{ "version": "1.0", "built_date": "2026-10-30", "title": "Initial Access Offers", "chapter_key": "initial-access", "creator": "Brandefense Research Team", "source": "Brandefense Blackhole", "population": "Blackhole posts carrying the classifier label \"Initial Access Selling\". A post is not an access offer, a seller, a victim or an access.", "period": { "start": "2026-01-01", "end": "2026-10-27", "label": "1 January–27 October 2026", "partial_month": "2026-10", "cut_date": "2026-10-27", "date_field": "post.created_at (post time, never ingest time)", "date_semantics": "Daily and window totals use the recorded post time; windows are 7 days or shorter and never cross a month." }, "summary": { "exact_labelled_posts": 166612, "days": 300, "fetched_posts_class_set": 166605, "retrieval_windows": 48, "windows_full_mode": 48, "cleaned_estimate_total": 39820 }, "monthly": [ { "month": "2026-01", "exact_total": 5098, "fetched": 5098, "fetched_fraction": 1.0, "cleaned_estimate": 2431, "cleaned_share_of_exact": 0.477, "foundation_cleaned_estimate": 2435, "foundation_exact_total": 5098, "foundation_fetched": 5098, "foundation_share_in_fully_fetched_windows": 1.0, "distinct_channels_fetched": 1014, "top1_channel_share": 0.0522, "top5_channel_share": 0.1671, "top20_channel_share": 0.3472, "top5_channel_share_cleaned": 0.1905, "top20_channel_share_cleaned": 0.4101, "partial": false }, { "month": "2026-02", "exact_total": 5105, "fetched": 5105, "fetched_fraction": 1.0, "cleaned_estimate": 2323, "cleaned_share_of_exact": 0.455, "foundation_cleaned_estimate": 2335, "foundation_exact_total": 5105, "foundation_fetched": 5105, "foundation_share_in_fully_fetched_windows": 1.0, "distinct_channels_fetched": 967, "top1_channel_share": 0.0443, "top5_channel_share": 0.1385, "top20_channel_share": 0.3387, "top5_channel_share_cleaned": 0.1817, "top20_channel_share_cleaned": 0.4034, "partial": false }, { "month": "2026-03", "exact_total": 3575, "fetched": 3575, "fetched_fraction": 1.0, "cleaned_estimate": 1729, "cleaned_share_of_exact": 0.484, "foundation_cleaned_estimate": 1730, "foundation_exact_total": 3575, "foundation_fetched": 3575, "foundation_share_in_fully_fetched_windows": 1.0, "distinct_channels_fetched": 793, "top1_channel_share": 0.0526, "top5_channel_share": 0.16, "top20_channel_share": 0.3407, "top5_channel_share_cleaned": 0.1978, "top20_channel_share_cleaned": 0.4239, "partial": false }, { "month": "2026-04", "exact_total": 12940, "fetched": 12940, "fetched_fraction": 1.0, "cleaned_estimate": 3047, "cleaned_share_of_exact": 0.235, "foundation_cleaned_estimate": 4070, "foundation_exact_total": 12940, "foundation_fetched": 3322, "foundation_share_in_fully_fetched_windows": 0.97, "distinct_channels_fetched": 1810, "top1_channel_share": 0.0684, "top5_channel_share": 0.1574, "top20_channel_share": 0.3191, "top5_channel_share_cleaned": 0.1726, "top20_channel_share_cleaned": 0.3505, "partial": false }, { "month": "2026-05", "exact_total": 2760, "fetched": 2760, "fetched_fraction": 1.0, "cleaned_estimate": 1178, "cleaned_share_of_exact": 0.427, "foundation_cleaned_estimate": 1191, "foundation_exact_total": 2760, "foundation_fetched": 2760, "foundation_share_in_fully_fetched_windows": 1.0, "distinct_channels_fetched": 714, "top1_channel_share": 0.0301, "top5_channel_share": 0.1362, "top20_channel_share": 0.3517, "top5_channel_share_cleaned": 0.1587, "top20_channel_share_cleaned": 0.4024, "partial": false }, { "month": "2026-06", "exact_total": 5892, "fetched": 5891, "fetched_fraction": 1.0, "cleaned_estimate": 2067, "cleaned_share_of_exact": 0.351, "foundation_cleaned_estimate": 2096, "foundation_exact_total": 5892, "foundation_fetched": 2678, "foundation_share_in_fully_fetched_windows": 0.93, "distinct_channels_fetched": 1200, "top1_channel_share": 0.09, "top5_channel_share": 0.1584, "top20_channel_share": 0.3059, "top5_channel_share_cleaned": 0.1219, "top20_channel_share_cleaned": 0.3299, "partial": false }, { "month": "2026-07", "exact_total": 9199, "fetched": 9199, "fetched_fraction": 1.0, "cleaned_estimate": 2598, "cleaned_share_of_exact": 0.282, "foundation_cleaned_estimate": 3673, "foundation_exact_total": 9199, "foundation_fetched": 500, "foundation_share_in_fully_fetched_windows": 0.0, "distinct_channels_fetched": 1349, "top1_channel_share": 0.0898, "top5_channel_share": 0.1992, "top20_channel_share": 0.3774, "top5_channel_share_cleaned": 0.1124, "top20_channel_share_cleaned": 0.3149, "partial": false }, { "month": "2026-08", "exact_total": 17457, "fetched": 17456, "fetched_fraction": 1.0, "cleaned_estimate": 2828, "cleaned_share_of_exact": 0.162, "foundation_cleaned_estimate": 4316, "foundation_exact_total": 17457, "foundation_fetched": 500, "foundation_share_in_fully_fetched_windows": 0.0, "distinct_channels_fetched": 1428, "top1_channel_share": 0.12, "top5_channel_share": 0.4451, "top20_channel_share": 0.6059, "top5_channel_share_cleaned": 0.1482, "top20_channel_share_cleaned": 0.3412, "partial": false }, { "month": "2026-09", "exact_total": 46920, "fetched": 46916, "fetched_fraction": 1.0, "cleaned_estimate": 11699, "cleaned_share_of_exact": 0.249, "foundation_cleaned_estimate": 15059, "foundation_exact_total": 46920, "foundation_fetched": 500, "foundation_share_in_fully_fetched_windows": 0.0, "distinct_channels_fetched": 2661, "top1_channel_share": 0.0516, "top5_channel_share": 0.1635, "top20_channel_share": 0.2766, "top5_channel_share_cleaned": 0.0782, "top20_channel_share_cleaned": 0.2361, "partial": false }, { "month": "2026-10", "exact_total": 57666, "fetched": 57665, "fetched_fraction": 1.0, "cleaned_estimate": 9920, "cleaned_share_of_exact": 0.172, "foundation_cleaned_estimate": 16479, "foundation_exact_total": 57573, "foundation_fetched": 400, "foundation_share_in_fully_fetched_windows": 0.0, "distinct_channels_fetched": 2913, "top1_channel_share": 0.035, "top5_channel_share": 0.1223, "top20_channel_share": 0.299, "top5_channel_share_cleaned": 0.0717, "top20_channel_share_cleaned": 0.2036, "partial": true } ], "daily_totals": { "file": "daily-totals.csv", "sum": 166612, "min_day": [ "2026-03-13", 1 ], "max_day": [ "2026-10-08", 3196 ], "note": "21 Sep (449) and 24 Oct (165) are low days, possible ingestion gaps, not real drops." }, "step": { "definition": "Exact API daily totals by post time. Pre window 1 Aug–10 Sep (41 days), post window 12 Sep–23 Oct (42 days); 11 Sep (ramp day) and the partial last days excluded.", "daily_exact_9_to_13_sep": { "2026-09-09": 381, "2026-09-10": 361, "2026-09-11": 673, "2026-09-12": 2011, "2026-09-13": 2078 }, "step_days": { "2026-09-10": 361, "2026-09-11": 673, "2026-09-12": 2011 }, "pre_mean_daily": 530, "pre_median_daily": 535, "post_mean_daily": 2290, "post_median_daily": 2323.0, "ratio_post_over_pre": 4.32 }, "cross_label_ratios": { "definition": "Mean posts per day 12–30 Sep divided by mean posts per day 25 Aug–10 Sep. Exact daily API totals for six other labels; the whole-corpus value is a one-fixed-minute-per-day proxy, not a day total.", "rows": [ { "label": "Initial Access Selling", "mean_daily_25aug_10sep": 473.2, "mean_daily_12_30sep": 2208.5, "ratio": 4.67, "kind": "label_daily_total" }, { "label": "Phishing", "mean_daily_25aug_10sep": 4565.5, "mean_daily_12_30sep": 8762.1, "ratio": 1.92, "kind": "label_daily_total" }, { "label": "Carding", "mean_daily_25aug_10sep": 2971.9, "mean_daily_12_30sep": 5164.3, "ratio": 1.74, "kind": "label_daily_total" }, { "label": "Combolist (email / username - passwords)", "mean_daily_25aug_10sep": 675.6, "mean_daily_12_30sep": 764, "ratio": 1.13, "kind": "label_daily_total" }, { "label": "Whole-corpus one-minute proxy", "mean_daily_25aug_10sep": 