contributors to openstreetmap and what do they do?","author":"Mooney","year":"2012","journal-title":"Proceedings of the GIS Research UK 20th Annual Conference"},{"key":"2023052911513863300_bib47","first-page":"1","article-title":"Participation inequality in mobile location games","author":"Lund","year":"2011","journal-title":"Proceedings of the Eight International Conference on Advances in Computer Entertainment Technology"},{"key":"2023052911513863300_bib48","doi-asserted-by":"crossref","first-page":"e33","DOI":"10.2196\/jmir.2966","article-title":"The 1% rule in four digital health social networks: an observational study","volume":"16","author":"Van\u00a0Mierlo","year":"2014","journal-title":"J Med Internet Res"},{"key":"2023052911513863300_bib49","article-title":"UMAP: uniform manifold approximation and projection for dimension reduction","author":"McInnes","year":"2018"},{"key":"2023052911513863300_bib50","doi-asserted-by":"crossref","first-page":"496","DOI":"10.1038\/s41586-019-0969-x","article-title":"The single-cell transcriptional landscape of mammalian organogenesis","volume":"566","author":"Cao","year":"2019","journal-title":"Nature"},{"key":"2023052911513863300_bib51","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1126\/science.aax1971","article-title":"A lineage-resolved molecular atlas of C. elegans embryogenesis at single-cell resolution","volume":"365","author":"Packer","year":"2019","journal-title":"Science"},{"key":"2023052911513863300_bib52","doi-asserted-by":"crossref","first-page":"e1008432","DOI":"10.1371\/journal.pgen.1008432","article-title":"UMAP reveals cryptic population structure and phenotype heterogeneity in large genomic cohorts","volume":"15","author":"Diaz-Papkovich","year":"2019","journal-title":"PLos Genet"},{"key":"2023052911513863300_bib53","author":"Google Translate API for Python"},{"key":"2023052911513863300_bib54","doi-asserted-by":"crossref","first-page":"445","DOI":"10.1145\/3131365.3131389","article-title":"Ethical issues in research using datasets of illicit origin","author":"Thomas","year":"2017","journal-title":"Proceedings of the 2017 Internet Measurement Conference"},{"key":"2023052911513863300_bib55","doi-asserted-by":"crossref","DOI":"10.1007\/978-3-642-22263-4_1","article-title":"How unique and traceable are usernames?","volume-title":"Privacy Enhancing Technologies","author":"Perito","year":"2011"},{"key":"2023052911513863300_bib56","doi-asserted-by":"crossref","first-page":"354","DOI":"10.1609\/icwsm.v3i1.13993","article-title":"Connecting corresponding identities across communities","author":"Zafarani","year":"2009","journal-title":"Proceedings of the International AAAI Conference on Web and Social Media"},{"key":"2023052911513863300_bib57","first-page":"522","article-title":"Identifying users across social tagging systems","author":"Iofciu","year":"2011","journal-title":"Proceedings of the International AAAI Conference on Web and Social Media"},{"key":"2023052911513863300_bib58","first-page":"1","article-title":"Mapping users across networks by manifold alignment on hypergraph","author":"Tan","year":"2014","journal-title":"Proceedings of the AAAI Conference on Artificial Intelligence"},{"key":"2023052911513863300_bib59","first-page":"18","article-title":"Linking user accounts across social media platforms","author":"Sinnott","year":"2021","journal-title":"Proceedings of the Eight International Conference on Big Data Computing, Applications and Technologies"},{"key":"2023052911513863300_bib60","doi-asserted-by":"crossref","first-page":"376","DOI":"10.1016\/j.procs.2016.05.336","article-title":"Identifying users across different sites using usernames","volume":"80","author":"Wang","year":"2016","journal-title":"Proc Comput Sci"},{"key":"2023052911513863300_bib61","first-page":"889","article-title":"De-anonymizing social networks user via profile similarity","author":"Wang","year":"2018","journal-title":"Proceedings of the IEEE Third International Conference on Data Science in Cyberspace"},{"key":"2023052911513863300_bib62","first-page":"1799","article-title":"On the reliability of profile matching across large online social networks","author":"Goga","year":"2015","journal-title":"Proceedings of the Twenty-First ACM SIGKDD International Conference on Knowledge Discovery and Data Mining"},{"key":"2023052911513863300_bib63","doi-asserted-by":"crossref","DOI":"10.1007\/978-3-319-27433-1_12","article-title":"Digital stylometry: linking profiles across social networks","volume-title":"Social Informatics","author":"Vosoughi","year":"2015"},{"key":"2023052911513863300_bib64","first-page":"173","article-title":"Application of stylometry to darkweb forum user identification","author":"Ho","year":"2016","journal-title":"Proceedings of the International Conference on Information and Communications Security"},{"key":"2023052911513863300_bib65"},{"key":"2023052911513863300_bib66","doi-asserted-by":"crossref","first-page":"12","DOI":"10.1016\/j.diin.2019.05.004","article-title":"Classifying suspicious content in tor darknet through semantic attention keypoint filtering","volume":"30","author":"Fidalgo","year":"2019","journal-title":"Digit Investig"},{"key":"2023052911513863300_bib67","doi-asserted-by":"crossref","article-title":"Availability of COVID-19 related products on Tor darknet markets","author":"Broadhurst","DOI":"10.52922\/sb04534"},{"key":"2023052911513863300_bib68","article-title":"The Tor darknet","author":"Owen"},{"key":"2023052911513863300_bib69","first-page":"418","article-title":"Traffic classification of user behaviors in tor, i2p, zeronet, freenet","author":"Hu","year":"2020","journal-title":"The Proceedings of the IEEE Nineteenth International Conference on Trust, Security and Privacy in Computing and Communications"},{"key":"2023052911513863300_bib70","doi-asserted-by":"crossref","first-page":"361","DOI":"10.1037\/0033-2909.111.2.361","article-title":"A common language effect size statistic","volume":"111","author":"McGraw","year":"1992","journal-title":"Psychol Bull"},{"key":"2023052911513863300_bib71","article-title":"Exploring and analyzing the dark web: a new alchemy","volume":"24","author":"Faizan","year":"2019"}],"container-title":["Journal of Cybersecurity"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/academic.oup.com\/cybersecurity\/article-pdf\/8\/1\/tyac010\/50476493\/tyac010.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"syndication"},{"URL":"https:\/\/academic.oup.com\/cybersecurity\/article-pdf\/8\/1\/tyac010\/50476493\/tyac010.pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2023,5,29]],"date-time":"2023-05-29T11:52:53Z","timestamp":1685361173000},"score":1,"resource":{"primary":{"URL":"https:\/\/academic.oup.com\/cybersecurity\/article\/doi\/10.1093\/cybsec\/tyac010\/6644916"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,1,1]]},"references-count":71,"journal-issue":{"issue":"1","published-print":{"date-parts":[[2022,1,28]]}},"URL":"https:\/\/doi.org\/10.1093\/cybsec\/tyac010","relation":{},"ISSN":["2057-2085","2057-2093"],"issn-type":[{"value":"2057-2085","type":"print"},{"value":"2057-2093","type":"electronic"}],"subject":[],"published-other":{"date-parts":[[2022,1,1]]},"published":{"date-parts":[[2022,1,1]]},"article-number":"tyac010"}}