Spams meet Cryptocurrencies: Sextortion in the Bitcoin Ecosystem

Bernhard Haslhofer; Masarah Paquet-Clouston; Matteo Romiti; Thomas Charvat

REVIEW 3 major objections 5 minor 40 references

Spams meet Cryptocurrencies: Sextortion in the Bitcoin Ecosystem

T0 review · 3 major / 5 minor · reviewed 2026-08-14 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read By tracking Bitcoin payments behind 4.3 million sextortion spams, this paper claims the scheme earned a lower-bound $1.30–$1.35 million over 11 months, with one entity controlling most of the payment flows.

desk verdict Valuable first large-scale look at sextortion spam's Bitcoin revenue, but the 'lower-bound' claim overreaches; the estimate is a useful filtered-flow figure, not a proven floor. read the letter →

arxiv 1908.01051 v1 pith:24HBTLFF submitted 2019-08-02 cs.CR

Masarah Paquet-Clouston , Matteo Romiti , Bernhard Haslhofer , Thomas Charvat This is my paper · ORCID

classification cs.CR

keywords sextortionspamBitcoinblockchainanalysiscryptocurrencycrimeextortionbotnetransomwaremoneylaundering

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper asks whether sextortion spam—bulk emails threatening to leak compromising images unless a Bitcoin payment is made—is a viable criminal business. It traces the Bitcoin addresses embedded in 4.3 million such emails through the public blockchain, and claims that an 11-month operation took in at least $1.30–$1.35 million, about $123,000 per month. It also finds that one real-world actor likely controls the payment backbone of nearly all the campaigns, and that spammers vary their demands by language and campaign but reuse addresses rather than tracking which threats work. If these claims are right, the economics explain why the scheme persists: costs are minimal because the upper tier of the spam supply chain—hosting, product delivery, payment processing—is cut away.

What carries the argument

The argument is carried by three linked mechanisms. First, an email bucketing heuristic groups the 4.3 million messages by their last 50 words with a Jaccard similarity threshold of 0.3, yielding 96 sextortion buckets and, after manual merging, 35 campaigns; this overcomes text obfuscation. Second, Bitcoin addresses from those emails are projected onto the full blockchain transaction graph and expanded by multiple-input clustering, the heuristic that co-spent addresses belong to one entity, with CoinJoin transactions filtered out. Third, three transaction filters narrow the incoming payments to likely victim payments: a collector filter removes flows between spammers' own addresses, a range filter keeps only amounts within ±10% of the ransom amounts seen in the emails, and a moving-money filter drops single-output exact-amount transactions. The revenue and single-entity claims rest on these filters and on the bucket-sharing graph.

What would settle it

Take the 2,346 payments that survive the collector and range filters and classify each sender by known attribution tags and transaction history; if a material share of those payments can be tied to other schemes (such as the fake video scam cited in the paper or ordinary donations to a reused address), the claimed lower bound of $1.30–$1.35 million would be an overestimate, not a floor.

Watch

Extended reading notes

Core claim

The central discovery is that sextortion spam is not a haphazard nuisance but a structured, profitable payment operation inscribed in the Bitcoin ledger. From 4,340,736 emails, the authors extract 12,533 candidate Bitcoin addresses, find 245 that actually receive funds, and use multiple-input clustering—the observation that addresses spending together in one transaction are controlled by the same key holder—to expand the set to 485 payment addresses. Filtering incoming transactions to those that match the ransom amounts found in the emails, they estimate a lower-bound revenue between $1,300,620 and $1,352,266 over 11 months (June 2018–April 2019), with an average of $122,933 per month. A graph connecting spam buckets that share clusters or addresses contains one giant component covering 56 of 96 buckets, 99.4% of the emails, and 88.3% of the estimated revenue, which the authors read as evidence that a single entity controls the financial backbone of the majority of campaigns. They also find that victims' payments move onward within about 5.5 days on average, and that the operation spends almost nothing on the usual spam supply chain.

Load-bearing premise

The 'lower bound' is only as clean as the range filter: every payment counted as sextortion revenue must genuinely be sextortion money, and the paper cannot exclude unrelated payments to reused addresses that happen to fall inside the demanded-amount window.

Editorial extensions

If this is right

Sextortion spam is profitable enough to sustain itself: at about $123,000 per month against roughly $110,000 in botnet rental over 11 months, the operation would net over $1.2 million even before further cost cuts.
The concentration of payments in one giant component means that disrupting a small set of addresses or clusters—or the service that creates them—could cut off most of the revenue across many campaigns.
Because addresses are reused across campaigns and languages, embedded Bitcoin addresses are a usable spam-filtering signal: messages pointing to known sextortion addresses can be flagged before delivery.
The short average holding time of 5.5 days means law-enforcement tracing of victim payments to exchanges or cash-out services has a narrow but real window.
Language-based pricing shows that spammers believe different populations have different willingness to pay; this mirrors price discrimination seen in ransomware, and implies future campaigns may tune demands further.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

If the revenue estimate holds, the implied conversion rate is roughly 2,346 payments per 4.3 million emails—about 0.05%—which suggests the scheme works on volume, not persuasion; even a tiny increase in conversion would scale revenue sharply.
The single-entity finding implies a testable prediction: most newly appearing sextortion Bitcoin addresses should join the same cluster or component over time; a monitoring dashboard could check this daily.
The same address-projection method could be applied to other cryptocurrency-based spam schemes, such as fake video scams or crypto-phishing, to see whether they share the same financial backbone.
One consequence the authors leave implicit is that the reuse of addresses, while simplifying spam operations, also creates a permanent public record that can be used to measure future campaigns without needing access to the emails themselves.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Short version: this is the first large-scale financial analysis of sextortion spam, and the campaign-structure finding is real and interesting. But the headline revenue figure is not strictly a lower bound, because the RangeFilter can count non-sextortion payments that fall in the ransom amount window. The authors admit as much in their own limitations section, yet they keep the phrase 'lower-bound' in the abstract and conclusion. That is the main flaw, and it is fixable.

