{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,8]],"date-time":"2026-10-08T10:41:44Z","timestamp":1791456104254,"version":"4.3.4"},"publisher-location":"New York, NY, USA","reference-count":119,"publisher":"ACM","funder":[{"name":"Institute of Information & Communications Technology Planning & Evaluation (IITP), Korea (funded by MSIT)","award":["No. 2024-00337703&#x3b; No. 2024-00398745&#x3b; No. 2022-0-00688&#x3b; IITP-2025-RS-2024-00437849&#x3b; RS-2025-25457342&#x3b; RS-2025-25394739"],"award-info":[{"award-number":["No. 2024-00337703&#x3b; No. 2024-00398745&#x3b; No. 2022-0-00688&#x3b; IITP-2025-RS-2024-00437849&#x3b; RS-2025-25457342&#x3b; RS-2025-25394739"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2026,4,13]]},"DOI":"10.1145\/3774904.3792737","type":"proceedings-article","created":{"date-parts":[[2026,4,9]],"date-time":"2026-04-09T21:54:39Z","timestamp":1775771679000},"page":"3531-3542","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":1,"title":["Unveiling the Underground Phishing Ecosystem: A 12-Year Longitudinal Study of Deep and Dark Web Forums"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-8351-2727","authenticated-orcid":false,"given":"Dohee","family":"Kim","sequence":"first","affiliation":[{"name":"Sungkyunkwan University, Suwon, Republic of Korea"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0004-4084-3819","authenticated-orcid":false,"given":"Hui","family":"Zhao","sequence":"additional","affiliation":[{"name":"Sungkyunkwan University, Suwon, Republic of Korea"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9033-990X","authenticated-orcid":false,"given":"Doowon","family":"Kim","sequence":"additional","affiliation":[{"name":"University of Tennessee, Knoxville, Knoxville, TN, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-5386-2411","authenticated-orcid":false,"given":"Sungjae","family":"Hwang","sequence":"additional","affiliation":[{"name":"Sungkyunkwan University, Suwon, Republic of Korea"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2026,4,12]]},"reference":[{"key":"e_1_3_2_1_1_1","unstructured":"Intel 471. 2014. Darkweb intelligence firm: Intel 471. https:\/\/www.intel471.com\/"},{"key":"e_1_3_2_1_2_1","unstructured":"ACID. 2014. Darkweb intelligence firm: ACID. https:\/\/www.acid-tech.com\/"},{"key":"e_1_3_2_1_3_1","volume-title":"Ahmia: Tor Hidden Service Search Engine. https:\/\/ahmia.fi\/.","year":"2025","unstructured":"Ahmia. 2025. Ahmia: Tor Hidden Service Search Engine. https:\/\/ahmia.fi\/."},{"key":"e_1_3_2_1_4_1","unstructured":"AhnLab ASEC. 2019. Distribution and Operation of Malware 'Crypter' Exploiting Malicious Spam. ASEC Blog. https:\/\/asec.ahnlab.com\/en\/16500\/"},{"key":"e_1_3_2_1_5_1","unstructured":"Akamai. 2019. Streaming Services Among the Most Targeted by Credential Stuffing Attacks According to Akamai Report. https:\/\/www.akamai.com\/newsroom\/press-release\/state-of-the-internet-security-credential-stuffing-attacks-and-economies"},{"key":"e_1_3_2_1_6_1","unstructured":"Jan Michael Alcantara. 2024. Phishing with Cloudflare Workers: Transparent Phishing and HTML Smuggling. https:\/\/www.netskope.com\/blog\/phishing-with-cloudflare-workers-transparent-phishing-and-html-smuggling"},{"key":"e_1_3_2_1_7_1","unstructured":"Altenens. 2008. Altenens website. https:\/\/altenens.is\/"},{"key":"e_1_3_2_1_8_1","volume-title":"4th Quarter","author":"Anti-Phishing Working Group (APWG). 2017.","year":"2016","unstructured":"Anti-Phishing Working Group (APWG). 