513.5, "mean_daily_12_30sep": 449.8, "ratio": 0.88, "kind": "one_minute_proxy" }, { "label": "Data Leak (PII / Database)", "mean_daily_25aug_10sep": 4361.1, "mean_daily_12_30sep": 2278.5, "ratio": 0.52, "kind": "label_daily_total" }, { "label": "Malicious Software", "mean_daily_25aug_10sep": 2195, "mean_daily_12_30sep": 1126.6, "ratio": 0.51, "kind": "label_daily_total" }, { "label": "Botnet Log", "mean_daily_25aug_10sep": 1579.5, "mean_daily_12_30sep": 514.4, "ratio": 0.33, "kind": "label_daily_total" } ], "reading": "Other labels moved both ways, so the step is not platform-wide volume growth. Ratios and absolute change per day; neither platform growth nor label reassignment is demonstrated." }, "channel_concentration": { "definition": "Shares of labelled posts held by the top 1, 5 and 20 source channels, measured on fetched posts. Channel names and handles are never published.", "pre_window_top1_top5_top20": [ 0.142, 0.4214, 0.5843 ], "post_window_top1_top5_top20": [ 0.0442, 0.127, 0.2654 ], "distinct_channels_pre_window": 1622, "distinct_channels_post_window": 3640, "post_share_from_channels_with_posts_in_pre_window": 0.6978, "post_share_from_channels_first_seen_after_11_sep": 0.1912, "post_share_from_channels_seen_before_11_sep": 0.8088, "post_daily_mean_from_channels_seen_before_11_sep": 1852, "post_daily_mean_from_channels_first_seen_after_11_sep": 438, "pre_daily_mean_fetched": 530, "monthly": [ { "month": "2026-01", "scope": "raw", "top1": 0.0522, "top5": 0.1671, "top20": 0.3472, "distinct_channels": 1014 }, { "month": "2026-01", "scope": "cleaned", "top1": 0.0773, "top5": 0.1905, "top20": 0.4101, "distinct_channels": 593 }, { "month": "2026-02", "scope": "raw", "top1": 0.0443, "top5": 0.1385, "top20": 0.3387, "distinct_channels": 967 }, { "month": "2026-02", "scope": "cleaned", "top1": 0.0697, "top5": 0.1817, "top20": 0.4034, "distinct_channels": 559 }, { "month": "2026-03", "scope": "raw", "top1": 0.0526, "top5": 0.16, "top20": 0.3407, "distinct_channels": 793 }, { "month": "2026-03", "scope": "cleaned", "top1": 0.0827, "top5": 0.1978, "top20": 0.4239, "distinct_channels": 458 }, { "month": "2026-04", "scope": "raw", "top1": 0.0684, "top5": 0.1574, "top20": 0.3191, "distinct_channels": 1810 }, { "month": "2026-04", "scope": "cleaned", "top1": 0.065, "top5": 0.1726, "top20": 0.3505, "distinct_channels": 762 }, { "month": "2026-05", "scope": "raw", "top1": 0.0301, "top5": 0.1362, "top20": 0.3517, "distinct_channels": 714 }, { "month": "2026-05", "scope": "cleaned", "top1": 0.0399, "top5": 0.1587, "top20": 0.4024, "distinct_channels": 363 }, { "month": "2026-06", "scope": "raw", "top1": 0.09, "top5": 0.1584, "top20": 0.3059, "distinct_channels": 1200 }, { "month": "2026-06", "scope": "cleaned", "top1": 0.0285, "top5": 0.1219, "top20": 0.3299, "distinct_channels": 593 }, { "month": "2026-07", "scope": "raw", "top1": 0.0898, "top5": 0.1992, "top20": 0.3774, "distinct_channels": 1349 }, { "month": "2026-07", "scope": "cleaned", "top1": 0.0296, "top5": 0.1124, "top20": 0.3149, "distinct_channels": 666 }, { "month": "2026-08", "scope": "raw", "top1": 0.12, "top5": 0.4451, "top20": 0.6059, "distinct_channels": 1428 }, { "month": "2026-08", "scope": "cleaned", "top1": 0.0389, "top5": 0.1482, "top20": 0.3412, "distinct_channels": 678 }, { "month": "2026-09", "scope": "raw", "top1": 0.0516, "top5": 0.1635, "top20": 0.2766, "distinct_channels": 2661 }, { "month": "2026-09", "scope": "cleaned", "top1": 0.021, "top5": 0.0782, "top20": 0.2361, "distinct_channels": 1328 }, { "month": "2026-10", "scope": "raw", "top1": 0.035, "top5": 0.1223, "top20": 0.299, "distinct_channels": 2913 }, { "month": "2026-10", "scope": "cleaned", "top1": 0.0183, "top5": 0.0717, "top20": 0.2036, "distinct_channels": 1437 } ] }, "language_mix": { "definition": "Classifier first-language tag, share of labelled posts in the window.", "pre_window": { "EN": 0.443, "ID": 0.433, "RU": 0.03, "ZH": 0.026, "TR": 0.017, "VI": 0.016 }, "post_window": { "EN": 0.382, "RU": 0.206, "ZH": 0.152, "ID": 0.103, "TR": 0.057, "VI": 0.047 } }, "content_mix": { "definition": "AI-coded stratified sample: 350 seeded post draws (327 distinct texts) from 1 Jan–27 Oct 2026. P1 = 1 Jan–31 Aug (n=150), P2 = 12 Sep–27 Oct (n=180), S1 = 1–11 Sep (n=20). Shares are population-weighted over kept and dropped (cleaning) strata; intervals are Wilson 95% on the stratified effective n.", "reader": "one primary reader (AI-assisted); second rater on a blind subset of 90", "rows": [ { "period": "P1", "period_label": "1 Jan–31 Aug", "category": "offer", "category_label": "Access offer", "draws_in_period": 150, "draws_in_category": 59, "weighted_share": 0.3823, "ci_low": 0.2812, "ci_high": 0.4948, "effective_n": 75.9 }, { "period": "P1", "period_label": "1 Jan–31 Aug", "category": "access_wanted_wtb", "category_label": "Buyer request (want to buy)", "draws_in_period": 150, "draws_in_category": 36, "weighted_share": 0.1111, "ci_low": 0.0752, "ci_high": 0.161, "effective_n": 208.2 }, { "period": "P1", "period_label": "1 Jan–31 Aug", "category": "legit_hosting_or_vps_ad", "category_label": "Hosting or VPS ad", "draws_in_period": 150, "draws_in_category": 6, "weighted_share": 0.046, "ci_low": 0.0164, "ci_high": 0.1224, "effective_n": 70.8 }, { "period": "P1", "period_label": "1 Jan–31 Aug", "category": "account_or_combo_selling", "category_label": "Consumer account or combo selling", "draws_in_period": 150, "draws_in_category": 18, "weighted_share": 0.093, "ci_low": 0.0483, "ci_high": 0.1718, "effective_n": 88.1 }, { "period": "P1", "period_label": "1 Jan–31 Aug", "category": "chat_or_discussion", "category_label": "Chat or discussion", "draws_in_period": 150, "draws_in_category": 6, "weighted_share": 0.061, "ci_low": 0.0238, "ci_high": 0.1474, "effective_n": 64.6 }, { "period": "P1", "period_label": "1 Jan–31 Aug", "category": "unclear", "category_label": "Unclear", "draws_in_period": 150, "draws_in_category": 13, "weighted_share": 0.1846, "ci_low": 0.1083, "ci_high": 0.2967, "effective_n": 63.8 }, { "period": "P1", "period_label": "1 Jan–31 Aug", "category": "legit_vpn_or_proxy_config_sharing", "category_label": "VPN or proxy config sharing", "draws_in_period": 150, "draws_in_category": 4, "weighted_share": 0.0557, "ci_low": 0.0202, "ci_high": 0.1444, "effective_n": 60.2 }, { "period": "P1", "period_label": "1 Jan–31 Aug", "category": "tutorial_or_tool", "category_label": "Tutorial or tool", "draws_in_period": 150, "draws_in_category": 1, "weighted_share": 0.0027, "ci_low": 0.0005, "ci_high": 0.0149, "effective_n": 377.2 }, { "period": "P1", "period_label": "1 Jan–31 Aug", "category": "scam_spam", "category_label": "Repeated spam or scam ad", "draws_in_period": 150, "draws_in_category": 2, "weighted_share": 0.0053, "ci_low": 0.0015, "ci_high": 0.0191, "effective_n": 379.7 }, { "period": "P1", "period_label": "1 Jan–31 Aug", "category": "other", "category_label": "Other", "draws_in_period": 150, "draws_in_category": 2, "weighted_share": 0.0203, "ci_low": 0.0043, "ci_high": 0.0907, "effective_n": 64.0 }, { "period": "P1", "period_label": "1 Jan–31 Aug", "category": "carding_fraud", "category_label": "Carding, mule or SIM trade", "draws_in_period": 150, "draws_in_category": 2, "weighted_share": 0.0203, "ci_low": 0.0043, "ci_high": 0.0907, "effective_n": 64.0 }, { "period": "P1", "period_label": "1 Jan–31 Aug", "category": "news", "category_label": "News", "draws_in_period": 150, "draws_in_category": 1, "weighted_share": 0.0177, "ci_low": 0.0031, "ci_high": 0.093, "effective_n": 57.0 }, { "period": "P2", "period_label": "12 Sep–27 Oct", "category": "offer", "category_label": "Access