What is new: they assembled 4.3 million sextortion emails, an order of magnitude larger than Schultz's 60-day look. The email bucketing heuristic is simple but effective, and the campaign graph built from shared Bitcoin clusters is a nice contribution. They publish the list of 12,533 addresses, which is real reproducibility credit. The finding that one entity's clusters sit behind most campaigns, controlling 88.3% of the estimated revenue, is the most original part. The pricing analysis (language-based differences) is plausible, though statistically basic.

Where it is soft: the revenue estimate. They start with 485 addresses after cluster expansion, then keep payments in [(1-p)*min S, (1+p)*max S] with p=0.1. Because addresses are reused across campaigns and, as Schultz found, across other cryptocurrency scams, any in-range incoming payment to those addresses gets counted. The CollectorFilter and MovingMoneyFilter do not remove unrelated payments. So the estimate may overcount. The stress-test note is right: it is not guaranteed to be a lower bound. The authors' Section 5.3 concession supports this. To make the claim valid, they need either a small manually labeled set of payments, control addresses known to be unrelated, or at minimum a sensitivity analysis with different p values and a statement that it is a filtered-flow estimate, not a proven floor.

Minor issues: the campaign count is inconsistent (35 vs 80 in Section 5.1). The acquisition filter means the email corpus is a biased sample, which could undercount revenue, so that direction is less worrying. The raw emails are private, but the address list is published.

Bottom line: this paper deserves a serious referee. I would send it to review with major revisions, asking for the lower-bound language to be softened or validated. The core measurement is valuable even if the precise number shifts by tens of percent. I would cite it in work on cryptocurrency crime measurement.

Referee Report

3 major / 5 minor

Summary. The paper analyzes 4,340,736 sextortion emails collected between October 2018 and February 2019, groups them into 96 buckets via a suffix-based Jaccard heuristic and then manually into 35 campaigns, extracts 12,533 Bitcoin addresses (245 of which received funds), expands these to 485 addresses via multiple-input clustering (excluding two large exchange-like clusters except for their seed addresses), and applies three filters (CollectorFilter, RangeFilter with p=0.1, MovingMoneyFilter) to incoming transactions. The authors report a lower-bound revenue of $1,300,620–$1,352,266 over an 11-month period, find that one giant component of a bucket-sharing graph covers 56 of 96 buckets, 99.4% of emails, and 88.3% of estimated revenue, and analyze pricing strategies, password reuse, holding periods, and money flows to known exchanges.

Significance. The paper offers the first large-scale, reproducible measurement of sextortion spam economics, releasing the extracted Bitcoin addresses and combining email-side and blockchain-side analyses. If the revenue estimate is treated as a filtered-flow sum rather than as a certified lower bound, the paper provides a valuable baseline for a scam type that has so far received little quantitative attention. The shared-address backbone finding is suggestive and worth pursuing, even though the real-world entity behind it is not identified. The authors are transparent about several limitations in Section 5.3, which is a strength, but the headline claims are stated with more confidence than the method supports.

major comments (3)

[§3.6, §4.4, §5.2] The headline revenue claim in the Abstract and §4.4 ('lower-bound revenue between $1,300,620 and $1,352,266') is not guaranteed by the filtering pipeline described in §3.6. The RangeFilter keeps all incoming transactions to the 485 addresses whose amounts fall in [(1−p)·min S, (1+p)·max S]; with the amounts in Table 2, this interval is roughly $180–$7,700. Because addresses are reused across campaigns and, as §5.3 acknowledges, across other Bitcoin scams, and because cluster expansion adds addresses controlled by the same entities that may also receive unrelated payments, in-range transactions that are not sextortion payments will be counted. Neither the CollectorFilter (which only removes internal transfers) nor the MovingMoneyFilter (which only removes single-output exact-amount transfers) addresses this. The paper should either present the figure as a filtered-flow estimate without the 'lower-bound' guarantee, or validate the filters using, for example, control addresses not appearing in any spam, manual inspection of a random sample of counted payments, and a sensitivity analysis of the tolerance p. Until then, the 'lucrative business' conclusion in §5.2 is not supported at the stated confidence level.
[§4.3] The claim that a single real-world entity controls the financial backbone of most campaigns is stronger than the evidence presented. The giant component is defined by shared clusters or seed addresses across buckets, but those clusters are produced by a best-effort multiple-input heuristic with heuristic CoinJoin filtering, and the error rate of that clustering is not evaluated on this dataset; false merges would create spurious edges between buckets. Moreover, a shared address set could represent a common payment-processing or exchange service used by several independent spam operators rather than a single operator. The authors should soften the entity claim or provide corroborating evidence, such as identifying the operator or demonstrating spending behavior consistent with one controller (for example, centralized consolidation patterns). This is load-bearing because the 'financial backbone' is one of the two headline contributions.
[§4.4] The revenue window is described as an 11-month operation (June 2018 to April 2019), but the email dataset covers only October 2018 to February 2019. Payments observed before the first and after the last spam are attributed to the same campaigns based solely on address reuse, which is not explicitly justified in the paper. This temporal extension further increases the risk of counting unrelated payments and should be either justified with evidence (for example, that the address set was exclusive to sextortion during that period) or removed by restricting the revenue estimate to the period covered by the email evidence.

