Where is Dmitry going? Framing 'migratory' decisions in the criminal underground

Adriana Radu; Jai Wientjes; Luca Allodi; Roy Ricaldi

REVIEW 4 major objections 4 minor 11 references

Where is Dmitry going? Framing 'migratory' decisions in the criminal underground

T0 review · 4 major / 4 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The paper argues that trust-building mechanisms observed in underground forums are mostly absent from Telegram criminal channels, so Telegram is probably limited to low-value crime while still acting as a support layer for forum markets.

desk verdict A clearly framed position paper with a genuinely new role taxonomy for forum-linked Telegram channels, but its headline claim that Telegram lacks trust signals is under-measured and may be an artifact of the forum-derived instrument. read the letter →

arxiv 2411.16291 v1 pith:U5KOZBIF submitted 2024-11-25 cs.CR

Luca Allodi , Roy Ricaldi , Jai Wientjes , Adriana Radu This is my paper · ORCID

classification cs.CR

keywords cybercrimeundergroundtrustsignalingTelegramforumscriminalmarketplacesmigrationdecisionsthreatintelligence

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This position paper asks what drives a cybercriminal, called Dmitry, to choose one underground community over another. It applies a 28-mechanism trust-signaling framework originally developed for criminal forums to about 1.1 million messages from 543 Telegram groups and channels, and finds only a small fraction of those mechanisms appear and are rarely signaled. The authors interpret this as evidence that Telegram's criminal ecosystem is less mature and probably unsuitable for trading highly technological and innovative criminal products, hypothesizing that Telegram may at most support low-value crime such as trading stolen data. A second study of Telegram spaces linked from forum advertisements reveals a coherent support ecosystem of automated services, announcements, proof of credibility, marketplaces, and private communication. The overarching thesis is that studying these market and trust signals could explain, and eventually help act upon, Dmitry's choice of community.

What carries the argument

The argument is carried by two hand-built taxonomies derived through iterative card-sorting of Telegram posts. The trust taxonomy maps the 28 forum trust mechanisms from [3] onto eight Telegram-visible categories: escrow services, Telegram bots, digital wallets, cryptocurrency, moderation rules, user verification or vouching, scam reports, and reviews or feedback. The role taxonomy classifies forum-linked Telegram spaces into six roles: private communication, automated services, announcements, proof of credibility, marketplace, and community building. These taxonomies are the instruments that let the authors measure how institutionalized trust is on Telegram and how Telegram complements rather than replaces forums.

What would settle it

An audit of forum-linked Telegram channels coded for all 28 mechanisms that finds the same density of trust signals as forums, or a documented sale of a novel malware family negotiated entirely on a Telegram channel exhibiting none of the eight taxonomy mechanisms, would refute the paper's central claim.

Watch

Extended reading notes

Core claim

The paper's central claim is that the trust institutions that make criminal forums work are largely missing on Telegram. Applying the 28-mechanism forum framework to 543 Telegram groups and channels, the authors find that only a small fraction of those mechanisms apply, and even those are rarely signaled. They conclude that Telegram is a much less mature environment that may hinder its use for trading highly technological and innovative criminal products, and they hypothesize that Telegram may at most support low-value crime activities. In parallel, they find that Telegram spaces advertised in forum posts form a coherent support ecosystem around traditional forum markets, with roles such as automated payments, announcements, proof of credibility, marketplaces, and private communication. The overarching thesis is that Dmitry's choice of community can be explained through these market and trust signals, and therefore potentially acted upon.

Load-bearing premise

The entire comparison rests on assuming that the 28 trust mechanisms defined for forums are the correct and complete lens for Telegram; if Telegram builds trust through platform-specific or forum-carried signals, the finding of few signals would be an artifact of the instrument rather than a property of the ecosystem.