2017. Phishing Activity Trends Report, 4th Quarter 2016. https:\/\/docs.apwg.org\/reports\/apwg_trends_report_q4_2016.pdf"},{"key":"e_1_3_2_1_9_1","volume-title":"1st Quarter","author":"Anti-Phishing Working Group (APWG). 2020.","year":"2020","unstructured":"Anti-Phishing Working Group (APWG). 2020. Phishing Activity Trends Report, 1st Quarter 2020. https:\/\/docs.apwg.org\/reports\/apwg_trends_report_q1_2020.pdf"},{"key":"e_1_3_2_1_10_1","volume-title":"4th Quarter","author":"Anti-Phishing Working Group (APWG). 2024.","year":"2023","unstructured":"Anti-Phishing Working Group (APWG). 2024. Phishing Activity Trends Report, 4th Quarter 2023. https:\/\/docs.apwg.org\/reports\/apwg_trends_report_q4_2023.pdf"},{"key":"e_1_3_2_1_11_1","unstructured":"Awazon. 2020. Awazon. http:\/\/awazonhndi7e5yfaobpk7j2tsnp4kfd2xa63tdtzcg7plc5fka4il4ad.onion\/"},{"key":"e_1_3_2_1_12_1","unstructured":"Tom Barnea. 2025. Ongoing Campaign Abuses Microsoft 365's Direct Send to Deliver Phishing Emails. https:\/\/www.varonis.com\/blog\/direct-send-exploit"},{"key":"e_1_3_2_1_13_1","volume-title":"120 million monthly active users and 31.3 billion game hours \u2014 Steam summed up the results of","author":"Bespyatova Ekaterina","year":"2020","unstructured":"Ekaterina Bespyatova. 2021. 120 million monthly active users and 31.3 billion game hours \u2014 Steam summed up the results of 2020. https:\/\/app2top.com\/analytics\/120-million-monthly-active-users-and-31-3-billion-game-hours-steam-summed-up-the-results-of-2020-180149.html"},{"key":"e_1_3_2_1_14_1","volume-title":"30th USENIX security symposium (USENIX security 21). 3757-3774.","author":"Bijmans Hugo","unstructured":"Hugo Bijmans, Tim Booij, Anneke Schwedersky, Aria Nedgabat, and Rolf van Wegberg. 2021. Catching phishers by their bait: Investigating the dutch phishing landscape through phishing kit detection. In 30th USENIX security symposium (USENIX security 21). 3757-3774."},{"key":"e_1_3_2_1_15_1","unstructured":"Vaibhav Billade. 2025. Spear Phishing Campaign Delivers VIP Keylogger via Email Attachment. Seqrite Technical Blog. https:\/\/www.seqrite.com\/blog\/spear-phishing-campaign-delivers-vip-keylogger-via-email-attachment\/"},{"key":"e_1_3_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICDCSW.2014.20"},{"key":"e_1_3_2_1_17_1","unstructured":"Bitsight. 2011. Darkweb intelligence firm: Bitsight. https:\/\/www.bitsight.com\/"},{"key":"e_1_3_2_1_18_1","unstructured":"BOLSTER. 2024. Zero to Hero of Phishing: Modern Phishing Attacks by Leveraging Dark Web Tools and AI. https:\/\/bolster.ai\/blog\/zero-to-hero-of-phishing-modern-phishing-attacks-by-leveraging-dark-web-tools-and-ai"},{"key":"e_1_3_2_1_19_1","unstructured":"Brandefense. 2018. Darkweb intelligence firm: Brandefense. https:\/\/brandefense.io\/"},{"key":"e_1_3_2_1_20_1","unstructured":"BreachForums. 2022. Breach Forums. https:\/\/breachforums.info\/"},{"key":"e_1_3_2_1_21_1","unstructured":"Breachsense. 2018. Darkweb intelligence firm: Breachsense. https:\/\/www.breachsense.com\/"},{"key":"e_1_3_2_1_22_1","unstructured":"BREACHSENSE. 2024. The 10 Best Dark Web Monitoring Services. https:\/\/www.breachsense.com\/blog\/best-dark-web-monitoring-services\/"},{"key":"e_1_3_2_1_23_1","first-page":"1877","article-title":"Language models are few-shot learners. In Advances in Neural Information Processing Systems 33 (NeurIPS). Curran Associates","author":"Brown Tom","year":"2020","unstructured":"Tom Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared D Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, et al., 2020. Language models are few-shot learners. In Advances in Neural Information Processing Systems 33 (NeurIPS). Curran Associates, Inc., 1877-1901.","journal-title":"Inc."