minor comments (5)

[§5.1] The text states that 'a total of 80 different campaigns were found,' which contradicts the 35 campaigns identified in §3.4; this should be corrected to 35 campaigns or clarified as 80 buckets.
[§3.5] The decision to disregard clusters 0 and 1 as 'exchange or another large real-world entity' is described only by qualitative characteristics; the paper should state the explicit quantitative criteria used for this exclusion.
[Figure 3] The caption of Figure 3 should explain the node numbering, the meaning of red versus black edges, and how edge weights are computed, as the current figure is difficult to interpret without access to the underlying data.
[§4.2] The sentence 'about 51% of our randomly selected password samples' should state the exact denominator (25% of the 632,688 unique passwords) in the main text so the percentage is reproducible.
[§5.3] The limitation paragraph says the reported numbers 'underestimate the magnitude,' but the false-positive concern described earlier means the estimate could also overestimate; the wording should acknowledge both directions of potential bias.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the revenue estimate is a direct filtered ledger sum, and the paper's acknowledged limitations are accuracy caveats rather than circular reductions.

full rationale

The paper's central quantitative claims do not reduce to their inputs by construction. The revenue estimate is a direct arithmetic sum of Bitcoin payments that survive explicit filters (CollectorFilter, RangeFilter, Moving-MoneyFilter; §3.6, Table 4): no parameter is fitted to reproduce the reported $1,300,620–$1,352,266 figure, and the filter thresholds (p=0.1, range from email ransom amounts) are selection criteria, not fitted predictions. The bucketing parameters (l=50, t=0.3) are tuned for internal email coherence, not for any target revenue. The 'one entity controls the financial backbone' claim is a graph summary of shared addresses/clusters produced by the standard multiple-input clustering heuristic; it is an inference from the constructed graph, not a prediction whose conclusion is assumed in its premise. The only notable self-citation, [28] by two of the same authors, motivates the CollectorFilter but does not supply the revenue result; it is not load-bearing. The acknowledged limitation in §5.3 that the expanded dataset 'may also include transactions that are not related to sextortion spams' is a validity and accuracy caveat about the lower-bound framing, not a circular derivation: an estimate can be biased without being circular. Accordingly, no circular step is exhibited.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The central estimate rests on a chain of measurement assumptions: emails are representative of sextortion, addresses in them are spammers' addresses, clustering preserves entity boundaries, filters separate victim payments from noise, and attribution tags identify exchanges. Most are reasonable and stated, but the unvalidated filter chain is the reason soundness is not higher.

free parameters (3)

RangeFilter tolerance p = 0.1
Hand-set tolerance for exchange rate oscillations; directly controls which incoming transactions count as sextortion payments and therefore the revenue estimate.
Email bucketing parameters (last words l, Jaccard threshold t) = l=50, t=0.3
Tuned on 10% of sample to maximize within-bucket Jaccard similarity; affects campaign grouping, not revenue magnitude directly.
Cash-out proxy threshold June 2018 = 2018-06-01
Arbitrary cutoff for 'older than observed sextortion payments' used in money-flow analysis; explicitly acknowledged as arbitrary in Section 4.5.

assumptions (4)

domain assumption Multiple-input clustering groups addresses controlled by the same entity.
Applied in Section 3.5 via GraphSense after CoinJoin filtering; can fail in mixing and shared-wallet cases, and attribution to one entity is probabilistic.
domain assumption Sextortion victims pay directly into the addresses found in the spam, without centralized mixers at the payment step.
Stated in Section 3.5; if victims use mixers, payments would be missed, so the revenue estimate could be too low rather than too high.
domain assumption Attribution tags from walletexplorer.com are correct for identifying exchanges.
Used to discard clusters 0 and 1 and to label exchanges in money-flow analysis; authors state tags are collected without a verification process in Section 5.3.
domain assumption The range of amounts extracted from spam emails is representative of actual sextortion payment amounts.
RangeFilter accepts only transactions near those amounts; if spammers change amounts over time or victims pay different amounts, real payments could be excluded.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Spams meet Cryptocurrencies: Sextortion in the Bitcoin Ecosystem." pith.science (2026). https://pith.science/paper/24HBTLFF

