{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,14]],"date-time":"2026-05-14T05:08:55Z","timestamp":1778735335692,"version":"3.51.4"},"reference-count":30,"publisher":"MDPI AG","issue":"5","license":[{"start":{"date-parts":[[2026,5,12]],"date-time":"2026-05-12T00:00:00Z","timestamp":1778544000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/501100000780","name":"European Union","doi-asserted-by":"crossref","award":["C084\/23"],"award-info":[{"award-number":["C084\/23"]}],"id":[{"id":"10.13039\/501100000780","id-type":"DOI","asserted-by":"crossref"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Information"],"abstract":"<jats:p>Credit card fraud constitutes a core component of the contemporary cybercrime economy, in which dark web carding forums play a pivotal role in coordinating, commoditising, and disseminating illicit activities. While prior research has primarily focused on transaction-level fraud detection, comparatively limited attention has been devoted to the systematic analysis of the social and organisational ecosystems within which these practices are enacted. This study addresses this gap by proposing and validating a domain-specific taxonomy for the automated classification of content in P2P carding forums. To this end, we adopt an iterative, data-driven methodology that integrates large language models (LLMs), lexical co-occurrence analysis, and semantic network analysis. Using a corpus of 3260 posts, we define and operationalise a taxonomy structured around four predicates: activity context, actor role, products and services, and technical tools, supported by a locally deployed LLM (Llama 4 Scout). A human-annotated subset was additionally used to evaluate inter-annotator agreement and standard classification metrics, complementing the coverage-based assessment and enabling comparison against a keyword-based baseline. Evaluation was further strengthened through manual benchmarking, confidence intervals, sensitivity analysis of key pipeline components, and comparison with alternative open-weight models. The results indicate that the proposed taxonomy achieves broad corpus-level representational coverage, with at least one semantic dimension identified in 98.71% of posts. However, coverage is uneven across predicates: activity-context is highly explicit, whereas actor-role and product-service show only moderate coverage and technique-tool remains substantially underrepresented and ambiguous. Overall, the findings show that combining domain-specific taxonomies with LLM-assisted classification and network analysis offers a robust framework for understanding and monitoring carding ecosystems in the dark web.<\/jats:p>","DOI":"10.3390\/info17050469","type":"journal-article","created":{"date-parts":[[2026,5,13]],"date-time":"2026-05-13T07:44:26Z","timestamp":1778658266000},"page":"469","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["Extending Taxonomies and Mapping P2P Credit Card Fraud (Carding) Forums on the Dark Web"],"prefix":"10.3390","volume":"17","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-3359-4952","authenticated-orcid":false,"given":"Jose-Amelio","family":"Medina-Merodio","sequence":"first","affiliation":[{"name":"Departamento de las Ciencias de la Computaci\u00f3n, Universidad de Alcal\u00e1, 28805 Alcal\u00e1 de Henares, Spain"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0001-0610-8210","authenticated-orcid":false,"given":"Mikel","family":"Ferrer-Oliva","sequence":"additional","affiliation":[{"name":"Departamento de las Ciencias de la Computaci\u00f3n, Universidad de Alcal\u00e1, 28805 Alcal\u00e1 de Henares, Spain"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Jos\u00e9","family":"Fern\u00e1ndez L\u00f3pez","sequence":"additional","affiliation":[{"name":"Departamento de las Ciencias de la Computaci\u00f3n, Universidad de Alcal\u00e1, 28805 Alcal\u00e1 de Henares, Spain"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Alejandro","family":"Ruiz-Zambrano","sequence":"additional","affiliation":[{"name":"Departamento de las Ciencias de la Computaci\u00f3n, Universidad de Alcal\u00e1, 28805 Alcal\u00e1 de Henares, Spain"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7632-8609","authenticated-orcid":false,"given":"Adri\u00e1n","family":"Dom\u00ednguez-D\u00edaz","sequence":"additional","affiliation":[{"name":"Departamento de las Ciencias de la Computaci\u00f3n, Universidad de Alcal\u00e1, 28805 Alcal\u00e1 de Henares, Spain"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"1968","published-online":{"date-parts":[[2026,5,12]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"155","DOI":"10.1080\/17440572.2013.787925","article-title":"Exploring the social organisation and structure of stolen data markets","volume":"14","author":"Holt","year":"2013","journal-title":"Glob. Crime"},{"key":"ref_2","doi-asserted-by":"crossref","first-page":"1313","DOI":"10.1177\/0002764217734262","article-title":"Shuffle Up and Deal: Use of a Capture-Recapture Method to Estimate the Size of Stolen Data Markets","volume":"61","author":"Macdonald","year":"2017","journal-title":"Am. Behav. Sci."