},{"key":"e_1_3_2_1_24_1","unstructured":"Jenny Chen. 2025. Cybersecurity Stop of the Month: Adversary-in-the-Middle Attacks that Target Microsoft 365. https:\/\/www.proofpoint.com\/us\/blog\/email-and-cloud-threats\/aitm-phishing-attacks-evolving-threat-microsoft-365"},{"key":"e_1_3_2_1_25_1","unstructured":"CISA. 2017. Google Docs Phishing Campaign (US-CERT Alert). https:\/\/www.cisa.gov\/news-events\/alerts\/2017\/05\/04\/google-docs-phishing-campaign"},{"key":"e_1_3_2_1_26_1","unstructured":"CorwdStrike. 2011. Darkweb intelligence firm: CrowdStrike. https:\/\/www.crowdstrike.com\/ko-kr\/"},{"key":"e_1_3_2_1_27_1","unstructured":"Cracked.io. 2018. Cracked.io. https:\/\/cracked.io\/"},{"key":"e_1_3_2_1_28_1","unstructured":"Cracking. 2018. Cracking. https:\/\/cracking.org\/"},{"key":"e_1_3_2_1_29_1","volume-title":"https:\/\/crax.cc\/ Deep Web Forum","year":"2025","unstructured":"Crax.cc. 2025. Crax.cc. https:\/\/crax.cc\/ Deep Web Forum; Year based on WHOIS creation date: 2025-09-06."},{"key":"e_1_3_2_1_30_1","unstructured":"Crax.pro. 2020. Crax.pro. https:\/\/crax.pro\/"},{"key":"e_1_3_2_1_31_1","unstructured":"Crax.shop. 2022. Crax.shop. https:\/\/crax.shop\/"},{"key":"e_1_3_2_1_32_1","volume-title":"10 Best Dark Web Monitoring Tools","author":"CRYPTIKA.","year":"2025","unstructured":"CRYPTIKA. 2025. 10 Best Dark Web Monitoring Tools in 2025. https:\/\/www.cryptika.com\/10-best-dark-web-monitoring-tools-in-2025\/"},{"key":"e_1_3_2_1_33_1","unstructured":"CTM360. 2014. Darkweb intelligence firm: CTM360. https:\/\/www.ctm360.com\/"},{"key":"e_1_3_2_1_34_1","unstructured":"Cybelangel. 2013. Darkweb intelligence firm: CybelAngel. https:\/\/cybelangel.com\/"},{"key":"e_1_3_2_1_35_1","unstructured":"Searchlight Cyber. 2017. Darkweb intelligence firm: Searchlight Cyber. https:\/\/slcyber.io\/"},{"key":"e_1_3_2_1_36_1","unstructured":"Cyberint. 2010. Darkweb intelligence firm: Cyberint. https:\/\/cyberint.com\/"},{"key":"e_1_3_2_1_37_1","unstructured":"Cyble. 2019. Darkweb intelligence firm: Cyble. https:\/\/cyble.com\/"},{"key":"e_1_3_2_1_38_1","unstructured":"Alexandre C\u00f4t\u00e9 Cyr. 2024. Life on a Crooked RedLine: Analyzing the Infamous Infostealer's Backend. https:\/\/www.welivesecurity.com\/en\/eset-research\/life-crooked-redline-analyzing-infamous-infostealers-backend\/"},{"key":"e_1_3_2_1_39_1","unstructured":"darkowl. 2016. Darkweb intelligence firm: DarkOwl. https:\/\/www.darkowl.com\/"},{"key":"e_1_3_2_1_40_1","unstructured":"Graham Edgecombe. 2024. Phishception \u2013 SendGrid is abused to host phishing attacks impersonating itself. https:\/\/www.netcraft.com\/blog\/popular-email-platform-used-to-impersonate-itself"},{"key":"e_1_3_2_1_41_1","unstructured":"ENKI WhiteHat Team. 2025. Analysis of FormBook Payload Loaded by PureCrypter Distributed from South Korean IP. https:\/\/www.enki.co.kr\/en\/media-center\/blog\/analysis-of-formbook-payload-loaded-by-purecrypter-distributed-from-south-korean-ip"},{"key":"e_1_3_2_1_42_1","unstructured":"Europol. 2023. One of the Darkweb's Largest Cryptocurrency Laundromats Washed Out (ChipMixer). https:\/\/www.europol.europa.eu\/media-press\/newsroom\/news\/one-of-darkwebs-largest-cryptocurrency-laundromats-washed-out"},{"key":"e_1_3_2_1_43_1","unstructured":"Harry Everett. 2024. Out of the Shadows \u2014 'darcula' iMessage and RCS Smishing Attacks Target USPS and Global Postal Services. https:\/\/www.netcraft.com\/blog\/darcula-smishing-attacks-target-usps-and-global-postal-services"},{"key":"e_1_3_2_1_44_1","unstructured":"Harry Everett. 