@misc{pith2026190801051,
  author       = {Pith},
  title        = {Pith review of: Spams meet Cryptocurrencies: Sextortion in the Bitcoin Ecosystem},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/24HBTLFF}},
  note         = {Machine review of arXiv:1908.01051}
}

abstract

In the past year, a new spamming scheme has emerged: sexual extortion messages requiring payments in the cryptocurrency Bitcoin, also known as sextortion. This scheme represents a first integration of the use of cryptocurrencies by members of the spamming industry. Using a dataset of 4,340,736 sextortion spams, this research aims at understanding such new amalgamation by uncovering spammers' operations. To do so, a simple, yet effective method for projecting Bitcoin addresses mentioned in sextortion spams onto transaction graph abstractions is computed over the entire Bitcoin blockchain. This allows us to track and investigate monetary flows between involved actors and gain insights into the financial structure of sextortion campaigns. We find that sextortion spammers are somewhat sophisticated, following pricing strategies and benefiting from cost reductions as their operations cut the upper-tail of the spamming supply chain. We discover that one single entity is likely controlling the financial backbone of the majority of the sextortion campaigns and that the 11-month operation studied yielded a lower-bound revenue between \$1,300,620 and \$1,352,266. We conclude that sextortion spamming is a lucrative business and spammers will likely continue to send bulk emails that try to extort money through cryptocurrencies.

Figures

Figures reproduced from arXiv: 1908.01051 by the authors.

**Figure 2.** Mean amounts asked per Language and per Campaign [PITH_FULL_IMAGE:figures/full_fig_p008_2.png] view at source ↗

**Figure 3.** Relationship among sextortion buckets, cam [PITH_FULL_IMAGE:figures/full_fig_p009_3.png] view at source ↗

Figures from the paper (1 more)

**Figure 5.** Figure 5: Histogram of holding periods considering the [PITH_FULL_IMAGE:figures/full_fig_p009_5.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

40 extracted references · 40 canonical work pages

[1]

Machine Learning and Textual Information Access

A/n.sc/d.sc/r.sc/o.sc/u.sc/t.sc/s.sc/o.sc/p.sc/o.sc/u.sc/l.sc/o.sc/s.sc, I., P/a.sc/l.sc/i.sc/o.sc/u.sc/r.sc/a.sc/s.sc, G., K/a.sc/r.sc/k.sc/a.sc/l.sc/e.sc/t.sc/s.sc/i.sc/s.sc, V., S/a.sc/k.sc/k.sc/i.sc/s.sc, G., S/p.sc/y.sc/r.sc/o.sc/p.sc/o.sc/u.sc/l.sc/o.sc/s.sc, C. D., /a.sc/n.sc/d.sc S/t.sc/a.sc/m.sc/a.sc/t.sc/o.sc/p.sc/o.sc/u.sc/l.sc/o.sc/s.sc, P.Lea...

work page 2000
[2]

B/i.sc/t.sc/c.sc/o.sc/i.sc/n.sc/hyphen.scW/i.sc/k.sc/i.sc. Privacy. https://en .bitcoin.it/wiki/Privacy, 2019. Retrieved May 17, 2019

work page 2019
[3]

In2015 IEEE international conference on communications (ICC) (2015), IEEE, pp

C/h.sc/e.sc/n.sc, C., Z/h.sc/a.sc/n.sc/g.sc, J., C/h.sc/e.sc/n.sc, X., X/i.sc/a.sc/n.sc/g.sc, Y., /a.sc/n.sc/d.sc Z/h.sc/o.sc/u.sc, W.6 million spam tweets: A large ground truth for timely twitter spam detection. In2015 IEEE international conference on communications (ICC) (2015), IEEE, pp. 7065–7070

work page 2015
[4]

Internet organized crime threat assessment report IOCTA

EUROPOL. Internet organized crime threat assessment report IOCTA. https://www.europol.europa.eu/activities-services/main-reports/internet- organised-crime-threat-assessment, 2018. Retrieved March 6, 2019

work page 2018
[5]

R/e.sc/i.sc/d.sc, M

F. R/e.sc/i.sc/d.sc, M. H.An analysis of anonymity in the bitcoin system. In 2011 IEEE In- ternational Conference on Privacy, Security, Risk, and Trust, and IEEE International Conference on Social Computing (2011)

work page 2011
[6]

In Data Science–Analytics and Applications

F/i.sc/l.sc/t.sc/z.sc, E., P/o.sc/l.sc/l.sc/e.sc/r.sc/e.sc/s.sc, A., K/a.sc/r.sc/l.sc, R., /a.sc/n.sc/d.sc H/a.sc/s.sc/l.sc/h.sc/o.sc/f.sc/e.sc/r.sc, B.Evolution of the bitcoin address graph. In Data Science–Analytics and Applications. Springer, 2017, pp. 77– 82

work page 2017
[7]

DEF CON conference, https: //www.cs.auckland.ac.nz/~pgut001/pubs/malwarebiz.pdf, 2007

G/u.sc/t.sc/m.sc/a.sc/n.sc/n.sc, P.The commercial malware industry. DEF CON conference, https: //www.cs.auckland.ac.nz/~pgut001/pubs/malwarebiz.pdf, 2007. Retrieved Feb- ruary 2, 2019

work page 2007
[8]

H/a.sc/r.sc/r.sc/i.sc/g.sc/a.sc/n.sc, M., /a.sc/n.sc/d.sc F/r.sc/e.sc/t.sc/t.sc/e.sc/r.sc, C.The unreasonable eﬀectiveness of address clustering. In 2016 Intl IEEE Conferences on Ubiquitous Intelligence & Computing, Advanced and Trusted Computing, Scalable Computing and Communications, Cloud and Big Data Computing, Internet of People, and Smart World Cong...