},{"key":"ref_3","doi-asserted-by":"crossref","first-page":"67","DOI":"10.1016\/j.future.2024.03.025","article-title":"A Big Data architecture for early identification and categorization of dark web sites","volume":"157","author":"Sandlin","year":"2024","journal-title":"Future Gener. Comput. Syst.-Int. J. Escience"},{"key":"ref_4","doi-asserted-by":"crossref","first-page":"35","DOI":"10.1109\/TETC.2015.2397395","article-title":"Then and Now On the Maturity of the Cybercrime Markets The Lesson That Black-Hat Marketeers Learned","volume":"4","author":"Allodi","year":"2016","journal-title":"IEEE Trans. Emerg. Top. Comput."},{"key":"ref_5","first-page":"63","article-title":"Cryptomarkets and carding: Influence on supply and demand","volume":"52","author":"Guillot","year":"2019","journal-title":"Criminologie"},{"key":"ref_6","doi-asserted-by":"crossref","first-page":"516","DOI":"10.1080\/10439463.2013.780227","article-title":"Trust among cybercriminals? Carding forums, uncertainty and implications for policing","volume":"23","author":"Yip","year":"2013","journal-title":"Polic. Soc."},{"key":"ref_7","doi-asserted-by":"crossref","first-page":"185","DOI":"10.1177\/10439862231157519","article-title":"The \u201cYelp-Ification\u201d of the Dark Web: An Exploration of the Use of Consumer Feedback in Dark Web Markets","volume":"39","author":"Brinck","year":"2023","journal-title":"J. Contemp. Crim. Justice"},{"key":"ref_8","doi-asserted-by":"crossref","first-page":"1243","DOI":"10.1007\/s00500-019-03958-9","article-title":"An intelligent credit card fraud detection approach based on semantic fusion of two classifiers","volume":"24","author":"Darwish","year":"2020","journal-title":"Soft Comput."},{"key":"ref_9","doi-asserted-by":"crossref","first-page":"40","DOI":"10.1016\/j.asoc.2014.06.042","article-title":"A novel model for credit card fraud detection using Artificial Immune Systems","volume":"24","author":"Halvaiee","year":"2014","journal-title":"Appl. Soft Comput."},{"key":"ref_10","doi-asserted-by":"crossref","first-page":"43","DOI":"10.5530\/jscires.13.1.4","article-title":"Bibliometric Analysis of Recent Trends in Machine Learning for Online Credit Card Fraud Detection","volume":"13","author":"Hove","year":"2024","journal-title":"J. Scientometr. Res."},{"key":"ref_11","doi-asserted-by":"crossref","first-page":"130","DOI":"10.1016\/j.engappai.2018.07.008","article-title":"How Artificial Intelligence and machine learning research impacts payment card fraud detection: A survey and industry benchmark","volume":"76","author":"Krause","year":"2018","journal-title":"Eng. Appl. Artif. Intell."},{"key":"ref_12","doi-asserted-by":"crossref","first-page":"618","DOI":"10.1177\/0894439320924735","article-title":"Behind the Scenes of the Underworld: Hierarchical Clustering of Two Leaked Carding Forum Databases","volume":"40","author":"Kigerl","year":"2022","journal-title":"Soc. Sci. Comput. Rev."},{"key":"ref_13","doi-asserted-by":"crossref","first-page":"111","DOI":"10.1007\/s12117-012-9159-z","article-title":"Cybercrime and virtual offender convergence settings","volume":"15","author":"Soudijn","year":"2012","journal-title":"Trends Organ. Crime"},{"key":"ref_14","doi-asserted-by":"crossref","first-page":"442","DOI":"10.1057\/sj.2013.39","article-title":"Criminals and signals: An assessment of criminal performance in the carding underworld","volume":"29","year":"2016","journal-title":"Secur. J."},{"key":"ref_15","doi-asserted-by":"crossref","first-page":"1059","DOI":"10.1080\/07421222.2016.1267528","article-title":"Identifying and Profiling Key Sellers in Cyber Carding Community: AZSecure Text Mining System","volume":"33","author":"Li","year":"2016","journal-title":"J. Manag. Inf. Syst."},{"key":"ref_16","doi-asserted-by":"crossref","first-page":"24","DOI":"10.1145\/3409455","article-title":"An Ensemble of Ensembles Approach to Author Attribution for Internet Relay Chat Forensics","volume":"11","author":"Shao","year":"2020","journal-title":"ACM Trans. Manag. Inf. Syst."