2025. AI-Enabled Darcula-Suite Makes Phishing Kits More Accessible Easier to Deploy. https:\/\/www.netcraft.com\/blog\/ai-enabled-darcula-suite-makes-phishing-kits-more-accessible-easier-to-deploy"},{"key":"e_1_3_2_1_45_1","unstructured":"Flare. 2017. Darkweb intelligence firm: Flare. https:\/\/flare.io\/"},{"key":"e_1_3_2_1_46_1","unstructured":"Flashpoint. 2010. Darkweb intelligence firm: Flashpoint. https:\/\/flashpoint.io\/"},{"key":"e_1_3_2_1_47_1","unstructured":"Foresiet. 2020. Darkweb intelligence firm: Foresiet. https:\/\/foresiet.com\/"},{"key":"e_1_3_2_1_48_1","unstructured":"Fortra Suspicious Email Analysis Team. 2024. Cloudflare's pages.dev and workers.dev Domains Increasingly Abused for Phishing. https:\/\/www.fortra.com\/blog\/cloudflare-pages-workers-domains-increasingly-abused-for-phishing"},{"key":"e_1_3_2_1_49_1","volume-title":"In Proceedings of the 2007 ACM Conference on Computer and Communications Security (CCS)., 375-388","author":"Franklin Jason","year":"2007","unstructured":"Jason Franklin, Adrian Perrig, Vern Paxson, and Stefan Savage. 2007. An inquiry into the nature and causes of the wealth of Internet miscreants. In In Proceedings of the 2007 ACM Conference on Computer and Communications Security (CCS)., 375-388."},{"key":"e_1_3_2_1_50_1","unstructured":"GOV.UK. 2021. Avoid and Report Internet Scams and Phishing. https:\/\/www.gov.uk\/report-suspicious-emails-websites-phishing"},{"key":"e_1_3_2_1_51_1","unstructured":"Group-IB. 2003. Darkweb intelligence firm: Group-IB. https:\/\/www.group-ib.com\/"},{"key":"e_1_3_2_1_52_1","unstructured":"Group-IB Threat Intelligence. 2022. Roasting 0ktapus: The Phishing Campaign Going After Okta. https:\/\/www.group-ib.com\/blog\/0ktapus\/"},{"key":"e_1_3_2_1_53_1","volume-title":"Phishy Business: Unraveling LabHost's scam ecosystem. https:\/\/www.group-ib.com\/blog\/labhost-operation\/","author":"Group","year":"2024","unstructured":"Group-IB Threat Intelligence. 2024. Phishy Business: Unraveling LabHost's scam ecosystem. https:\/\/www.group-ib.com\/blog\/labhost-operation\/"},{"key":"e_1_3_2_1_54_1","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2024.3375882"},{"key":"e_1_3_2_1_55_1","unstructured":"Shane Hickey. 2025. UK student jailed for selling phishing kits linked to \u00a3100m of fraud. https:\/\/www.theguardian.com\/technology\/2025\/jul\/24\/canterbury-student-phishing-kits-jailed-fraudsters"},{"key":"e_1_3_2_1_56_1","volume-title":"28th USENIX security symposium (USENIX security 19). 1273-1290.","author":"Ho Grant","unstructured":"Grant Ho, Asaf Cidon, Lior Gavish, Marco Schweighauser, Vern Paxson, Stefan Savage, Geoffrey M Voelker, and David Wagner. 2019. Detecting and characterizing lateral phishing at scale. In 28th USENIX security symposium (USENIX security 19). 1273-1290."},{"key":"e_1_3_2_1_57_1","unstructured":"FBI Internet Crime Complaint Center (IC3). 2023. 2023 Internet Crime Report. https:\/\/www.ic3.gov\/annualreport\/reports\/2023_ic3report.pdf"},{"key":"e_1_3_2_1_58_1","unstructured":"SSL Insights. 2025. Phishing Statistics for 2025: Latest Figures and Trends. https:\/\/sslinsights.com\/phishing-statistics\/"},{"key":"e_1_3_2_1_59_1","unstructured":"Microsoft Threat Intelligence. 2023. DEV-1101 Enables High-Volume AiTM Campaigns with Open-Source Phishing Kit. https:\/\/www.microsoft.com\/en-us\/security\/blog\/2023\/03\/13\/dev-1101-enables-high-volume-aitm-campaigns-with-open-source-phishing-kit\/"},{"key":"e_1_3_2_1_60_1","unstructured":"Mimecast Threat Intelligence. 2025. Direct Send Abuse. https:\/\/www.mimecast.com\/threat-intelligence-hub\/microsoft-direct-send-abuse\/"},{"key":"e_1_3_2_1_61_1","unstructured":"Matt Kapko. 