work page 2016

Show all 40 references

[9]

In SEMANTiCS (Posters, Demos, SuCCESS) (2016)

H/a.sc/s.sc/l.sc/h.sc/o.sc/f.sc/e.sc/r.sc, B., K/a.sc/r.sc/l.sc, R., /a.sc/n.sc/d.sc F/i.sc/l.sc/t.sc/z.sc, E.O bitcoin where art thou? insight into large-scale transaction graphs. In SEMANTiCS (Posters, Demos, SuCCESS) (2016)

2016
[10]

Available at SSRN 2937641„ 2017

H/e.sc/r.sc/n.sc/a.sc/n.sc/d.sc/e.sc/z.sc/hyphen.scC/a.sc/s.sc/t.sc/r.sc/o.sc, J., C/a.sc/r.sc/t.sc/w.sc/r.sc/i.sc/g.sc/h.sc/t.sc, E., /a.sc/n.sc/d.sc S/t.sc/e.sc/p.sc/a.sc/n.sc/o.sc/v.sc/a.sc, A.Economic analysis of ransomware. Available at SSRN 2937641„ 2017. Retrieved March 6, 2019

2017
[11]

Expert Systems with Applications 42 , 7 (2015), 3634–3642

H/e.sc/y.sc/d.sc/a.sc/r.sc/i.sc, A., /a.sc/l.sc/i.sc T/a.sc/v.sc/a.sc/k.sc/o.sc/l.sc/i.sc, M., S/a.sc/l.sc/i.sc/m.sc, N., /a.sc/n.sc/d.sc H/e.sc/y.sc/d.sc/a.sc/r.sc/i.sc, Z.Detection of review spam: A survey. Expert Systems with Applications 42 , 7 (2015), 3634–3642

2015
[12]

Y., A/l.sc/i.sc/a.sc/p.sc/o.sc/u.sc/l.sc/i.sc/o.sc/s.sc, M

H/u.sc/a.sc/n.sc/g.sc, D. Y., A/l.sc/i.sc/a.sc/p.sc/o.sc/u.sc/l.sc/i.sc/o.sc/s.sc, M. M., L/i.sc, V. G., I/n.sc/v.sc/e.sc/r.sc/n.sc/i.sc/z.sc/z.sc/i.sc, L., B/u.sc/r.sc/s.sc/z.sc/t.sc/e.sc/i.sc/n.sc, E., M/c.scR/o.sc/b.sc/e.sc/r.sc/t.sc/s.sc, K., L/e.sc/v.sc/i.sc/n.sc, J., L/e...

2018
[13]

Necurs delivers language targeted porn scams

IBM/hyphen.scX/hyphen.scF/o.sc/r.sc/c.sc/e.sc/hyphen.scE/x.sc/c.sc/h.sc/a.sc/n.sc/g.sc/e.sc. Necurs delivers language targeted porn scams. IBM, https://exchange.xforce.ibmcloud.com/collection/Necurs-delivers-language- targeted-porn-scams-fdb9d6b7941506807cbe56dd06e142d0, Sept ...

2018
[14]

P., M/o.sc/s.sc/h.sc/c.sc/h.sc/u.sc/k.sc, A., G/r.sc/i.sc/b.sc/b.sc/l.sc/e.sc, S

J/o.sc/h.sc/n.sc, J. P., M/o.sc/s.sc/h.sc/c.sc/h.sc/u.sc/k.sc, A., G/r.sc/i.sc/b.sc/b.sc/l.sc/e.sc, S. D., K/r.sc/i.sc/s.sc/h.sc/n.sc/a.sc/m.sc/u.sc/r.sc/t.sc/h.sc/y.sc, A., /e.sc/t.sc /a.sc/l.sc.Studying spamming botnets using botlab. In USENIX Symposium on Networked Systems ...

2009
[15]

A., G/o.sc/l.sc/d.sc/f.sc/e.sc/d.sc/e.sc/r.sc, S., C/h.sc/a.sc/t.sc/o.sc/r.sc, A., M/odieresis.sc/s.sc/e.sc/r.sc, M., /a.sc/n.sc/d.sc N/a.sc/r.sc/a.sc/y.sc/a.sc/n.sc/a.sc/n.sc, A

K/a.sc/l.sc/o.sc/d.sc/n.sc/e.sc/r.sc, H. A., G/o.sc/l.sc/d.sc/f.sc/e.sc/d.sc/e.sc/r.sc, S., C/h.sc/a.sc/t.sc/o.sc/r.sc, A., M/odieresis.sc/s.sc/e.sc/r.sc, M., /a.sc/n.sc/d.sc N/a.sc/r.sc/a.sc/y.sc/a.sc/n.sc/a.sc/n.sc, A. Blocksci: Design and applications of a blockchain analys...

