“Invest in crypto!”: An analysis of investment scam advertisements found in Bitcointalk

This paper investigates the evolution of investment scam lures and scam-related keywords in the cryptocurrency online forum Bitcointalk over a period of 12 years. Our findings show a shift in scam-related keywords found within posts in the forum, where “Ponzi” was the most popular and most frequently mentioned in 2014 and 2018 and “HYIP” appeared more often in 2018 and 2021. We also identify that the financial principle is the tactic more likely to be used to lure people into investment scams from 2015 until 2017, coinciding with the period when “Ponzi” was the most commonly found keyword. This is followed by a transition to the authority and distraction principles from 2018 until 2022, which also coincides with the increase of popularity of “HYIP”. We collect more than 17.8M posts from 399k threads from the forum from July 2010 until June 2022. Our longitudinal analysis shows the popularity transition between subforums and keywords across time. We design a categorisation criteria and annotate 4,218 posts from 2,630 threads based on it. We then use the annotated sample to train four machine learning statistical models. We use the best performing model to classify all 281k English-language threads into four categories: overt scams, potential scams, scam comments and not investment scam related. We analyze the frequency changes of scam-related threads across the 12 year period and observe that overt and potential scams peaked in 2015 and 2018 respectively. We see that potential scams also increased during the COVID-19 pandemic. We use heuristics to pinpoint the types of cryptocurrencies most frequently used within scam advertisements. Bitcoin is most commonly found in potential scams while Ethereum appears more often than other cryptocurrencies in overt scams. We use machine learning classifiers to identify the scam actor types behind the posts categorised as overt and potential scams. We also classify the type of lure used by scammers. Our results indicate that the time principle is not a tactic used as frequently as expected. Finally, we observe the influence of the pandemic in the strategies used to lure victims, reflected in higher than expected use of the kindness principle in 2021 and 2022

“Get a higher return on your savings!”: Comparing adverts for cryptocurrency investment scams across platforms

This work compares machine learning methods using supervised, semi-supervised and unsupervised learning, to classify advertisements for cryptocurrency related investment scams found in the online forum Bitcointalk, and the social media platform Reddit. We extract more than 24.2 million posts from Bitcointalk and use Reddit's API to collect 2,108 submissions. We train and compare several multi-class text classification approaches and use the models with highest accuracy and F-measure to identify cryptocurrency investment scam advertisements found on both platforms. We discover around five percent of all posts collected on both sites are potential scams. We then use another text classifier to identify the scam actors involved in these investment scam advertisements. We also discover the lures used within these fraudulent adverts and find the main differences in luring techniques used between Bitcointalk and Reddit. We identify that the most prevalent lure type uses the financial principle, followed by the distraction principle in Bitcointalk, and by the authority principle in Reddit. Finally, we use subreddits as communities' proxies and compare scam advertisements within them to identify whether pensioners are being specifically targeted by cryptocurrency scam adverts. Our results show that retirement subreddits do not contain a higher number of cryptocurrency investment scam adverts compared to other investment focused subreddits

Follow the money: The relationship between currency exchange and illicit behaviour in an underground forum

Underground forums are used to discuss and organise cybercrime (as well as more conventional social activities). These forums are also commonly used for exchanging various digital currencies, either gained through the profits of crime or through less controversial means. Understanding the link between discussions of illicit behaviour and currency exchange can provide insights to identify money laundering and other parts of the cybercrime supply chain. In this paper we use natural language processing to classify posts from HackForums by crime type over a period of more than 10 years. To the best of our knowledge, this is the first time that this type of classification has been used for this large forum dataset. Although the majority of conversations in the forum were identified as relating to non-criminal discussions, we concentrate on the types of crimes being discussed by those exchanging currencies. We find the most popular topics are related to trading credentials and bots and malware. PayPal was one of the most widely advertised digital currencies and we observe significant displacement from Liberty Reserve to Bitcoin after the former was taken down in 2013. Rather than an explicit 'cashing out' mechanism, in which cryptocurrencies gained through crime flow into state-backed fiat currencies, we instead see a circulation of capital between different forms, as cash is held and then cashed back and forward according to movements in the wider currency market. We continue our examination of discussions of cryptocurrencies and explore how the underground market has reacted to new opportunities, with a qualitative case study about Facebook's putative 'Diem' coin. We find that while most discussions are related to the technical details and potential investment opportunities, some potential cybercrime use-cases are raised.This work is supported by the Engineering and Physical Sciences Research Council (EPSRC) [grant number EP/V026178/1] and the Economic and Social Research Council (ESRC) [grant number ES/T008466/1

A Graph-Based Stratified Sampling Methodology for the Analysis of (Underground) Forums

Researchers analyze underground forums to study abuse and cybercrime activities. Due to the size of the forums and the domain expertise required to identify criminal discussions, most approaches employ supervised machine learning techniques to automatically classify the posts of interest. Human annotation is costly. How to select samples to annotate that account for the structure of the forum? We present a methodology to generate stratified samples based on information about the centrality properties of the population and evaluate classifier performance. We observe that by employing a sample obtained from a uniform distribution of the post degree centrality metric, we maintain the same level of precision but significantly increase the recall (+30%) compared to a sample whose distribution is respecting the population stratification. We find that classifiers trained with similar samples disagree on the classification of criminal activities up to 33% of the time when deployed on the entire forum.</p