Editorial extensions

If this is right

If Telegram cannot generate strong trust signals, high-impact or innovative criminal products such as new malware and specialized service infrastructures are unlikely to migrate there, leaving forums as the locus of threat innovation.
Telegram's emerging role is complementary: it handles automated payments, customer support, announcements, and credibility displays for products advertised on forums, so disruption efforts aimed only at Telegram may not eliminate the underlying market.
Dmitry's movement is not random: communities with institutionalized trust mechanisms attract successful criminals, so platform choice itself acts as a market signal.
Because some Telegram roles co-occur, such as announcements with marketplaces and automation with private communication, the ecosystem is developing a division of labor that can support traditional crime even if it cannot bootstrap trust from scratch.
A full model of Dmitry's migration is probably out of reach, but push-pull and prospect-theory analogies from migration economics provide a way to think about which types of users end up in which types of communities.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The two studies sit in tension: if trust is inherited from forums when buyers follow an advertised Telegram link, then the 'few signals' finding for snowball-discovered channels may underestimate Telegram's maturity for users who arrive pre-vouched; a direct test would compare trust-signal rates between forum-linked and snowball-discovered channels.
The 28-mechanism lens may be the wrong instrument for Telegram; native signals such as channel view counts, forwarded review provenance, pinned admin vouches, and bot-mediated escrow could perform the same economic function without looking like forum mechanisms, which would make 'few signals' an artifact of the comparison rather than a property of the platform.
If the support-ecosystem finding generalizes, threat intelligence should map Telegram as the logistics layer of underground markets, focusing on payments, customer support, and restock updates whose disruption would raise transaction costs even if forums remain.
The migration-economics analogy yields testable extensions: channels that add escrow bots and scam reports should attract higher-value listings, and removing a forum's trust signals should push vendors toward Telegram rather than toward another forum.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

The genuinely new thing here is the mapping. The authors took Campobasso's forum trust framework to Telegram, manually coded 543 channels (about 1.1M messages), and produced a Telegram-specific taxonomy that adapts the original 28 mechanisms into nine observable ones, including platform-native 'Telegram Bots'. The second empirical piece, a role taxonomy for 500 forum threads that link to Telegram, stands independent of the forum framework and is the most useful contribution. Six roles (Private Communication, Automated Services, Announcements, Proof of Credibility, Marketplace, Community Building) and their distribution across forum sections give a concrete, plausible picture of how Telegram supports forum-based trade. The observation that Marketplace and Proof-of-Credibility roles dominate for Malware and Documents, while Automated Services carry server and traffic trading, is specific and believable.

The soft spot is the load-bearing inference in Section 3.1. The claim that 'a small fraction' of forum mechanisms apply and that trust signals are 'few and rarely signaled' is not actually measured. There are no per-mechanism counts, rates, or confidence intervals, and the 'rarely signaled' finding rests on an undescribed keyword matching pass. More importantly, the instrument is the forum codebook from [3]. If Telegram users signal trust through forwarded forum vouches, pinned admin endorsements, bot-mediated escrow, or channel age, the codebook would not capture them, and the sparse-signal conclusion could be an artifact. The paper itself shows the codebook had to be adapted—Telegram Bots is a new mechanism—which cuts both ways. Section 3.2 then finds that forum-linked Telegram channels commonly perform marketplace and proof-of-credibility roles for malware and documents, which sits awkwardly with the hypothesis that Telegram 'may at most support low-value crime activities'. The authors are transparent that these are preliminary results, which is to their credit, but the headline claim is underdetermined by the reported evidence.

Who benefits? A reader working on cybercrime ecosystems or threat intelligence will find the role taxonomy and the 'not all Telegram places are the same' point worth citing now, even before the trust-mechanism claim is firmed up. The migration framing is speculative but sensible. This deserves a serious referee: it is important enough and has enough empirical novelty to merit peer review, though revision should require coding procedures, inter-coder agreement, prevalence counts, and a more careful treatment of what the adapted framework can and cannot see.

Referee Report

4 major / 4 minor

Summary. This position paper asks what market signals drive a hypothetical cybercriminal ("Dmitry") to join one underground community rather than another, focusing on migration from forums to Telegram. The authors first apply the 28-feature trust-mechanism framework of Campobasso et al. [3] to 543 Telegram groups/channels (about 1.1M messages) seeded from public repositories and snowballing. They report that only a small fraction of forum mechanisms appear on Telegram and that these are "rarely signaled," leading to the hypothesis that Telegram may at most support low-value crime. In a second study, they sample 500 forum threads that advertise products linking to Telegram, identify six roles (private communication, automated services, announcements, proof of credibility, marketplace, community building), and find that Telegram channels often serve as marketplaces and proof-of-credibility venues for malware and documents. The paper concludes by proposing analogies from migration economics to frame future research on Dmitry's choices.