2019
[16]

M., P/a.sc/x.sc/s.sc/o.sc/n.sc, V., /a.sc/n.sc/d.sc S/a.sc/v.sc/a.sc/g.sc/e.sc, S.Spamalytics: An empirical analysis of spam marketing conver- sion

K/a.sc/n.sc/i.sc/c.sc/h.sc, C., K/r.sc/e.sc/i.sc/b.sc/i.sc/c.sc/h.sc, C., L/e.sc/v.sc/c.sc/h.sc/e.sc/n.sc/k.sc/o.sc, K., E/n.sc/r.sc/i.sc/g.sc/h.sc/t.sc, B., V/o.sc/e.sc/l.sc/k.sc/e.sc/r.sc, G. M., P/a.sc/x.sc/s.sc/o.sc/n.sc, V., /a.sc/n.sc/d.sc S/a.sc/v.sc/a.sc/g.sc/e.sc, S.S...

2008
[17]

M., /a.sc/n.sc/d.sc S/a.sc/v.sc/a.sc/g.sc/e.sc, S.Show me the money: Character- izing spam-advertised revenue

K/a.sc/n.sc/i.sc/c.sc/h.sc, C., W/e.sc/a.sc/v.sc/e.sc/r.sc, N., M/c.scC/o.sc/y.sc, D., H/a.sc/l.sc/v.sc/o.sc/r.sc/s.sc/o.sc/n.sc, T., K/r.sc/e.sc/i.sc/b.sc/i.sc/c.sc/h.sc, C., L/e.sc/v.sc/c.sc/h.sc/e.sc/n.sc/k.sc/o.sc, K., P/a.sc/x.sc/s.sc/o.sc/n.sc, V., V/o.sc/e.sc/l.sc/k.sc/...

2011
[18]

IBM, https://securityintelligence.com/the-necurs-botnet-a-pandoras-box-of- malicious-spam/, April 2017

K/e.sc/s.sc/s.sc/e.sc/m.sc, L.The necurs botnet: A pandora’s box of malicious spam. IBM, https://securityintelligence.com/the-necurs-botnet-a-pandoras-box-of- malicious-spam/, April 2017. Retrieved March 6, 2019

2017
[19]

In2011 ieee symposium on security and privacy (2011), IEEE, pp

L/e.sc/v.sc/c.sc/h.sc/e.sc/n.sc/k.sc/o.sc, K., P/i.sc/t.sc/s.sc/i.sc/l.sc/l.sc/i.sc/d.sc/i.sc/s.sc, A., C/h.sc/a.sc/c.sc/h.sc/r.sc/a.sc, N., E/n.sc/r.sc/i.sc/g.sc/h.sc/t.sc, B., F/eacute.sc/l.sc/e.sc/g.sc/y.sc/h.sc/aacute.sc/z.sc/i.sc, M., G/r.sc/i.sc/e.sc/r.sc, C., H/a.sc/l.s...

2011
[20]

Annual review of public health 23 , 1 (2002), 151–169

L/u.sc/m.sc/l.sc/e.sc/y.sc, T., D/i.sc/e.sc/h.sc/r.sc, P., E/m.sc/e.sc/r.sc/s.sc/o.sc/n.sc, S., /a.sc/n.sc/d.sc C/h.sc/e.sc/n.sc, L.The importance of the normality assumption in large public health data sets. Annual review of public health 23 , 1 (2002), 151–169

2002
[21]

M., /a.sc/n.sc/d.sc S/a.sc/v.sc/a.sc/g.sc/e.sc, S.A /f_istful of bitcoins: Characterizing payments among men with no names

M/e.sc/i.sc/k.sc/l.sc/e.sc/j.sc/o.sc/h.sc/n.sc, S., P/o.sc/m.sc/a.sc/r.sc/o.sc/l.sc/e.sc, M., J/o.sc/r.sc/d.sc/a.sc/n.sc, G., L/e.sc/v.sc/c.sc/h.sc/e.sc/n.sc/k.sc/o.sc, K., M/c.scC/o.sc/y.sc, D., V/o.sc/e.sc/l.sc/k.sc/e.sc/r.sc, G. M., /a.sc/n.sc/d.sc S/a.sc/v.sc/a.sc/g.sc/e.s...

2013
[22]

V.Identifying bitcoin users by transaction behavior

M/o.sc/n.sc/a.sc/c.sc/o.sc, J. V.Identifying bitcoin users by transaction behavior. In Biometric and Surveillance Technology for Human and Activity Identi/f_ication XII (2015), vol. 9457, International Society for Optics and Photonics, p. 945704

2015
[23]

In Proceedings of the Workshop on the Economics of Information Security (WEIS) (University of California at Berkeley, 2016)

M/odieresis.sc/s.sc/e.sc/r.sc, M., /a.sc/n.sc/d.sc B/odieresis.sc/h.sc/m.sc/e.sc, R.Join me on a market for anonymity. In Proceedings of the Workshop on the Economics of Information Security (WEIS) (University of California at Berkeley, 2016). Retrieved March 7, 2019

2016
[24]

In 2013 APWG eCrime Researchers Summit (2013), IEEE, pp

M/odieresis.sc/s.sc/e.sc/r.sc, M., B/odieresis.sc/h.sc/m.sc/e.sc, R., /a.sc/n.sc/d.sc B/r.sc/e.sc/u.sc/k.sc/e.sc/r.sc, D.An inquiry into money laundering tools in the bitcoin ecosystem. In 2013 APWG eCrime Researchers Summit (2013), IEEE, pp. 1–14. Retreived March 20, 2019