2025. Infostealers Fueled Cyberattacks and Snagged 2.1B Credentials Last Year. https:\/\/cyberscoop.com\/infostealers-cybercrime-surged-2024-flashpoint\/"},{"key":"e_1_3_2_1_62_1","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2023.3252366"},{"key":"e_1_3_2_1_63_1","unstructured":"KELA. 2009. Darkweb intelligence firm: KELA. https:\/\/www.kelacyber.com\/"},{"key":"e_1_3_2_1_64_1","doi-asserted-by":"publisher","DOI":"10.1145\/3548606.3560615"},{"key":"e_1_3_2_1_65_1","volume-title":"250 Phishing Statistics and Trends You Must Know","author":"Labs Keepnet","year":"2025","unstructured":"Keepnet Labs. 2024. 250 Phishing Statistics and Trends You Must Know in 2025. https:\/\/keepnetlabs.com\/blog\/top-phishing-statistics-and-trends-you-must-know"},{"key":"e_1_3_2_1_66_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2019.23055"},{"key":"e_1_3_2_1_67_1","unstructured":"Pei Han Liao. 2025. SEO Poisoning Attack Targets Chinese-Speaking Users with Fake Software Sites. https:\/\/www.fortinet.com\/blog\/threat-research\/seo-poisoning-attack-targets-chinese-speaking-users-with-fake-software-sites"},{"key":"e_1_3_2_1_68_1","unstructured":"Argo Market. 2023. Argo Market. http:\/\/argo4y7i55eafmunecspkroynos76c7px7l6or3cdbpekltxqlxqjmqd.onion"},{"key":"e_1_3_2_1_69_1","unstructured":"King Market. 2021. King Market. http:\/\/kingl5yq6n3h5b6bsc3ut7uytjdecvla3jbmhcofu4nzsogoap2oqnid.onion"},{"key":"e_1_3_2_1_70_1","volume-title":"http:\/\/osirisdaec7ufbb3sbe3r355b2s7lwvw726l4z4oumg6kdddnomht3qd.onion Year based on first archived snapshot of Tor Link listing (Wayback","author":"Market Osiris","year":"2025","unstructured":"Osiris Market. 2025a. Osiris Market. http:\/\/osirisdaec7ufbb3sbe3r355b2s7lwvw726l4z4oumg6kdddnomht3qd.onion Year based on first archived snapshot of Tor Link listing (Wayback, 2025-08-09)."},{"key":"e_1_3_2_1_71_1","unstructured":"Stargate Market. 2025b. Stargate Market. http:\/\/emskd5wz645mvyadsfhcomuwuj3j32ejy6jcqhmcepno3dboyqze2pyd.onion Year based on archived snapshot of Tor Link listing (archive.md\/XLUuO)."},{"key":"e_1_3_2_1_72_1","unstructured":"MCS. 1984. Darkweb intelligence firm: MCS. https:\/\/www.micromindercs.com\/dark-web-monitoring-threat-intel-solutions"},{"key":"e_1_3_2_1_73_1","unstructured":"Microsoft Defender Experts. 2023. Detecting and Mitigating a Multi-Stage AiTM Phishing and BEC Campaign. https:\/\/www.microsoft.com\/en-us\/security\/blog\/2023\/06\/08\/detecting-and-mitigating-a-multi-stage-aitm-phishing-and-bec-campaign\/"},{"key":"e_1_3_2_1_74_1","unstructured":"Munit. 2016. Darkweb intelligence firm: Munit. https:\/\/munit.io\/"},{"key":"e_1_3_2_1_75_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP54263.2024.00169"},{"key":"e_1_3_2_1_76_1","doi-asserted-by":"publisher","DOI":"10.1109\/ECRIME.2018.8376206"},{"key":"e_1_3_2_1_77_1","unstructured":"U.S. Department of Justice. 2023. Justice Department Investigation Leads to Takedown of Darknet Cryptocurrency Mixer (ChipMixer). https:\/\/www.justice.gov\/archives\/opa\/pr\/justice-department-investigation-leads-takedown-darknet-cryptocurrency-mixer-processed-over-3"},{"key":"e_1_3_2_1_78_1","unstructured":"U.S. Department of the Treasury. 2022. U.S. Treasury Sanctions Notorious Virtual Currency Mixer Tornado Cash. https:\/\/home.treasury.gov\/news\/press-releases\/jy0916"},{"key":"e_1_3_2_1_79_1","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2023.3235409"},{"key":"e_1_3_2_1_80_1","unstructured":"OpenAI. 2024. GPT-4o mini. https:\/\/openai.com\/index\/gpt-4o-mini-advancing-cost-efficient-intelligence\/"},{"key":"e_1_3_2_1_81_1","unstructured":"Outpost24. 