Significance. If the empirical claims were fully supported, this would be a valuable step toward comparing trust environments across underground platforms and could inform threat intelligence. The paper is explicitly preliminary and is appropriately cautious in its wording, and it contributes a concrete role taxonomy for Telegram channels plus a transparent description of the coding process. However, the significance is currently limited by the absence of quantitative validation: no inter-coder agreement, no per-mechanism prevalence counts, and no formal treatment of instrument transferability. The role analysis in Section 3.2 is the strongest contribution, as it is grounded in a fresh sample of forum-linked channels and suggests a coherent ecosystem that partly contradicts the low-value hypothesis. The paper is worth publishing after substantial empirical strengthening.

major comments (4)

[Section 3.1] The central claim that trust mechanisms on Telegram are "few" and "rarely signaled" is not supported by any reported counts, rates, or confidence intervals. The paper states only that a "preliminary exploration of the data through keyword matching" shows this, with no table or figure reporting the number of channels exhibiting each mechanism, the frequency of signals, or the distribution across batches. The authors should report per-mechanism prevalence (e.g., number and percentage of channels coded for each taxonomy entry) and, ideally, inter-coder agreement (e.g., Cohen's kappa) for the coding process described in Section 3.1. Without these numbers, the "small fraction" and "rarely signaled" assertions are not verifiable, and the subsequent low-value hypothesis rests on an unquantified impression.
[Section 3.1] The instrument transferability from forums to Telegram is a load-bearing assumption that is not validated. The taxonomy in Table 1 is derived from the 28 forum mechanisms of [3], and the paper itself notes that the instrument had to be adapted (e.g., adding "Telegram Bots" and dropping forum-specific features like vendor vetting and segregation). If Telegram communities signal trust through mechanisms not in the forum-derived codebook—such as forum-linked reputation, forwarded vouches, pinned administrator endorsements, bot-mediated escrow, or channel age and engagement—the finding of "few" signals would be an artifact of the instrument rather than a property of the ecosystem. To address this, the authors should either conduct an instrument-free pilot coding of Telegram channels to discover platform-native trust mechanisms, or at minimum discuss known Telegram-specific signaling practices and test whether they are captured by the taxonomy.
[Sections 3.1 and 3.2] There is an unresolved tension between the hypothesis that Telegram "may at most support low-value crime activities" and the findings of the second study, where Marketplace and Proof-of-Credibility roles are "particularly common" for Documents, Carding, and Malware. If forum-linked Telegram channels serve as marketplaces and credibility proofs for exactly the categories associated with high-impact crime, the low-value inference from Section 3.1 appears scope-dependent or possibly contradicted. The paper should reconcile these findings, for example by testing whether the channels with forum links exhibit the same sparsity of trust mechanisms as the broader sample, or by qualifying the low-value claim to exclude forum-linked Telegram spaces. As written, the two sections support different conclusions about Telegram's role in serious crime.
[Section 3.2 and Figure 1] The role analysis lacks the same quantitative transparency as the rest of the paper. The text says the authors "identify six roles" from 500 threads, but neither the number of threads coded per role nor the frequencies underlying Figure 1 are reported. Claims such as "the Marketplace role is particularly common for Documents, Carding, and Malware" and "Proof of credibility is prevalent in Documents and Malware" cannot be evaluated without prevalence counts or at least the raw numbers on which the figure is based. I recommend adding a table with per-role, per-forum-section counts (or percentages) and reporting inter-coder agreement for this second coding pass as well.

minor comments (4)

[Abstract and Introduction] The term "migratory" appears in the title and later as "migration," but the paper does not clearly define what counts as migration (e.g., joining a new community vs. abandoning an old one); a brief operational definition in the introduction would help.
[Section 3.1] Typographical issues: "Crytocurrency" should be "Cryptocurrency" in Table 1, and "hypothetise" should be "hypothesize" in the last paragraph of Section 3.1.
[Section 3.2] The text "the forums CryptBB, Cracked, CrackingPro, Nulled, 2crd, and Xss" is missing a space after "the forums." Also, Figure 1 is not referenced in the text with a sentence; consider adding an explicit callout.
[Section 4] In the sentence "whereas trust building mechanisms do seem to affect Dmitry's decision to join a form rather than another," "form" should be "forum."