offer", "draws_in_period": 180, "draws_in_category": 13, "weighted_share": 0.0493, "ci_low": 0.0204, "ci_high": 0.1142, "effective_n": 92.3 }, { "period": "P2", "period_label": "12 Sep–27 Oct", "category": "account_or_combo_selling", "category_label": "Consumer account or combo selling", "draws_in_period": 180, "draws_in_category": 57, "weighted_share": 0.376, "ci_low": 0.2757, "ci_high": 0.4883, "effective_n": 76.2 }, { "period": "P2", "period_label": "12 Sep–27 Oct", "category": "chat_or_discussion", "category_label": "Chat or discussion", "draws_in_period": 180, "draws_in_category": 7, "weighted_share": 0.0539, "ci_low": 0.0208, "ci_high": 0.1328, "effective_n": 71.1 }, { "period": "P2", "period_label": "12 Sep–27 Oct", "category": "carding_fraud", "category_label": "Carding, mule or SIM trade", "draws_in_period": 180, "draws_in_category": 12, "weighted_share": 0.1759, "ci_low": 0.1032, "ci_high": 0.2837, "effective_n": 67.2 }, { "period": "P2", "period_label": "12 Sep–27 Oct", "category": "unclear", "category_label": "Unclear", "draws_in_period": 180, "draws_in_category": 7, "weighted_share": 0.0682, "ci_low": 0.0286, "ci_high": 0.1538, "effective_n": 68.2 }, { "period": "P2", "period_label": "12 Sep–27 Oct", "category": "scam_spam", "category_label": "Repeated spam or scam ad", "draws_in_period": 180, "draws_in_category": 64, "weighted_share": 0.1165, "ci_low": 0.0855, "ci_high": 0.1568, "effective_n": 313.0 }, { "period": "P2", "period_label": "12 Sep–27 Oct", "category": "access_wanted_wtb", "category_label": "Buyer request (want to buy)", "draws_in_period": 180, "draws_in_category": 5, "weighted_share": 0.008, "ci_low": 0.0035, "ci_high": 0.0183, "effective_n": 645.5 }, { "period": "P2", "period_label": "12 Sep–27 Oct", "category": "tutorial_or_tool", "category_label": "Tutorial or tool", "draws_in_period": 180, "draws_in_category": 1, "weighted_share": 0.0016, "ci_low": 0.0003, "ci_high": 0.009, "effective_n": 629.5 }, { "period": "P2", "period_label": "12 Sep–27 Oct", "category": "legit_hosting_or_vps_ad", "category_label": "Hosting or VPS ad", "draws_in_period": 180, "draws_in_category": 5, "weighted_share": 0.0222, "ci_low": 0.0059, "ci_high": 0.0799, "effective_n": 85.0 }, { "period": "P2", "period_label": "12 Sep–27 Oct", "category": "other", "category_label": "Other", "draws_in_period": 180, "draws_in_category": 3, "weighted_share": 0.0333, "ci_low": 0.0097, "ci_high": 0.1079, "effective_n": 66.4 }, { "period": "P2", "period_label": "12 Sep–27 Oct", "category": "legit_vpn_or_proxy_config_sharing", "category_label": "VPN or proxy config sharing", "draws_in_period": 180, "draws_in_category": 5, "weighted_share": 0.0792, "ci_low": 0.0346, "ci_high": 0.1711, "effective_n": 64.6 }, { "period": "P2", "period_label": "12 Sep–27 Oct", "category": "news", "category_label": "News", "draws_in_period": 180, "draws_in_category": 1, "weighted_share": 0.0158, "ci_low": 0.0028, "ci_high": 0.0842, "effective_n": 63.4 }, { "period": "S1", "period_label": "1–11 Sep", "category": "offer", "category_label": "Access offer", "draws_in_period": 20, "draws_in_category": 7, "weighted_share": 0.35, "ci_low": 0.1812, "ci_high": 0.5671, "effective_n": 20.0 }, { "period": "S1", "period_label": "1–11 Sep", "category": "carding_fraud", "category_label": "Carding, mule or SIM trade", "draws_in_period": 20, "draws_in_category": 3, "weighted_share": 0.15, "ci_low": 0.0524, "ci_high": 0.3604, "effective_n": 20.0 }, { "period": "S1", "period_label": "1–11 Sep", "category": "account_or_combo_selling", "category_label": "Consumer account or combo selling", "draws_in_period": 20, "draws_in_category": 5, "weighted_share": 0.25, "ci_low": 0.1119, "ci_high": 0.4687, "effective_n": 20.0 }, { "period": "S1", "period_label": "1–11 Sep", "category": "scam_spam", "category_label": "Repeated spam or scam ad", "draws_in_period": 20, "draws_in_category": 1, "weighted_share": 0.05, "ci_low": 0.0089, "ci_high": 0.2361, "effective_n": 20.0 }, { "period": "S1", "period_label": "1–11 Sep", "category": "chat_or_discussion", "category_label": "Chat or discussion", "draws_in_period": 20, "draws_in_category": 1, "weighted_share": 0.05, "ci_low": 0.0089, "ci_high": 0.2361, "effective_n": 20.0 }, { "period": "S1", "period_label": "1–11 Sep", "category": "access_wanted_wtb", "category_label": "Buyer request (want to buy)", "draws_in_period": 20, "draws_in_category": 1, "weighted_share": 0.05, "ci_low": 0.0089, "ci_high": 0.2361, "effective_n": 20.0 }, { "period": "S1", "period_label": "1–11 Sep", "category": "legit_vpn_or_proxy_config_sharing", "category_label": "VPN or proxy config sharing", "draws_in_period": 20, "draws_in_category": 1, "weighted_share": 0.05, "ci_low": 0.0089, "ci_high": 0.2361, "effective_n": 20.0 }, { "period": "S1", "period_label": "1–11 Sep", "category": "unclear", "category_label": "Unclear", "draws_in_period": 20, "draws_in_category": 1, "weighted_share": 0.05, "ci_low": 0.0089, "ci_high": 0.2361, "effective_n": 20.0 } ], "strata": [ { "stratum": "P1_kept", "population_posts": 18205, "draws": 110, "templates_read": 110, "access_offers": 44, "share": 0.4, "ci_low": 0.3133, "ci_high": 0.4934 }, { "stratum": "P1_dropped", "population_posts": 43819, "draws": 40, "templates_read": 23, "access_offers": 15, "share": 0.375, "ci_low": 0.2422, "ci_high": 0.5297 }, { "stratum": "P2_kept", "population_posts": 20698, "draws": 130, "templates_read": 130, "access_offers": 11, "share": 0.0846, "ci_low": 0.0479, "ci_high": 0.1452 }, { "stratum": "P2_dropped", "population_posts": 78924, "draws": 50, "templates_read": 46, "access_offers": 2, "share": 0.04, "ci_low": 0.011, "ci_high": 0.1346 }, { "stratum": "S1", "population_posts": 4959, "draws": 20, "templates_read": 18, "access_offers": 7, "share": 0.35, "ci_low": 0.1812, "ci_high": 0.5671 } ], "offer_share": { "P1": { "p": 0.3823, "n": 150, "n_eff": 75.9, "lo": 0.2812, "hi": 0.4948 }, "P2": { "p": 0.0493, "n": 180, "n_eff": 92.3, "lo": 0.0204, "hi": 0.1142 }, "S1": { "p": 0.35, "n": 20, "n_eff": 20.0, "lo": 0.1812, "hi": 0.5671 } }, "offer_posts_per_day": { "P1": { "days": 243, "estimate": 97.6, "low": 71.8, "high": 126.3 }, "P2": { "days": 46, "estimate": 106.8, "low": 44.2, "high": 247.3 }, "S1": { "days": 11, "estimate": 157.8, "low": 81.7, "high": 255.7 }, "reading": "Counting every copy, the bands overlap widely; for the step, use the separate cleaning-kept comparison (offer_posts_per_day_deduplicated.joint_ratio)." }, "estimated_offer_posts": { "P1": 23712, "P2": 4911, "S1": 1736 }, "offer_subtype_draw_counts_unweighted": { "definition": "Offers read, by subtype, unweighted counts of draws. Weighted P1 mix is dominated by one repeated shell/cPanel bot template, so no weighted mix is published; P2 has 13 offers, too few for percentages.", "P1": { "web_shell": 23, "vps_cloud_account": 5, "rdp": 7, "mixed_bulk": 15, "other": 2, "corporate_network": 2, "admin_panel_cms": 4, "cpanel_whm": 1 }, "P2": { "smtp": 4, "mixed_bulk": 3, "web_shell": 3, "other": 1, "vps_cloud_account": 2 } }, "near_duplicate_families_100_plus_share_of_kept": { "P1": 0.0115, "P2": 0.426 }, "one_slogan_family": { "posts": 7069, "share_of_P2_cleaned_kept": 0.34 }, "sensitivity_share_of_all_posts": { "strict_offers": { "P1": 0.3823, "P2": 0.0493 }, "offers_plus_unclear": { "P1": 0.567, "P2": 0.1174 }, "offers_plus_vps_hosting_ads_and_wtb": { "P1": 0.4283, "P2": 0.0715 }, "access_theme_incl_wanted_ads": { "P1": 0.4934, "P2": 0.0573 }, "web_shell_related_supply_and_demand": { "P1": 0.4357, "P2": 0.0318 } }, "cleaning_precision": { "P1": { "kept_n": 110, "kept_offers": 44, "kept_precision": 0.4, "kept_ci": [ 0.3133, 0.4934 ], "dropped_n": 40, "dropped_offers": 15, "dropped_offer_rate": 0.375, "dropped_ci": [ 0.2422, 0.5297 ], "share_of_offer_posts_removed_by_cleaning": 0.6929 }, "P2": { "kept_n": 130, "kept_offers": 11, "kept_precision": 0.0846, "kept_ci": [ 0.0479, 0.1452 ], "dropped_n": 50, "dropped_offers": 2, "dropped_offer_rate": 0.04, "dropped_ci": [ 0.011, 0.1346 ], "share_of_offer_posts_removed_by_cleaning": 0.6432 } }, "offer_posts_per_day_deduplicated": { "definition": "Offer posts per day among cleaning-kept (de-duplicated) posts: kept offer share times kept posts, divided by days. Preferred comparison because repeats are removed.", "rows": [ { "period": "1 Aug–11 Sep", "per_day": 24.2, "low": 16.2, "high": 34.4, "kept_draws": 70 }, { "period": "1 Jan–31 Aug", "per_day": 30.0, "low": 23.5, "high": 37.0, "kept_draws": 110 }, { "period": "12 Sep–27 Oct", "per_day": 38.1, "low": 21.6, "high": 65.3, "kept_draws": 130 } ], "reading": "Under this model the 12 Sep–27 Oct / 1 Aug–11 Sep ratio is about 1.6 (approximate 95% 0.8–3.1): no detectable change; a fourfold rise is not supported. Jan–Aug is a level, not a test baseline. Cleaning keeps near-duplicate spam after 12 September, so kept posts are not offers; the intervals are approximate.", "joint_ratio": { "definition": "Ratio of de-duplicated (cleaning-kept) offer posts per day, 12 Sep–27 Oct over 1 Aug–11 Sep 2026 (after / before), estimated jointly from both samples. Jan–Aug is not part of this test.", "windows": [ { "period": "1 Aug–11 Sep", "start": "2026-08-01", "end": "2026-09-11", "days": 42 }, { "period": "12 Sep–27 Oct", "start": "2026-09-12", "end": "2026-10-27", "days": 46 } ], "inputs": { "1 Aug–11 Sep": { "offers_in_kept_draws": 19, "kept_draws": 70, "kept_posts": 3748, "days": 42 }, "12 Sep–27 Oct": { "offers_in_kept_draws": 11, "kept_draws": 130, "kept_posts": 20698, "days": 46 } }, "ratio": 1.571861, "profile_likelihood_95_approx": [ 0.762261, 3.054155 ], "LR_vs_1": { "statistic": 1.573132, "p_value_chi2_1df": 0.209753 }, "LR_vs_4": { "statistic": 7.637639, "p_value_chi2_1df": 0.005716 }, "display": { "ratio": 1.6, "low": 0.8, "high": 3.1 }, "method": "Offers among each window's cleaning-kept draws are treated as independent binomial counts; kept posts and calendar days are held fixed (c = (N2/d2)/(N1/d1)). theta_hat is the maximum-likelihood ratio; the preferred interval is the approximate (asymptotic) 95% profile-likelihood interval (chi-square 1 df); likelihood-ratio tests against theta = 1 and theta = 4.", "limits": [ "c (kept posts and days) is held fixed; its own error is not modelled", "kept draws are assumed independent simple random draws within each window", "AI coding error, collection coverage, cleaning choices, near-duplicate dependence and template effects are outside the model", "approximate asymptotic interval: no finite-sample exact 95% coverage claim; an interval including 1 is not proof of equality", "applies to kept offer posts only; says nothing about sales, sellers or the whole market" ] }, "p1_note": "The 1 Jan–31 Aug period straddles the May–July classifier taxonomy break; this is a level comparison, not a trend." } }, "regex_tag_precision": { "definition": "Share of draws carrying a W1 regex tag where the tag was correct (an offer of the named type; for vpn tags, genuine config sharing). Wilson 95%.", "rows": [ { "period": "P1", "regex_tag": "chat_other", "draws": 44, "tag_correct": 38, "precision": 0.8636, "ci_low": 0.7329, "ci_high": 0.936 }, { "period": "P1", "regex_tag": "corporate_access", "draws": 28, "tag_correct": 1, "precision": 0.0357, "ci_low": 0.0063, "ci_high": 0.1771 }, { "period": "P1", "regex_tag": "cpanel_whm", "draws": 2, "tag_correct": 1, "precision": 0.5, "ci_low": 0.0945, "ci_high": 0.9055 }, { "period": "P1", "regex_tag": "rdp", "draws": 17, "tag_correct": 7, "precision": 0.4118, "ci_low": 0.2161, "ci_high": 0.6399 }, { "period": "P1", "regex_tag": "ssh_root", "draws": 2, "tag_correct": 0, "precision": 0.0, "ci_low": 0, "ci_high": 0.6576 }, { "period": "P1", "regex_tag": "vpn_config", "draws": 2, "tag_correct": 1, "precision": 0.5, "ci_low": 0.0945, "ci_high": 0.9055 }, { "period": "P1", "regex_tag": "vpn_config_strong", "draws": 3, "tag_correct": 3, "precision": 1.0, "ci_low": 0.4385, "ci_high": 1 }, { "period": "P1", "regex_tag": "vps_cloud", "draws": 11, "tag_correct": 4, "precision": 0.3636, "ci_low": 0.1517, "ci_high": 0.6462 }, { "period": "P1", "regex_tag": "web_shell", "draws": 41, "tag_correct": 15, "precision": 0.3659, "ci_low": 0.2359, "ci_high": 0.5188 }, { "period": "P2", "regex_tag": "chat_other", "draws": 123, "tag_correct": 122, "precision": 0.9919, "ci_low": 0.9554, "ci_high": 0.9986 }, { "period": "P2", "regex_tag": "corporate_access", "draws": 6, "tag_correct": 0, "precision": 0.0, "ci_low": 0, "ci_high": 0.3903 }, { "period": "P2", "regex_tag": "cpanel_whm", "draws": 1, "tag_correct": 0, "precision": 0.0, "ci_low": 0, "ci_high": 0.7935 }, { "period": "P2", "regex_tag": "rdp", "draws": 1, "tag_correct": 0, "precision": 0.0, "ci_low": 0, "ci_high": 0.7935 }, { "period": "P2", "regex_tag": "smtp", "draws": 3, "tag_correct": 3, "precision": 1.0, "ci_low": 0.4385, "ci_high": 1 }, { "period": "P2", "regex_tag": "ssh_root", "draws": 1, "tag_correct": 0, "precision": 0.0, "ci_low": 0, "ci_high": 0.7935 }, { "period": "P2", "regex_tag": "vpn_config", "draws": 24, "tag_correct": 0, "precision": 0.0, "ci_low": 0, "ci_high": 0.138 }, { "period": "P2", "regex_tag": "vpn_config_strong", "draws": 3, "tag_correct": 3, "precision": 1.0, "ci_low": 0.4385, "ci_high": 1 }, { "period": "P2", "regex_tag": "vps_cloud", "draws": 8, "tag_correct": 1, "precision": 0.125, "ci_low": 0.0224, "ci_high": 0.4709 }, { "period": "P2", "regex_tag": "web_shell", "draws": 10, "tag_correct": 2, "precision": 0.2, "ci_low": 0.0567, "ci_high": 0.5098 }, { "period": "ALL", "regex_tag": "chat_other", "draws": 176, "tag_correct": 168, "precision": 0.9545, "ci_low": 0.9129, "ci_high": 0.9768 }, { "period": "ALL", "regex_tag": "corporate_access", "draws": 39, "tag_correct": 1, "precision": 0.0256, "ci_low": 0.0045, "ci_high": 0.1318 }, { "period": "ALL", "regex_tag": "cpanel_whm", "draws": 4, "tag_correct": 2, "precision": 0.5, "ci_low": 0.15, "ci_high": 0.85 }, { "period": "ALL", "regex_tag": "rdp", "draws": 19, "tag_correct": 7, "precision": 0.3684, "ci_low": 0.1915, "ci_high": 0.5896 }, { "period": "ALL", "regex_tag": "smtp", "draws": 3, "tag_correct": 3, "precision": 1.0, "ci_low": 0.4385, "ci_high": 1 }, { "period": "ALL", "regex_tag": "ssh_root", "draws": 3, "tag_correct": 0, "precision": 0.0, "ci_low": 0, "ci_high": 0.5615 }, { "period": "ALL", "regex_tag": "vpn_config", "draws": 27, "tag_correct": 2, "precision": 0.0741, "ci_low": 0.0206, "ci_high": 0.2337 }, { "period": "ALL", "regex_tag": "vpn_config_strong", "draws": 6, "tag_correct": 6, "precision": 1.0, "ci_low": 0.6097, "ci_high": 1.0 }, { "period": "ALL", "regex_tag": "vps_cloud", "draws": 21, "tag_correct": 7, "precision": 0.3333, "ci_low": 0.1719, "ci_high": 0.5463 }, { "period": "ALL", "regex_tag": "web_shell", "draws": 52, "tag_correct": 17, "precision": 0.3269, "ci_low": 0.2152, "ci_high": 0.4624 } ], "corporate_access_pooled": { "draws": 39, "correct": 1, "note": "The foundation corporate-access regex was correct in 1 of 39 sampled hits; the \"corporate about 5%\" and 10–16% regex shares are not supported." }, "corporate_network_offers_in_random_sample": { "offer_draws": 79, "corporate": 2 } }, "second_rater": { "sample_subset": { "n": 90, "per_period_n": { "P1": 45, "P2": 45 }, "three_class": { "agreement_pct": 88.9, "kappa": 0.751 }, "binary_yes_vs_not_yes": { "agreement_pct": 