2001. Darkweb intelligence firm: Outpost24. https:\/\/outpost24.com\/"},{"key":"e_1_3_2_1_82_1","unstructured":"Steve Pederson. 2013. White paper: Understanding the Deep Web in 10 minutes."},{"key":"e_1_3_2_1_83_1","unstructured":"Jay Peters. 2022. EA's new PC app is here to replace Origin. https:\/\/www.theverge.com\/2022\/10\/7\/23392775\/ea-new-pc-app-launcher-replace-origin-macos"},{"key":"e_1_3_2_1_84_1","unstructured":"Deerendra Prasad. 2025. Threat Spotlight: A million phishing-as-a-service attacks in two months highlight a fast-evolving threat. https:\/\/blog.barracuda.com\/2025\/03\/19\/threat-spotlight-phishing-as-a-service-fast-evolving-threat"},{"key":"e_1_3_2_1_85_1","unstructured":"Prescient. 2008. Darkweb intelligence firm: Prescient. https:\/\/prescient.com\/dark-web-intelligence\/"},{"key":"e_1_3_2_1_86_1","unstructured":"Rapid7. 2000. Darkweb intelligence firm: Rapid7. https:\/\/www.rapid7.com\/"},{"key":"e_1_3_2_1_87_1","unstructured":"Recorded. 2009. Darkweb intelligence firm: Recorded. https:\/\/www.recordedfuture.com\/"},{"key":"e_1_3_2_1_88_1","unstructured":"ReliaQuest. 2007. Darkweb intelligence firm: ReliaQuest. https:\/\/reliaquest.com\/"},{"key":"e_1_3_2_1_89_1","volume-title":"Stealer Logs: Everything You Need to Know. https:\/\/socradar.io\/stealer-logs-everything-you-need-to-know\/","author":"Research Radar","year":"2025","unstructured":"SOCRadar Research. 2025. Stealer Logs: Everything You Need to Know. https:\/\/socradar.io\/stealer-logs-everything-you-need-to-know\/"},{"key":"e_1_3_2_1_90_1","unstructured":"Mark Risher. 2017. Protecting You Against Phishing. https:\/\/security.googleblog.com\/2017\/05\/protecting-you-against-phishing.html"},{"key":"e_1_3_2_1_91_1","volume-title":"Discord Transparency Report: July \u2014","author":"Safety Discord","year":"2020","unstructured":"Discord Safety. 2021. Discord Transparency Report: July \u2014 Dec 2020. https:\/\/discord.com\/blog\/discord-transparency-report-july-dec-2020"},{"key":"e_1_3_2_1_92_1","volume-title":"Kobra Khanmohammadi, and Shirin Nilizadeh.","author":"Roy Sayak Saha","year":"2024","unstructured":"Sayak Saha Roy, Elham Pourabbas Vafa, Kobra Khanmohammadi, and Shirin Nilizadeh. 2024. DarkGram: a large-scale analysis of cybercriminal activity channels on Telegram. arXiv preprint arXiv:2409.14596 (2024)."},{"key":"e_1_3_2_1_93_1","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2024.3352629"},{"key":"e_1_3_2_1_94_1","volume-title":"Jonathan Leitschuh, Jeongkyu, Yamuna Krishnamurthy, and Christine Doig.","author":"Santos A\u00e9cio","year":"2025","unstructured":"A\u00e9cio Santos, Kien Pham, Deepti Verma, Juliana Freire, Aron Ahmadia, Tommy Ellqvist, Ayman Abdel Ghany, Jonathan Leitschuh, Jeongkyu, Yamuna Krishnamurthy, and Christine Doig. 2025. ache. https:\/\/github.com\/VIDA-NYU\/ache"},{"key":"e_1_3_2_1_95_1","unstructured":"Alexandra Sentenac. 2025. MFA Under Attack: AiTM Phishing Kits Abusing Legitimate Services (Tycoon 2FA). https:\/\/www.darktrace.com\/blog\/mfa-under-attack-aitm-phishing-kits-abusing-legitimate-services"},{"key":"e_1_3_2_1_96_1","volume-title":"Smishing: Package Tracking Text Scams. https:\/\/www.uspis.gov\/news\/scam-article\/smishing-package-tracking-text-scams","author":"Postal Inspection Service U.S.","year":"2025","unstructured":"U.S. Postal Inspection Service. 2025. Smishing: Package Tracking Text Scams. https:\/\/www.uspis.gov\/news\/scam-article\/smishing-package-tracking-text-scams"},{"key":"e_1_3_2_1_97_1","volume-title":"Moshe Avraham and Eilon Bendet","author":"Jake Gionet Shachar Gritzman Tim Kromphardt","year":"2023","unstructured":"Tim Kromphardt Jake Gionet Shachar Gritzman, Moshe Avraham and Eilon Bendet. 