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the paper applies a prior framework to new Telegram data; findings are empirical, not forced by definition.

full rationale

The paper's central empirical claim in Section 3.1 is that only 'a small fraction of the forum mechanisms identified in [3] apply to the Telegram ecosystem.' This is not circular: the authors take a pre-existing framework from Campobasso et al. [3], apply it to newly collected Telegram messaging data from 543 channels and groups, and report what they observe. The framework is self-cited, but the Telegram data and the coding process are new, and the conclusion about ecosystem maturity is an interpretive inference from observed feature prevalence, not a quantity fitted to the conclusion. No equation is defined in terms of a predicted outcome, no fitted parameter is renamed as a prediction, and no uniqueness theorem from the authors' prior work is invoked to forbid alternative interpretations. The taxonomy in Table 1 even includes Telegram-specific mechanisms such as 'Telegram Bots' that are not in the original forum framework, showing that the instrument was adapted rather than merely presupposed. The main limitation is construct validity: the framework from [3] may not be exhaustive for Telegram, making 'few and rarely signaled' potentially an artifact of the instrument. But that is a correctness or external-validity concern, not circularity. The paper is honest about the preliminary nature of the results and does not claim a derivation that reduces to its own inputs. Therefore, no circular step can be exhibited, and the appropriate score is 0.

Assumptions & free parameters 0 free parameters · 4 assumptions · 1 invented entities

The central empirical mapping does not fit any numeric model, so there are no fitted free parameters. It depends on several domain assumptions: the transferability of the forum trust framework, the representativeness of seed-plus-snowball sampling, the reliability of manual coding without reported agreement, and the representativeness of the six sampled forums. The only invented entity is the Dmitry persona, which is a narrative device rather than an explanatory construct.

assumptions (4)

domain assumption The Campobasso et al. forum trust-mechanism framework [3] transfers to Telegram and is sufficient to characterize Telegram trust building.
Section 3.1 uses [3] as the taxonomic lens; if Telegram uses trust signals outside the 28 mechanisms, the finding of sparse signaling is an artifact of the instrument.
domain assumption The seeded repositories [9,7] and the snowball discovery method [6] yield a representative sample of Telegram cybercrime spaces.
Sampling starts from two public repositories and expands by snowballing; there is no evidence about private or invite-only channels where mature trust mechanisms might be more prevalent.
domain assumption Manual coding by two authors reached stable, reliable codes without formal inter-rater metrics.
The paper states codes stabilized after iterative card sorting but reports no agreement statistic, so coding reliability is assumed.
domain assumption The six sampled forums and sections (CryptBB, Cracked, CrackingPro, Nulled, 2crd, Xss) represent forum-to-Telegram referral patterns broadly enough to define roles.
Section 3.2 samples 500 threads from these forums; other forums or marketplaces might link to Telegram differently.

invented entities (1)

Dmitry persona (hypothetical underground participant)
purpose: Personifies the migration decision-maker in the paper's research questions and framing.
Introduced in the abstract as 'a participant (hereafter, Dmitry)'; it is a rhetorical device, not an empirical agent, and carries no independent falsifiable predictions.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Where is Dmitry going? Framing 'migratory' decisions in the criminal underground." pith.science (2026). https://pith.science/paper/U5KOZBIF

@misc{pith2026241116291,
  author       = {Pith},
  title        = {Pith review of: Where is Dmitry going? Framing 'migratory' decisions in the criminal underground},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/U5KOZBIF}},
  note         = {Machine review of arXiv:2411.16291}
}

read the original abstract

The cybercriminal underground consists of hundreds of forum communities that function as marketplaces and information-exchange platforms for both established and wannabe cybercriminals. The ecosystem is continuously evolving, with users migrating between forums and platforms. The emergence of cybercrime communities in Telegram and Discord only highlights the rising fragmentation and adaptability of the ecosystem. In this position paper, we explore the economic incentives and trust-building mechanisms that may drive a participant (hereafter, Dmitry) of the cybercriminal underground ecosystem to migrate from one forum or platform to another. What are the market signals that matter to Dmitry's decision of joining a specific community, and what roles and purposes do these communities or platforms play within the broader ecosystem? Ultimately, we build towards our thesis that by studying these mechanisms we could explain, and therefore act upon, Dmitry's choice of joining a criminal community rather than another. To build this argument, we first discuss previous work evaluating differences in trust signals depicted in criminal forums. We then present preliminary results evaluating criminal channels on Telegram using those same lenses. Further, we analyze the different roles these channels play in the criminal ecosystem. We then discuss implications for future research.