98.9, "kappa": 0.963 }, "confusion_rater2_vs_rater1": { "y/y": 16, "n/n": 60, "u/u": 4, "u/n": 8, "u/y": 1, "n/u": 1, "y/n": 0, "n/y": 0 }, "subtype_agreement_both_yes": { "agree": 16, "of": 16 }, "offer_share_mine_vs_r1": { "P1": { "n": 45, "rater2_yes": 14, "rater1_yes": 15, "rater2_pct": 31.1, "rater1_pct": 33.3 }, "P2": { "n": 45, "rater2_yes": 2, "rater1_yes": 2, "rater2_pct": 4.4, "rater1_pct": 4.4 } } }, "corporate_subset": { "n": 40, "three_class_agreement_pct": 87.5, "three_class_kappa": 0.767, "yes_vs_not_yes_agreement_pct": 95.0, "yes_vs_not_yes_kappa": 0.875 }, "note": "Blind second rater (AI-assisted, separate pass). Disagreements were almost all \"unclear\" versus \"no\"; no yes/no flips in the sample subset. Not a human check." }, "corporate_catalogue": { "offers": 120, "candidate_texts_reviewed": 469, "records": 141, "posts_occupied": 144, "listings_total_across_offers": 181, "list_offers": 13, "listings_in_list_offers": 74, "genuine_offers_removed_by_cleaning_not_counted": 17, "access_method": { "firewall": 23, "web_app_db": 17, "rdp": 12, "vpn": 12, "cloud": 10, "multiple": 9, "unstated_or_other": 8, "domain_ad": 7, "rdweb": 7, "remote_mgmt_or_app": 5, "fortinet_unspecified": 4, "shell": 3, "vpn+rdp": 2, "citrix": 1 }, "privilege": { "admin_root_system": 59, "user_level": 24, "domain_admin": 17, "unstated": 17, "mixed": 3 }, "revenue_band_stated_by_seller": { "unstated": 44, "10M-100M": 23, "<10M": 19, ">1B": 17, "100M-1B": 16, "mixed": 1 }, "sector_generic": { "government": 16, "withheld": 15, "manufacturing": 14, "retail_consumer": 14, "technology": 12, "mixed": 10, "unstated": 9, "finance": 7, "professional_services": 6, "education": 3, "healthcare_pharma": 3, "transport_logistics": 3, "telecom": 3, "energy_mining": 3, "media_gaming": 2 }, "region": { "Europe": 29, "Asia": 24, "North America": 17, "Latin America": 16, "Middle East": 13, "multiple": 11, "unstated": 7, "Africa": 2, "Oceania": 1 }, "language": { "EN": 114, "RU": 5, "TR": 1 }, "edr_or_av_named": 32, "edr_stated_field": { "not_stated": 85, "stated": 30, "none_detected": 3, "stated_mixed": 2 }, "price_form": { "fixed": 67, "unstated": 27, "auction_blitz": 13, "negotiable": 12, "blitz_only": 1 }, "first_seen_by_month": { "2026-01": 18, "2026-02": 30, "2026-03": 18, "2026-04": 20, "2026-05": 17, "2026-06": 6, "2026-07": 6, "2026-08": 5 }, "first_seen_jan_may": 103, "first_seen_jun_oct": 17, "source_path": { "seller_post_only": 66, "relay_only": 41, "both": 6, "list_posts": 7, "auctions_via_relay": "13 of 13" }, "sector_note": "For the 14 offers with a stated revenue over $1B the sector is withheld in the public catalogue and the exact price is replaced by a bucket.", "one_contact_identifier_share_of_offers": { "offers": 15, "of": 120, "share": 0.125, "note": "count only; no identifier is published; 14 of the 23 firewall listings and 1 firewall-and-VPN listing carry it" }, "second_rater_yes_vs_not_yes": { "n": 40, "agreement_pct": 95.0, "kappa": 0.875 }, "caveat": "Lower bound: pattern recall is unknown. Revenue, sector, EDR and privilege are seller claims, unverified. Jan–May 103 of 120 vs Jun–Oct 17 reflects what the collection captured (relay channels), not a market trend.", "price_comparison_policy": "Revenue bands describe the advertised profile, not a verified company value or a price predictor. Fixed, auction, negotiable and unstated price formats are counted separately. The dollar denomination is often unstated, and source selection for one historical corporate price aggregate cannot be uniquely bound under the permitted coded fields. This edition therefore makes no cross-listing price comparison; individual dated asking terms remain in the catalogue." }, "pricing": { "sample": { "priced_kept_texts_population": 4308, "sampled_texts": 200, "commodity_offers": 139, "buyer_bids": 18, "not_commodity_offers": 43, "not_commodity_offers_note": "42 texts that were not access offers plus 1 corporate-profile listing (which is access, but not commodity)", "note": "Uneven stratified allocation: pooled shares are not population estimates." }, "packaging_terms_among_139_offers": { "hardware_spec_tiers": 41, "warranty_or_replacement": 24, "itemised_list": 21, "country_or_region_choice": 18, "escrow_accepted": 13, "fresh_or_new_stock": 12, "bulk_or_volume_discount": 11, "authority_seo_metrics": 8, "duration_tiers": 6, "sold_markers_in_list": 5, "validity_checked": 5, "traffic_metric": 4, "stock_counts_shown": 4, "negotiable": 3, "metric_price_tiers": 2, "single_buyer_lot": 2, "proof_or_sample": 2, "auction": 1, "no_warranty": 1, "lost_access_markers": 1, "struck_through_discount": 1, "replacement_if_dead": 1, "no_escrow": 1, "refund": 1, "proxy_ip_bundled": 1 }, "unit_among_139_offers": { "per_piece": 69, "none": 14, "per_bulk_n": 14, "per_plan": 13, "per_month": 10, "per_item": 10, "per_subscription": 6, "per_period": 2, "per_offer": 1 }, "currency_among_139_offers": { "USD": 118, "IDR": 16, "INR": 2, "USDT": 2, "CNY": 1 }, "subtype_among_139_offers": { "cloud_account": 35, "rdp": 25, "web_shell": 20, "cpanel_whm": 15, "smtp": 14, "ssh_root": 11, "vps_server": 10, "wp_admin": 3, "mixed_hacked_stock": 3, "shell_cpanel_mixed": 2, "other_access": 1 }, "rdp_warranty_windows": { "posts_with_term": 10, "of_posts": 25, "windows": { "1 month (three copies of one template, English and Spanish)": 3, "15 days": 4, "20 days": 1, "1 week": 1, "replace if dead within 30 days": 1 } }, "rule": "Prices remain separate dated asking or bidding terms with their stated units and periods. The legacy USD code combines explicit USD and bare \"$\" with an unstated denomination. No common denomination and unit cohort is established, so this edition publishes no cross-advertisement price median, rank, ratio, range or inferred price relationship. Same-advertisement arithmetic remains attached to that advertisement.", "currency_code_note": "USD is a legacy combined code for explicit USD and bare dollar signs; it does not establish denomination. Counts are code counts, not a currency-verified cohort." }, "cleaning_correction": { "definition": "Foundation cleaned estimates for Jul–Oct were scaled from a 400–500 post sample per month (exact_fraction 0). Jul–Oct were then fetched in full (>=99.99% of exact totals) and the same cleaning rules re-run.", "rows": [ { "month": "2026-01", "foundation_cleaned_estimate": 2435, "foundation_share_in_fully_fetched_windows": 1.0, "full_fetch_cleaned_estimate": 2431, "difference": -4, "foundation_exact_total": 5098, "exact_total_now": 5098 }, { "month": "2026-02", "foundation_cleaned_estimate": 2335, "foundation_share_in_fully_fetched_windows": 1.0, "full_fetch_cleaned_estimate": 2323, "difference": -12, "foundation_exact_total": 5105, "exact_total_now": 5105 }, { "month": "2026-03", "foundation_cleaned_estimate": 1730, "foundation_share_in_fully_fetched_windows": 1.0, "full_fetch_cleaned_estimate": 1729, "difference": -1, "foundation_exact_total": 3575, "exact_total_now": 3575 }, { "month": "2026-04", "foundation_cleaned_estimate": 4070, "foundation_share_in_fully_fetched_windows": 0.97, "full_fetch_cleaned_estimate": 3047, "difference": -1023, "foundation_exact_total": 12940, "exact_total_now": 12940 }, { "month": "2026-05", "foundation_cleaned_estimate": 1191, "foundation_share_in_fully_fetched_windows": 1.0, "full_fetch_cleaned_estimate": 1178, "difference": -13, "foundation_exact_total": 2760, "exact_total_now": 2760 }, { "month": "2026-06", "foundation_cleaned_estimate": 2096, "foundation_share_in_fully_fetched_windows": 0.93, "full_fetch_cleaned_estimate": 2067, "difference": -29, "foundation_exact_total": 