2023. Cloud Account Takeover Campaign Leveraging EvilProxy Targets Top-Level Executives at over 100 Global Organizations. https:\/\/www.proofpoint.com\/us\/blog\/email-and-cloud-threats\/cloud-account-takeover-campaign-leveraging-evilproxy-targets-top-level"},{"key":"e_1_3_2_1_98_1","first-page":"493","volume-title":"Nature","volume":"623","author":"Shanahan Murray","year":"2023","unstructured":"Murray Shanahan, Kyle McDonell, and Laria Reynolds. 2023. Role play with large language models. Nature, Vol. 623, 7987 (2023), 493-498."},{"key":"e_1_3_2_1_99_1","volume-title":"Phishing Guidance: Stopping the Attack Cycle at Phase One. https:\/\/www.cisa.gov\/sites\/default\/files\/2023-10\/Phishing%20Guidance%20-%20Stopping%20the%20Attack%20Cycle%20at%20Phase%20One_508c.pdf","author":"Multi-State Information Sharing and Analysis Center (MS-ISAC).","year":"2023","unstructured":"Multi-State Information Sharing and Analysis Center (MS-ISAC). 2023. Phishing Guidance: Stopping the Attack Cycle at Phase One. https:\/\/www.cisa.gov\/sites\/default\/files\/2023-10\/Phishing%20Guidance%20-%20Stopping%20the%20Attack%20Cycle%20at%20Phase%20One_508c.pdf"},{"key":"e_1_3_2_1_100_1","unstructured":"SocRadar. 2019. Darkweb intelligence firm: SocRadar. https:\/\/socradar.io\/"},{"key":"e_1_3_2_1_101_1","volume-title":"24th USENIX security symposium (USENIX security 15). 33-48.","author":"Soska Kyle","unstructured":"Kyle Soska and Nicolas Christin. 2015. Measuring the longitudinal evolution of the online anonymous marketplace ecosystem. In 24th USENIX security symposium (USENIX security 15). 33-48."},{"key":"e_1_3_2_1_102_1","volume-title":"Exploring and analysing surface, deep, dark web and attacks. Security Incidents & Response Against Cyber Attacks","author":"Sultana Jabeen","year":"2021","unstructured":"Jabeen Sultana and Abdul Khader Jilani. 2021. Exploring and analysing surface, deep, dark web and attacks. Security Incidents & Response Against Cyber Attacks (2021), 85-96."},{"key":"e_1_3_2_1_103_1","doi-asserted-by":"publisher","DOI":"10.1145\/3308560.3316502"},{"key":"e_1_3_2_1_104_1","unstructured":"Teamt5. 2017. Darkweb intelligence firm: Teamt5. https:\/\/teamt5.org\/en\/"},{"key":"e_1_3_2_1_105_1","unstructured":"TheLance. 2021. The Rise of Discord Among Students During the COVID-19 Pandemic. https:\/\/www.thelance.ca\/2021\/09\/27\/the-rise-of-discord-among-students-during-the-covid-19-pandemic\/"},{"key":"e_1_3_2_1_106_1","unstructured":"ThreatMon. 2018. Darkweb intelligence firm: ThreatMon. https:\/\/threatmon.io\/"},{"key":"e_1_3_2_1_107_1","volume-title":"https:\/\/tor.link\/site\/dig-ai\/info Tor Hidden Service Directory","year":"2020","unstructured":"Torlink. 2020. Torlink. https:\/\/tor.link\/site\/dig-ai\/info Tor Hidden Service Directory; Year based on WHOIS creation date: 2020-11-297."},{"key":"e_1_3_2_1_108_1","unstructured":"Bill Toulas. 2022. Google SMTP Relay Service Abused for Sending Phishing Emails. https:\/\/www.bleepingcomputer.com\/news\/security\/google-smtp-relay-service-abused-for-sending-phishing-emails\/"},{"key":"e_1_3_2_1_109_1","unstructured":"Colleen Tressler. 2022. Netflix phishing scam: Don't take the bait. https:\/\/consumer.ftc.gov\/consumer-alerts\/2018\/12\/netflix-phishing-scam-dont-take-bait"},{"key":"e_1_3_2_1_110_1","volume-title":"Sendception: SendGrid Impersonation Campaign. https:\/\/www.uvcyber.com\/hubfs\/downloadable-content\/product%2Dsheets\/Sendception%20-%20SendGrid%20Impersonation%20Campaign.pdf","author":"UltraViolet","year":"2024","unstructured":"UltraViolet Cyber (UVCyber). 