Figures

Figures reproduced from arXiv: 2411.16291 by the authors.

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

11 extracted references · 9 canonical work pages

[3]

Campobasso, M., R a dulescu, R., Brons, S., Allodi, L.: You can tell a cybercriminal by the company they keep: A framework to infer the relevance of underground communities to the threat landscape (Jun 2023)

work page 2023
[1]

Akerlof, G.A.: The market for ``lemons'': Quality uncertainty and the market mechanism. Q. J. Econ. 84(3), 488 (Aug 1970)

work page 1970
[2]

Master's thesis, University of Twente (2023)

Boersma , K.: So long and thanks for all the (big) fish : exploring cybercrime in Dutch Telegram groups. Master's thesis, University of Twente (2023)

work page 2023
[4]

Journal of Ethnic and Migration Studies 41(1), 58--82 (2015)

Czaika, M.: Migration and economic prospects. Journal of Ethnic and Migration Studies 41(1), 58--82 (2015)

work page 2015
[5]

The annals of the American Academy of Pol

Czaika, M., Bijak, J., Prike, T.: Migration decision-making and its key dimensions. The annals of the American Academy of Pol. & Soc. science 697(1), 15--31 (2021)

work page 2021
[6]

Master's thesis, TU Eindhoven (2024)

Doğaner, T.: Tracking the Evolution of Cybercrime on Telegram: A Scalable Tool for Continuous Monitoring and Analysis. Master's thesis, TU Eindhoven (2024)

work page 2024
[7]

Giaimo, M.: Telegram threat actors, https://github.com/fastfire/deepdarkCTI

work page
[8]

In: Economics of Information Security and Privacy, pp

Herley, C., Flor \^e ncio, D.: Nobody sells gold for the price of silver: Dishonesty, uncertainty and the underground economy. In: Economics of Information Security and Privacy, pp. 33--53. Springer US, Boston, MA (2010)

work page 2010

Show all 11 references

[9]

https://github.com/SystemsLab-Sapienza/TGDataset (2023)

La Morgia, M., Mei, A., Mongardini, A.M.: TGDataset Repository . https://github.com/SystemsLab-Sapienza/TGDataset (2023)

2023
[10]

, " * write output.state after.block = add.period write

ENTRY address author booktitle chapter doi edition editor eid howpublished institution journal key month note number organization pages publisher school series title type url volume year label INTEGERS output.state before.all mid.sentence after.sentence after.block FUNCTION in...
[11]

write newline

" write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 gl...

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.

[1] [3]

Campobasso, M., R a dulescu, R., Brons, S., Allodi, L.: You can tell a cybercriminal by the company they keep: A framework to infer the relevance of underground communities to the threat landscape (Jun 2023)

work page 2023

[2] [1]

Akerlof, G.A.: The market for ``lemons'': Quality uncertainty and the market mechanism. Q. J. Econ. 84(3), 488 (Aug 1970)

work page 1970

[3] [2]

Master's thesis, University of Twente (2023)

Boersma , K.: So long and thanks for all the (big) fish : exploring cybercrime in Dutch Telegram groups. Master's thesis, University of Twente (2023)

work page 2023

[4] [4]

Journal of Ethnic and Migration Studies 41(1), 58--82 (2015)

Czaika, M.: Migration and economic prospects. Journal of Ethnic and Migration Studies 41(1), 58--82 (2015)

work page 2015

[5] [5]

The annals of the American Academy of Pol

Czaika, M., Bijak, J., Prike, T.: Migration decision-making and its key dimensions. The annals of the American Academy of Pol. & Soc. science 697(1), 15--31 (2021)

work page 2021

[6] [6]

Master's thesis, TU Eindhoven (2024)

Doğaner, T.: Tracking the Evolution of Cybercrime on Telegram: A Scalable Tool for Continuous Monitoring and Analysis. Master's thesis, TU Eindhoven (2024)

work page 2024

[7] [7]

Giaimo, M.: Telegram threat actors, https://github.com/fastfire/deepdarkCTI

work page

[8] [8]

In: Economics of Information Security and Privacy, pp

Herley, C., Flor \^e ncio, D.: Nobody sells gold for the price of silver: Dishonesty, uncertainty and the underground economy. In: Economics of Information Security and Privacy, pp. 33--53. Springer US, Boston, MA (2010)

work page 2010