5892, "exact_total_now": 5892 }, { "month": "2026-07", "foundation_cleaned_estimate": 3673, "foundation_share_in_fully_fetched_windows": 0.0, "full_fetch_cleaned_estimate": 2598, "difference": -1075, "foundation_exact_total": 9199, "exact_total_now": 9199 }, { "month": "2026-08", "foundation_cleaned_estimate": 4316, "foundation_share_in_fully_fetched_windows": 0.0, "full_fetch_cleaned_estimate": 2828, "difference": -1488, "foundation_exact_total": 17457, "exact_total_now": 17457 }, { "month": "2026-09", "foundation_cleaned_estimate": 15059, "foundation_share_in_fully_fetched_windows": 0.0, "full_fetch_cleaned_estimate": 11699, "difference": -3360, "foundation_exact_total": 46920, "exact_total_now": 46920 }, { "month": "2026-10", "foundation_cleaned_estimate": 16479, "foundation_share_in_fully_fetched_windows": 0.0, "full_fetch_cleaned_estimate": 9920, "difference": -6559, "foundation_exact_total": 57573, "exact_total_now": 57666 } ], "april_june_note": "April and June windows were also re-pulled in full. April falls from 4,070 to 3,047 (-25%) and June from 2,096 to 2,067. The foundation field is the share of volume in fully fetched windows, not fetched divided by exact.", "october_note": "Foundation October total 57,573 was taken before 28 Oct closed; 1–27 Oct is 57,666 now (1–28 Oct is 58,667). Analyses use 1–27 Oct." }, "retrieval": { "windows": 48, "file": "retrieval-windows.csv", "daily_total_calls": "Exact per-day totals come from 300 per-day count calls (daily-totals.csv).", "fetched_vs_exact": "166,605 fetched of 166,612 exact", "full_fetch_note": "Every window of the label set is in full mode. Seven posts are missing across five windows (deficits 1, 1, 2, 2 and 1); the minimum fetched fraction is 1735/1736, about 99.94%." }, "definitions": { "post": "One Blackhole record (a message or thread post) carrying the label. Telegram-dominated.", "template": "A group of posts with the same normalised text; the cleaning step keeps the earliest post of each exact text.", "offer": "A post that, on a full read, advertises access for sale. AI-labelled; a repost of the same listing is one offer in the corporate catalogue.", "listing": "One item inside an offer (one domain, one server, one account). A list post bundles many listings.", "cleaned_estimate": "Posts kept after the foundation cleaning rules (noise, short, template/bot, mirror/news, off-topic, duplicate). Not a count of offers." }, "revision": { "definition": "Revision-round numbers (lead-checked sheet, section F). Each block names its source file and window.", "f1_baseline_p1b": { "window": "1 Aug–11 Sep 2026 (42 days, 533.7 posts a day); 110 new draws (70 kept, 40 dropped), 93 templates read; AI coder, no second rater", "offer_share": { "p": 0.5450597495299703, "lo": 0.41861782737018016, "hi": 0.6659465904805106 }, "offer_posts_per_day_all_copies": { "p": 290.9, "lo": 223.4, "hi": 355.4 }, "offer_posts_per_day_excluding_bot_ad": { "p": 68.7, "lo": 36.7, "hi": 121.7 }, "bot_ad": { "definition": "One repeated shell/cPanel ad identified by its fixed promotion footer", "posts_in_window": 8477, "per_day": 201.8, "share_of_all_label_posts": 0.3782, "posts_surviving_cleaning": 0, "share_of_offer_posts_sample": 0.764, "posts_by_month": { "2026-07": 893, "2026-08": 7260, "2026-09": 2451, "2026-10": 1606 }, "posts_by_month_source": "internal research file (not published)" } }, "f2_offer_posts_per_day_deduplicated": { "definition": "Offer posts per day among cleaning-kept (de-duplicated) posts: kept offer share times kept posts, divided by days. Preferred comparison because repeats are removed.", "rows": [ { "period": "1 Aug–11 Sep", "per_day": 24.2, "low": 16.2, "high": 34.4, "kept_draws": 70 }, { "period": "1 Jan–31 Aug", "per_day": 30.0, "low": 23.5, "high": 37.0, "kept_draws": 110 }, { "period": "12 Sep–27 Oct", "per_day": 38.1, "low": 21.6, "high": 65.3, "kept_draws": 130 } ], "reading": "Under this model the 12 Sep–27 Oct / 1 Aug–11 Sep ratio is about 1.6 (approximate 95% 0.8–3.1): no detectable change; a fourfold rise is not supported. Jan–Aug is a level, not a test baseline. Cleaning keeps near-duplicate spam after 12 September, so kept posts are not offers; the intervals are approximate.", "joint_ratio": { "definition": "Ratio of de-duplicated (cleaning-kept) offer posts per day, 12 Sep–27 Oct over 1 Aug–11 Sep 2026 (after / before), estimated jointly from both samples. Jan–Aug is not part of this test.", "windows": [ { "period": "1 Aug–11 Sep", "start": "2026-08-01", "end": "2026-09-11", "days": 42 }, { "period": "12 Sep–27 Oct", "start": "2026-09-12", "end": "2026-10-27", "days": 46 } ], "inputs": { "1 Aug–11 Sep": { "offers_in_kept_draws": 19, "kept_draws": 70, "kept_posts": 3748, "days": 42 }, "12 Sep–27 Oct": { "offers_in_kept_draws": 11, "kept_draws": 130, "kept_posts": 20698, "days": 46 } }, "ratio": 1.571861, "profile_likelihood_95_approx": [ 0.762261, 3.054155 ], "LR_vs_1": { "statistic": 1.573132, "p_value_chi2_1df": 0.209753 }, "LR_vs_4": { "statistic": 7.637639, "p_value_chi2_1df": 0.005716 }, "display": { "ratio": 1.6, "low": 0.8, "high": 3.1 }, "method": "Offers among each window's cleaning-kept draws are treated as independent binomial counts; kept posts and calendar days are held fixed (c = (N2/d2)/(N1/d1)). theta_hat is the maximum-likelihood ratio; the preferred interval is the approximate (asymptotic) 95% profile-likelihood interval (chi-square 1 df); likelihood-ratio tests against theta = 1 and theta = 4.", "limits": [ "c (kept posts and days) is held fixed; its own error is not modelled", "kept draws are assumed independent simple random draws within each window", "AI coding error, collection coverage, cleaning choices, near-duplicate dependence and template effects are outside the model", "approximate asymptotic interval: no finite-sample exact 95% coverage claim; an interval including 1 is not proof of equality", "applies to kept offer posts only; says nothing about sales, sellers or the whole market" ] }, "p1_note": "The 1 Jan–31 Aug period straddles the May–July classifier taxonomy break; this is a level comparison, not a trend." }, "f3_increment_decomposition": { "definition": "Step-window daily increment: 530 (1 Aug-10 Sep, 41 days) to 2,290 (12 Sep-23 Oct, 42 days), +1,760. Multiply these step-window totals by sample offer shares from 1 Aug-11 Sep and 12 Sep-27 Oct. This yields 288.9 to 112.8 offers/day, -176.1; the separate full-period all-copy rates are 290.9 to 106.8, -184.1. Bands are rough normal approximations from independent Wilson intervals, for guidance only. Shares are shares of posts, not of distinct messages.", "categories": { "access_offer": { "category_label": "Access offers", "share_before": 0.5451, "share_after": 0.0493, "posts_per_day_before": 288.9, "posts_per_day_after": 112.8, "change_per_day": -176.1, "share_of_increment": -0.1, "band95_approx": [ -301.8, -50.3 ] }, "access_wanted_wtb": { "category_label": "Buyer request (want to buy)", "share_before": 0.1055, "share_after": 0.008, "posts_per_day_before": 55.9, "posts_per_day_after": 18.3, "change_per_day": -37.6, "share_of_increment": -0.021, "band95_approx": [ -78.9, 3.8 ] }, "account_or_combo_selling": { "category_label": "Consumer account or combo selling", "share_before": 0.0983, "share_after": 0.376, "posts_per_day_before": 52.1, "posts_per_day_after": 861.1, "change_per_day": 809.0, "share_of_increment": 0.46, "band95_approx": [ 562.7, 1055.3 ] }, "carding_fraud": { "category_label": "Carding, mule or SIM trade", "share_before": 0.044, "share_after": 0.1759, "posts_per_day_before": 23.3, "posts_per_day_after": 402.8, "change_per_day": 379.5, "share_of_increment": 