2024. Sendception: SendGrid Impersonation Campaign. https:\/\/www.uvcyber.com\/hubfs\/downloadable-content\/product%2Dsheets\/Sendception%20-%20SendGrid%20Impersonation%20Campaign.pdf"},{"key":"e_1_3_2_1_111_1","volume-title":"Classification of Web Phishing Kits for early detection by platform providers. arXiv preprint arXiv:2210.08273","author":"Venturi Andrea","year":"2022","unstructured":"Andrea Venturi, Michele Colajanni, Marco Ramilli, and Giorgio Valenziano Santangelo. 2022. Classification of Web Phishing Kits for early detection by platform providers. arXiv preprint arXiv:2210.08273 (2022)."},{"key":"e_1_3_2_1_112_1","unstructured":"Verizon. 2024. 2024 Data Breach Investigations Report. https:\/\/www.verizon.com\/business\/resources\/reports\/2024-dbir-data-breach-investigations-report.pdf"},{"key":"e_1_3_2_1_113_1","unstructured":"Web-IQ. 2011. Darkweb intelligence firm: Web-IQ. https:\/\/www.web-iq.com\/"},{"key":"e_1_3_2_1_114_1","volume-title":"http:\/\/shadowxn3o3kvvkbjyaoe33emqxrtadijp7xybizbht2thb6x5dvfhad.onion Year based on first archived snapshot of onion.live listing (Wayback","author":"Shadow X.","year":"2025","unstructured":"Shadow X. 2025. Shadow X. http:\/\/shadowxn3o3kvvkbjyaoe33emqxrtadijp7xybizbht2thb6x5dvfhad.onion Year based on first archived snapshot of onion.live listing (Wayback, 2025-05-19);."},{"key":"e_1_3_2_1_115_1","volume-title":"Companion Proceedings of the 2019 World Wide Web Conference (WWW '19 Companion). 2225-2235","author":"Yoon Changhoon","year":"2019","unstructured":"Changhoon Yoon, Kwanwoo Kim, Yongdae Kim, Seungwon Shin, and Sooel Son. 2019. Doppelg\u00e4ngers on the dark web: a large-scale assessment on phishing hidden web services. In Companion Proceedings of the 2019 World Wide Web Conference (WWW '19 Companion). 2225-2235."},{"key":"e_1_3_2_1_116_1","volume-title":"A Decade-long Landscape of Advanced Persistent Threats: Longitudinal Analysis and Global Trends. arXiv preprint arXiv:2509.07457","author":"Yuldoshkhujaev Shakhzod","year":"2025","unstructured":"Shakhzod Yuldoshkhujaev, Mijin Jeon, Doowon Kim, Nick Nikiforakis, and Hyungjoon Koo. 2025. A Decade-long Landscape of Advanced Persistent Threats: Longitudinal Analysis and Global Trends. arXiv preprint arXiv:2509.07457 (2025)."},{"key":"e_1_3_2_1_117_1","unstructured":"ZeorFox. 2013. Darkweb intelligence firm: ZeroFox. https:\/\/www.zerofox.com\/"},{"key":"e_1_3_2_1_118_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP40001.2021.00021"},{"key":"e_1_3_2_1_119_1","unstructured":"Xiaopeng Zhang. 2024. Deep Analysis of Snake Keylogger's New Variant. https:\/\/www.fortinet.com\/blog\/threat-research\/deep-analysis-of-snake-keylogger-new-variant endthebibl"}],"event":{"name":"WWW '26: The ACM Web Conference 2026","location":"Dubai United Arab Emirates","sponsor":["SIGWEB ACM Special Interest Group on Hypertext, Hypermedia, and Web"]},"container-title":["Proceedings of the ACM Web Conference 2026"],"original-title":[],"deposited":{"date-parts":[[2026,4,10]],"date-time":"2026-04-10T16:32:46Z","timestamp":1775838766000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3774904.3792737"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,4,12]]},"references-count":119,"alternative-id":["10.1145\/3774904.3792737","10.1145\/3774904"],"URL":"https:\/\/doi.org\/10.1145\/3774904.3792737","relation":{},"subject":[],"published":{"date-parts":[[2026,4,12]]},"assertion":[{"value":"2026-04-12","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}