},{"key":"ref_17","doi-asserted-by":"crossref","unstructured":"Webber, C., and Yip, M. (2020). Humanizing the cybercriminal Markets, forums, and the carding subculture. The Human Factor of Cybercrime, Routledge.","DOI":"10.4324\/9780429460593-12"},{"key":"ref_18","doi-asserted-by":"crossref","first-page":"39700","DOI":"10.1109\/ACCESS.2022.3166891","article-title":"Credit Card Fraud Detection Using State-of-the-Art Machine Learning and Deep Learning Algorithms","volume":"10","author":"Alarfaj","year":"2022","journal-title":"IEEE Access"},{"key":"ref_19","doi-asserted-by":"crossref","first-page":"35","DOI":"10.1145\/3641283","article-title":"Credit Card Fraud Detection via Intelligent Sampling and Self-supervised Learning","volume":"15","author":"Chen","year":"2024","journal-title":"ACM Trans. Intell. Syst. Technol."},{"key":"ref_20","first-page":"103618","article-title":"An ensemble learning approach for anomaly detection in credit card data with imbalanced and overlapped classes","volume":"78","author":"Islam","year":"2023","journal-title":"J. Inf. Secur. Appl."},{"key":"ref_21","doi-asserted-by":"crossref","first-page":"158939","DOI":"10.1109\/ACCESS.2024.3487298","article-title":"Machine Learning Methods for Credit Card Fraud Detection: A Survey","volume":"12","author":"Dastidar","year":"2024","journal-title":"IEEE Access"},{"key":"ref_22","doi-asserted-by":"crossref","first-page":"591","DOI":"10.1177\/0894439317730296","article-title":"Profiling Cybercriminals: Topic Model Clustering of Carding Forum Member Comment Histories","volume":"36","author":"Kigerl","year":"2018","journal-title":"Soc. Sci. Comput. Rev."},{"key":"ref_23","doi-asserted-by":"crossref","unstructured":"Wang, F.Z., Dickinson, T., and Ghazi-Tehrani, A. (2025). Not All Money Is the Same: The Meanings of Money in Online Fraud. Crime Delinq.","DOI":"10.1177\/00111287251321442"},{"key":"ref_24","doi-asserted-by":"crossref","first-page":"1244","DOI":"10.1177\/0002764217734271","article-title":"Deviating From the Cybercriminal Script: Exploring Tools of Anonymity (Mis)Used by Carders on Cryptomarkets","volume":"61","author":"Webber","year":"2017","journal-title":"Am. Behav. Sci."},{"key":"ref_25","doi-asserted-by":"crossref","first-page":"519","DOI":"10.1080\/19361610.2021.2024049","article-title":"Investigation of Card Skimming Cases: An Indian Perspective","volume":"18","author":"Shetty","year":"2023","journal-title":"J. Appl. Secur. Res."},{"key":"ref_26","doi-asserted-by":"crossref","first-page":"7562","DOI":"10.1109\/TCE.2024.3482708","article-title":"Your IP Camera Can Be Abused for Payments: A Study of IoT Exploitation for Financial Services Leveraging Shodan and Criminal Infrastructures","volume":"70","author":"Siwakoti","year":"2024","journal-title":"IEEE Trans. Consum. Electron."},{"key":"ref_27","doi-asserted-by":"crossref","unstructured":"Jaffal, N.O., Alkhanafseh, M., and Mohaisen, D. (2025). Large Language Models in Cybersecurity: A Survey of Applications, Vulnerabilities, and Defense Techniques. AI, 6.","DOI":"10.3390\/ai6090216"},{"key":"ref_28","doi-asserted-by":"crossref","unstructured":"Wang, J., Ni, T., Lee, W.B., and Zhao, Q. (2025). A Contemporary Survey of Large Language Model Assisted Program Analysis. arXiv.","DOI":"10.53941\/tai.2025.100006"},{"key":"ref_29","first-page":"28","article-title":"A Survey on Backdoor Threats in Large Language Models (LLMs): Attacks, Defenses, and Evaluation Methods","volume":"1","author":"Zhou","year":"2025","journal-title":"Trans. Artif. Intell."},{"key":"ref_30","unstructured":"The Bootstrap Authors (2026, April 13). Bootstrap Icons: Official Open Source SVG Icon Library for Bootstrap (v1.13.1). Available online: https:\/\/icons.getbootstrap.com\/."}],"container-title":["Information"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2078-2489\/17\/5\/469\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,5,14]],"date-time":"2026-05-14T04:18:54Z","timestamp":1778732334000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2078-2489\/17\/5\/469"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,5,12]]},"references-count":30,"journal-issue":{"issue":"5","published-online":{"date-parts":[[2026,5]]}},"alternative-id":["info17050469"],"URL":"https:\/\/doi.org\/10.3390\/info17050469","relation":{},"ISSN":["2078-2489"],"issn-type":[{"value":"2078-2489","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,5,12]]}}}