Researchers Analyze the Popularity of Hacker Forums

Recently, experts from Digital Shadows noticed that the operators of the English-language carding forum Altenen were boasting about their website’s visitor numbers and revenue, citing data from the analytics service HypeStat. Altenen’s administrators clearly shared this information in hopes of promoting themselves and attracting more visitors. Observing this, the researchers decided to independently analyze the traffic of other popular cybercriminal resources and compare the findings with their own impressions of these sites.

In addition to Altenen, the researchers examined data from other English-language forums such as RaidForums, Nulled, Cracked TO, and Cracking King, the German-language forum Crimenetwork, as well as Russian-language resources Exploit and XSS. The data for analysis was sourced from public platforms (HypeStat and Alexa) and included site rankings, the number of unique daily visitors, visitor geography, traffic sources, and estimated daily revenue. Naturally, the collected statistics do not include visits to .onion domains, so the data is not exhaustive.

Key Findings from the Analysis

• Sites like Altenen, Nulled, Exploit, and XSS have shown significant traffic growth over the past 90 days. Some administrators use these statistics to promote their services.
• According to Digital Shadows, these sites likely use bots and artificial traffic to manipulate visitor numbers and boost their rankings. For example, Altenen’s sharp rise in ranking appears too good to be true, especially since no other popular forum, such as RaidForums, showed similar growth during the same period.
• The data indicates that the average time users spend on hacker forums ranges from 6 to 22 minutes. However, the researchers believe these numbers may not be very accurate. For instance, users reportedly spend less than 8 minutes on Exploit, but since it is a completely closed forum with no random visitors, actual user engagement is likely much higher.
• When it comes to advertising revenue, the researchers argue that analytics services do not reflect the true economics of these forums. Hacker sites may earn money from paid memberships, and some receive commissions from each transaction.

Manipulation of Traffic Metrics

The main conclusion from this analysis is that traffic metrics can be manipulated, including through the use of bots and VPNs. Some hacker platforms use these statistics to draw attention to themselves. Moreover, it is nearly impossible to get an accurate picture of what is really happening based solely on these numbers.

“Context is crucial when evaluating forums. Numbers alone do not provide a complete picture of a forum’s content, its users, or the real economics of the resource, nor do they explain fluctuations in visitor numbers. Gaining a deep understanding of the cybercriminal underground requires a lot of manual work and time. You cannot form an accurate picture based only on website traffic statistics. Such research once again highlights the need for ongoing human involvement, and the importance of combining manual and automated approaches. Big data analysis can give a general idea of what’s happening, but without human intelligence, many important details and nuances will be missed,” summarizes Digital Shadows expert Kacey Clark.