2013
[25]

https://bitcoin.org/ bitcoin.pdf, 2008

N/a.sc/k.sc/a.sc/m.sc/o.sc/t.sc/o.sc, S.Bitcoin: A peer-to-peer electronic cash system. https://bitcoin.org/ bitcoin.pdf, 2008. Retrieved January 4, 2019

2008
[26]

D.Data-driven de-anonymization in bitcoin

N/i.sc/c.sc/k.sc, J. D.Data-driven de-anonymization in bitcoin. Master’s thesis, ETH-Zürich,
[27]

E., A/t.sc/l.sc/a.sc/s.sc, R

O/v.sc/e.sc/r.sc/a.sc/l.sc/l.sc, J. E., A/t.sc/l.sc/a.sc/s.sc, R. S., /a.sc/n.sc/d.sc G/i.sc/b.sc/s.sc/o.sc/n.sc, J. M.Tests that are robust against vari- ance heterogeneity in k× 2 designs with unequal cell frequencies. Psychological reports 76, 3 (1995), 1011–1017

1995
[28]

Journal of Cybersecurity 5 , 1 (2019), tyz003

P/a.sc/q.sc_u.sc/e.sc/t.sc/hyphen.scC/l.sc/o.sc/u.sc/s.sc/t.sc/o.sc/n.sc, M., H/a.sc/s.sc/l.sc/h.sc/o.sc/f.sc/e.sc/r.sc, B., /a.sc/n.sc/d.sc D/u.sc/p.sc/o.sc/n.sc/t.sc, B.Ransomware payments in the bitcoin ecosystem. Journal of Cybersecurity 5 , 1 (2019), tyz003

2019
[29]

M., /a.sc/n.sc/d.sc R/e.sc/i.sc/l.sc/e.sc/y.sc, D

R/a.sc/o.sc, J. M., /a.sc/n.sc/d.sc R/e.sc/i.sc/l.sc/e.sc/y.sc, D. H.The economics of spam. Journal of Economic Perspectives 26, 3 (2012), 87–110

2012
[30]

In Security and Privacy in Social Networks

R/e.sc/i.sc/d.sc, F., /a.sc/n.sc/d.sc H/a.sc/r.sc/r.sc/i.sc/g.sc/a.sc/n.sc, M.An analysis of anonymity in the bitcoin system. In Security and Privacy in Social Networks . Springer, 2013, pp. 197–223

2013
[31]

In Financial Cryptography and Data Security (2013), Springer, pp

R/o.sc/n.sc, D., /a.sc/n.sc/d.sc S/h.sc/a.sc/m.sc/i.sc/r.sc, A.Quantitative analysis of the full bitcoin transaction graph. In Financial Cryptography and Data Security (2013), Springer, pp. 6–24. Retrieved February 15, 2019

2013
[32]

Cisco Talos Intelligence, https: //blog.talosintelligence.com/2018/10/anatomy-of-sextortion-scam .html, Oct

S/c.sc/h.sc/u.sc/l.sc/t.sc/z.sc, J.Anatomy of a sextortion scam. Cisco Talos Intelligence, https: //blog.talosintelligence.com/2018/10/anatomy-of-sextortion-scam .html, Oct

2018
[33]

In Proceedings of the 38th International ACM SIGIR Conference on Research and Development in Information Retrieval (2015), ACM, pp

S/e.sc/d.sc/h.sc/a.sc/i.sc, S., /a.sc/n.sc/d.sc S/u.sc/n.sc, A.Hspam14: A collection of 14 million tweets for hashtag- oriented spam research. In Proceedings of the 38th International ACM SIGIR Conference on Research and Development in Information Retrieval (2015), ACM, pp. 223–232

2015
[34]

In International Conference on Financial Cryptography and Data Security (2014), Springer, pp

S/p.sc/a.sc/g.sc/n.sc/u.sc/o.sc/l.sc/o.sc, M., M/a.sc/g.sc/g.sc/i.sc, F., /a.sc/n.sc/d.sc Z/a.sc/n.sc/e.sc/r.sc/o.sc, S.Bitiodine: Extracting intelligence from the bitcoin network. In International Conference on Financial Cryptography and Data Security (2014), Springer, pp. 457–468

2014
[35]

LEET 11 (2011), 4–4

S/t.sc/o.sc/n.sc/e.sc/hyphen.scG/r.sc/o.sc/s.sc/s.sc, B., H/o.sc/l.sc/z.sc, T., S/t.sc/r.sc/i.sc/n.sc/g.sc/h.sc/i.sc/n.sc/i.sc, G., /a.sc/n.sc/d.sc V/i.sc/g.sc/n.sc/a.sc, G.The underground economy of spam: A botmaster’s perspective of coordinating large-scale spam campaigns. L...

2011
[36]

In Proceedings of the 9th ACM symposium on Information, computer and communications security (2014), ACM, pp

S/t.sc/r.sc/i.sc/n.sc/g.sc/h.sc/i.sc/n.sc/i.sc, G., H/o.sc/h.sc/l.sc/f.sc/e.sc/l.sc/d.sc, O., K/r.sc/u.sc/e.sc/g.sc/e.sc/l.sc, C., /a.sc/n.sc/d.sc V/i.sc/g.sc/n.sc/a.sc, G.The harvester, the botmaster, and the spammer: on the relations between the diﬀerent actors in the spam l...

2014
[37]

In 2016 IEEE Symposium on Security and Privacy (SP) (2016), IEEE, pp

T/u.sc, H., D/o.sc/u.sc/p.sc/eacute.sc, A., Z/h.sc/a.sc/o.sc, Z., /a.sc/n.sc/d.sc A/h.sc/n.sc, G./hyphen.scJ.Sok: Everyone hates robocalls: A survey of techniques against telephone spam. In 2016 IEEE Symposium on Security and Privacy (SP) (2016), IEEE, pp. 320–338

2016
[38]

W., /a.sc/n.sc/d.sc Z/u.sc/m.sc/b.sc/o.sc, B

Z/i.sc/m.sc/m.sc/e.sc/r.sc/m.sc/a.sc/n.sc, D. W., /a.sc/n.sc/d.sc Z/u.sc/m.sc/b.sc/o.sc, B. D.Rank transformations and the power of the student t test and welch t’test for non-normal populations with unequal variances. Canadian Journal of Experimental Psychology/Revue canadien...

1993
[2015]

Retrieved March 11, 2019

2019
[2018]

Retrieved January 17, 2019

2019

Pith tools

Reviewed August 14, 2026 · model on record in the stance chip above.

[1] [1]

Machine Learning and Textual Information Access

A/n.sc/d.sc/r.sc/o.sc/u.sc/t.sc/s.sc/o.sc/p.sc/o.sc/u.sc/l.sc/o.sc/s.sc, I., P/a.sc/l.sc/i.sc/o.sc/u.sc/r.sc/a.sc/s.sc, G., K/a.sc/r.sc/k.sc/a.sc/l.sc/e.sc/t.sc/s.sc/i.sc/s.sc, V., S/a.sc/k.sc/k.sc/i.sc/s.sc, G., S/p.sc/y.sc/r.sc/o.sc/p.sc/o.sc/u.sc/l.sc/o.sc/s.sc, C. D., /a.sc/n.sc/d.sc S/t.sc/a.sc/m.sc/a.sc/t.sc/o.sc/p.sc/o.sc/u.sc/l.sc/o.sc/s.sc, P.Lea...

work page 2000

[2] [2]

B/i.sc/t.sc/c.sc/o.sc/i.sc/n.sc/hyphen.scW/i.sc/k.sc/i.sc. Privacy. https://en .bitcoin.it/wiki/Privacy, 2019. Retrieved May 17, 2019

work page 2019

[3] [3]

In2015 IEEE international conference on communications (ICC) (2015), IEEE, pp

C/h.sc/e.sc/n.sc, C., Z/h.sc/a.sc/n.sc/g.sc, J., C/h.sc/e.sc/n.sc, X., X/i.sc/a.sc/n.sc/g.sc, Y., /a.sc/n.sc/d.sc Z/h.sc/o.sc/u.sc, W.6 million spam tweets: A large ground truth for timely twitter spam detection. In2015 IEEE international conference on communications (ICC) (2015), IEEE, pp. 7065–7070

work page 2015

[4] [4]

Internet organized crime threat assessment report IOCTA

EUROPOL. Internet organized crime threat assessment report IOCTA. https://www.europol.europa.eu/activities-services/main-reports/internet- organised-crime-threat-assessment, 2018. Retrieved March 6, 2019

work page 2018

[5] [5]

R/e.sc/i.sc/d.sc, M

F. R/e.sc/i.sc/d.sc, M. H.An analysis of anonymity in the bitcoin system. In 2011 IEEE In- ternational Conference on Privacy, Security, Risk, and Trust, and IEEE International Conference on Social Computing (2011)

work page 2011

[6] [6]

In Data Science–Analytics and Applications

F/i.sc/l.sc/t.sc/z.sc, E., P/o.sc/l.sc/l.sc/e.sc/r.sc/e.sc/s.sc, A., K/a.sc/r.sc/l.sc, R., /a.sc/n.sc/d.sc H/a.sc/s.sc/l.sc/h.sc/o.sc/f.sc/e.sc/r.sc, B.Evolution of the bitcoin address graph. In Data Science–Analytics and Applications. Springer, 2017, pp. 77– 82

work page 2017

[7] [7]

DEF CON conference, https: //www.cs.auckland.ac.nz/~pgut001/pubs/malwarebiz.pdf, 2007

G/u.sc/t.sc/m.sc/a.sc/n.sc/n.sc, P.The commercial malware industry. DEF CON conference, https: //www.cs.auckland.ac.nz/~pgut001/pubs/malwarebiz.pdf, 2007. Retrieved Feb- ruary 2, 2019

work page 2007

[8] [8]

H/a.sc/r.sc/r.sc/i.sc/g.sc/a.sc/n.sc, M., /a.sc/n.sc/d.sc F/r.sc/e.sc/t.sc/t.sc/e.sc/r.sc, C.The unreasonable eﬀectiveness of address clustering. In 2016 Intl IEEE Conferences on Ubiquitous Intelligence & Computing, Advanced and Trusted Computing, Scalable Computing and Communications, Cloud and Big Data Computing, Internet of People, and Smart World Cong...

work page 2016