0.216, "band95_approx": [ 170.1, 588.8 ] }, "chat_or_discussion": { "category_label": "Chat or discussion", "share_before": 0.0048, "share_after": 0.0539, "posts_per_day_before": 2.5, "posts_per_day_after": 123.5, "change_per_day": 121.0, "share_of_increment": 0.069, "band95_approx": [ -7.4, 249.3 ] }, "legit_hosting_or_vps_ad": { "category_label": "Hosting or VPS ad", "share_before": 0.0423, "share_after": 0.0222, "posts_per_day_before": 22.4, "posts_per_day_after": 50.9, "change_per_day": 28.5, "share_of_increment": 0.016, "band95_approx": [ -59.6, 116.6 ] }, "legit_vpn_or_proxy_config_sharing": { "category_label": "VPN or proxy config sharing", "share_before": 0.072, "share_after": 0.0792, "posts_per_day_before": 38.2, "posts_per_day_after": 181.4, "change_per_day": 143.3, "share_of_increment": 0.081, "band95_approx": [ -17.6, 304.1 ] }, "news": { "category_label": "News", "share_before": 0.0, "share_after": 0.0158, "posts_per_day_before": 0.0, "posts_per_day_after": 36.3, "change_per_day": 36.3, "share_of_increment": 0.021, "band95_approx": [ -56.9, 129.5 ] }, "other": { "category_label": "Other", "share_before": 0.0, "share_after": 0.0333, "posts_per_day_before": 0.0, "posts_per_day_after": 76.2, "change_per_day": 76.2, "share_of_increment": 0.043, "band95_approx": [ -36.2, 188.7 ] }, "scam_spam": { "category_label": "Repeated spam or scam ad", "share_before": 0.0208, "share_after": 0.1165, "posts_per_day_before": 11.0, "posts_per_day_after": 266.9, "change_per_day": 255.8, "share_of_increment": 0.145, "band95_approx": [ 169.6, 342.0 ] }, "tutorial_or_tool": { "category_label": "Tutorial or tool", "share_before": 0.0, "share_after": 0.0016, "posts_per_day_before": 0.0, "posts_per_day_after": 3.7, "change_per_day": 3.7, "share_of_increment": 0.002, "band95_approx": [ -6.3, 13.6 ] }, "unclear": { "category_label": "Unclear", "share_before": 0.0672, "share_after": 0.0682, "posts_per_day_before": 35.6, "posts_per_day_after": 156.1, "change_per_day": 120.5, "share_of_increment": 0.068, "band95_approx": [ -27.9, 268.9 ] } }, "reading": "Access offers fall by about 176 a day, driven by the decline of one bot ad. The increment is mostly consumer account selling, carding, mule and SIM buying, repeated spam, config sharing, chat and unclear text." }, "f4_absolute_change_by_label": { "definition": "Mean posts a day 25 Aug–10 Sep against 12–30 Sep; the whole-corpus value is a one-fixed-minute proxy (posts per minute).", "rows": { "all_corpus_1min_0922": { "mean_day_25aug_10sep": 513.5, "mean_day_12_30sep": 449.8, "abs_change_per_day": -63.7, "ratio": 0.88, "note": "posts per minute proxy" }, "Combolist (email / username - passwords)": { "mean_day_25aug_10sep": 675.6, "mean_day_12_30sep": 764.0, "abs_change_per_day": 88.4, "ratio": 1.13, "note": "exact day total" }, "Botnet Log": { "mean_day_25aug_10sep": 1579.5, "mean_day_12_30sep": 514.4, "abs_change_per_day": -1065.1, "ratio": 0.33, "note": "exact day total" }, "Carding": { "mean_day_25aug_10sep": 2971.9, "mean_day_12_30sep": 5164.3, "abs_change_per_day": 2192.3, "ratio": 1.74, "note": "exact day total" }, "Data Leak (PII / Database)": { "mean_day_25aug_10sep": 4361.1, "mean_day_12_30sep": 2278.5, "abs_change_per_day": -2082.6, "ratio": 0.52, "note": "exact day total" }, "Malicious Software": { "mean_day_25aug_10sep": 2195.0, "mean_day_12_30sep": 1126.6, "abs_change_per_day": -1068.4, "ratio": 0.51, "note": "exact day total" }, "Phishing": { "mean_day_25aug_10sep": 4565.5, "mean_day_12_30sep": 8762.1, "abs_change_per_day": 4196.6, "ratio": 1.92, "note": "exact day total" }, "Initial Access Selling": { "mean_day_25aug_10sep": 473.2, "mean_day_12_30sep": 2208.5, "abs_change_per_day": 1735.3, "ratio": 4.67, "note": "exact day total" } } }, "f5_families": { "definition": "Message families (near-identical texts) with public-safe ids F01–F15; no text, channel names or handles.", "f01_zh_vpn_traffic_slogan": { "posts": 7174, "kept_posts": 7069, "channels": 124, "posts_before_12_sep": 0, "first_seen": "2026-09-18", "last_seen": "2026-10-10", "reading": "A new campaign that began six days after the step; it cannot explain the step." }, "top15_post_step_families": { "first_seen_on_or_after_11_sep": 11, "first_seen_strictly_after_11_sep": 10, "share_of_12sep_27oct_posts": 0.2745, "share_of_12sep_27oct_posts_in_the_ten_strictly_after_11_sep": 0.1867, "share_of_12sep_27oct_posts_in_the_eleven_on_or_after_11_sep": 0.1967, "denominator_posts_12sep_27oct": 99622, "note": "The 27.5% is all 15 largest families together; the ten first seen after 11 September hold less." }, "distinct_families_per_day": { "1aug_10sep": 292.2, "12sep_23oct": 1317.6, "reading": "The step is breadth (many different messages), not repetition." }, "rows": [ { "family": "F01", "posts_sep12_oct27": "7174", "kept_posts_sep12_oct27": "7069", "posts_before_sep12": "0", "first_seen": "2026-09-18", "last_seen": "2026-10-10", "distinct_channels_sep12_oct27": "124", "language": "ZH", "primary_tag": "chat_other", "emerged": "new_on_or_after_sep11" }, { "family": "F02", "posts_sep12_oct27": "4211", "kept_posts_sep12_oct27": "0", "posts_before_sep12": "51", "first_seen": "2026-04-15", "last_seen": "2026-10-26", "distinct_channels_sep12_oct27": "1", "language": "EN", "primary_tag": "chat_other", "emerged": "existed_before" }, { "family": "F03", "posts_sep12_oct27": "3500", "kept_posts_sep12_oct27": "0", "posts_before_sep12": "0", "first_seen": "2026-10-15", "last_seen": "2026-10-27", "distinct_channels_sep12_oct27": "10", "language": "RU", "primary_tag": "chat_other", "emerged": "new_on_or_after_sep11" }, { "family": "F04", "posts_sep12_oct27": "2709", "kept_posts_sep12_oct27": "1500", "posts_before_sep12": "0", "first_seen": "2026-10-14", "last_seen": "2026-10-23", "distinct_channels_sep12_oct27": "98", "language": "TR", "primary_tag": "chat_other", "emerged": "new_on_or_after_sep11" }, { "family": "F05", "posts_sep12_oct27": "2112", "kept_posts_sep12_oct27": "0", "posts_before_sep12": "3094", "first_seen": "2026-08-23", "last_seen": "2026-10-10", "distinct_channels_sep12_oct27": "4", "language": "EN", "primary_tag": "corporate_access", "emerged": "existed_before" }, { "family": "F06", "posts_sep12_oct27": "1444", "kept_posts_sep12_oct27": "109", "posts_before_sep12": "0", "first_seen": "2026-10-16", "last_seen": "2026-10-27", "distinct_channels_sep12_oct27": "16", "language": "ZH", "primary_tag": "chat_other", "emerged": "new_on_or_after_sep11" }, { "family": "F07", "posts_sep12_oct27": "1130", "kept_posts_sep12_oct27": "140", "posts_before_sep12": "0", "first_seen": "2026-10-17", "last_seen": "2026-10-23", "distinct_channels_sep12_oct27": "5", "language": "ID", "primary_tag": "web_shell", "emerged": "new_on_or_after_sep11" }, { "family": "F08", "posts_sep12_oct27": "1001", "kept_posts_sep12_oct27": "0", "posts_before_sep12": "24", "first_seen": "2026-09-09", "last_seen": "2026-09-28", "distinct_channels_sep12_oct27": "54", "language": "ZH", "primary_tag": "chat_other", "emerged": "existed_before" }, { "family": "F09", "posts_sep12_oct27": "993", "kept_posts_sep12_oct27": "1", "posts_before_sep12": "2", "first_seen": "2026-09-11", "last_seen": "2026-10-13", "distinct_channels_sep12_oct27": "4", "language": "RU", "primary_tag": "chat_other", "emerged": "new_on_or_after_sep11" }, { "family": "F10", "posts_sep12_oct27": "692", "kept_posts_sep12_oct27": "0", "posts_before_sep12": "0", "first_seen": "2026-09-30", "last_seen": "2026-10-04", "distinct_channels_sep12_oct27": "17", "language": "EN", "primary_tag": "corporate_access", "emerged": "new_on_or_after_sep11" }, { "family": "F11", "posts_sep12_oct27": "602", "kept_posts_sep12_oct27": "96", "posts_before_sep12": "0", "first_seen": "2026-10-06", "last_seen": "2026-10-13", "distinct_channels_sep12_oct27": "1", "language": "ID", "primary_tag": "chat_other", "emerged": "new_on_or_after_sep11" }, { "family": "F12", "posts_sep12_oct27": "600", "kept_posts_sep12_oct27": "0", "posts_before_sep12": "0", "first_seen": "2026-09-28", "last_seen": "2026-10-12", "distinct_channels_sep12_oct27": "7", "language": "RU", "primary_tag": "chat_other", "emerged": "new_on_or_after_sep11" }, { "family": "F13", "posts_sep12_oct27": "429", "kept_posts_sep12_oct27": "0", "posts_before_sep12": "2", "first_seen": "2026-09-06", "last_seen": "2026-10-23", "distinct_channels_sep12_oct27": "6", "language": "EN", "primary_tag": "vps_cloud", "emerged": "existed_before" }, { "family": "F14", "posts_sep12_oct27": "398", "kept_posts_sep12_oct27": "0", "posts_before_sep12": "0", "first_seen": "2026-09-12", "last_seen": "2026-10-23", "distinct_channels_sep12_oct27": "22", "language": "TR", "primary_tag": "corporate_access", "emerged": "new_on_or_after_sep11" }, { "family": "F15", "posts_sep12_oct27": "354", "kept_posts_sep12_oct27": "28", "posts_before_sep12": "0", "first_seen": "2026-10-06", "last_seen": "2026-10-13", "distinct_channels_sep12_oct27": "1", "language": "EN", "primary_tag": "chat_other", "emerged": "new_on_or_after_sep11" } ] }, "f6_earlier_steps": { "april_burst_15_20_apr": { "daily": { "2026-04-15": 1022, "2026-04-16": 1697, "2026-04-17": 2351, "2026-04-18": 1639, "2026-04-19": 1704, "2026-04-20": 1221 }, "neighbours_11_14_apr": [ 20, 34, 27, 35 ], "neighbours_21_25_apr": [ 84, 102, 121, 118, 109 ], "multi_label_share": 0.669 }, "late_july_step_29_30_jul": { "mean_daily_1_24_jul": 262, "mean_daily_25jul_10aug": 517, "daily_28_30_jul": [ 241, 506, 695 ], "top5_channel_share_25jul_10aug": 0.433, "top5_family_share_25jul_10aug": 0.422 }, "note": "Not sampled separately; the label rose in steps before 12 September, and the 12 September step is the largest." }, "f7_established_channels": { "posts_per_day_before": 530, "posts_per_day_after": 1852, "channels_increased": 1569, "channels_decreased": 748, "top10_risers_share_of_gross_increase": 0.246, "top50_risers_share_of_gross_increase": 0.485, "reading": "The rise is broad across channels already seen before 11 September, not driven by a handful." }, "f9_doors_family_counted_once": { "n": 106, "edge_incl_firewall_fortinet_citrix": 48, "rdp_vpn_rdweb": 33, "rdp_vpn_rdweb_of_120": 33, "firewall_family_contact_linked_offers": 15, "firewall_offers_total": 23, "firewall_listings_with_contact": 14, "firewall_and_vpn_listing_with_contact": 1, "firewall_relays_repeating_template_without_contact": 4, "firewall_relays_note": "three to eight February; the other 5 firewall offers without the contact are different listings", "first_seller_post": "IA-C024", "category_definition": "The numerator 48 includes firewall, network device, Fortinet, Citrix, RDP, VPN and RDWeb; denominator 106 collapses the 15 contact-linked offers to one." }, "f10_reconciliation": { "random_sample_corporate_draws": 2, "of_kept_p1_draws": 110, "rate": 0.0182, "ci": [ 0.005, 0.0639 ], "implied_posts_point": 331, "implied_posts_band": [ 91, 1163 ], "search_records_before_12_sep": 138, "reading": "Consistent, but the band is too wide to validate the search recall." }, "f12_corporate_timing": { "first_seen_jan_may": 103, "first_seen_jun_oct": 17, "dropped_only_relay_offers_oct": 2, "reading": "In the candidate set built from cleaned posts no offer was first seen in September or October; two further October relay-format offers exist only among cleaning-dropped posts. The magnitude argument is stronger: 120 offers in ten months against a rise of about 1,760 posts a day." }, "coder_note": "Every hand classification was done by an AI coder against a written codebook. The blind second rater is a separate AI pass; agreement shows consistency, not human validation. Field-level coding had only a limited second check: on the 10 offers both passes called corporate, privilege matched in 4 (strict); packaging terms had no second rater." }, "caveats": [ "Counts are Blackhole-collected posts, Telegram-dominated, with limited forum coverage. They are not offers, sellers, victims, accesses or incidents.", "The label is a classifier output. In an AI-coded sample only 38.2% of January–August posts and 4.9% of 12 September–27 October posts were access offers; for 1 August–11 September the figure is 54.5%, but about three quarters of those offer posts are one repeated bot ad.", "No claim is made about dark web growth or decline, or about the access-selling market size. The 12 September step is a step in labelled posts, not evidence of more access sales.", "No trend is claimed across the May–July classifier taxonomy break. The January–August period straddles it, so the before and after offer comparison is a level comparison, not a trend. Corporate Jan–May versus Jun–Oct is a collection-path observation, not a market trend.", "The cross-label comparison reports ratios and absolute change per day; neither platform growth nor label reassignment is demonstrated.", "Every hand classification was done by an AI coder against a written codebook; the blind second rater (90 sample posts, 40 corporate candidates) is a separate AI pass. Agreement shows consistency, not human validation. Field-level coding had only a limited second check: on the 10 offers both passes called corporate, privilege matched in 4 (strict); packaging terms had no second rater. P2 has only 13 offer draws, so subtype percentages are not published.", "Cleaning rules were designed on January–June data; near-duplicate spam that differs only by invisible characters passes exact-text de-duplication, so cleaned counts are not offer counts.", "The foundation corporate-access regex was correct in 1 of 39 sampled hits; its shares are not used.", "The corporate catalogue (120 offers) is a lower bound with unknown pattern recall; revenue, sector, EDR and privilege are unverified seller claims; counts are offers, not sellers.", "Prices remain separate dated asking or bidding terms with their stated units and periods. The legacy USD code combines explicit USD and bare \"$\" with an unstated denomination. No common denomination and unit cohort is established, so this edition publishes no cross-advertisement price median, rank, ratio, range or inferred price relationship. Same-advertisement arithmetic remains attached to that advertisement.", "The increment decomposition uses rough bands and shares of posts, not of distinct messages.", "Channel concentration is given as shares only; channel names and handles are never published.", "October is partial (1–27 October). 21 September and 24 October are low days, possibly ingestion gaps." ], "findings": [ { "id": "W1", "title": "Volume under the label", "text": "Blackhole carries 166,612 posts labelled Initial Access Selling between 1 January and 27 October 2026 (exact API totals by post time). Monthly: Jan 5,098; Feb 5,105; Mar 3,575; Apr 12,940; May 2,760; Jun 5,892; Jul 9,199; Aug 17,457; Sep 46,920; Oct (1–27) 57,666.", "limit": "Posts, not offers. Telegram-dominated collection. May–July classifier taxonomy break: no trend claim across it." }, { "id": "W2", "title": "A step on 12 September", "text": "Daily labelled posts were 361 on 10 September, 673 on 11 September and 2,011 on 12 September. The mean rose from 530 a day (1 Aug–10 Sep) to 2,290 a day (12 Sep–23 Oct), 4.3 times.", "limit": "A step in labelled posts, not in access sales. Earlier, smaller steps exist (15–20 April burst, 29–30 July)." }, { "id": "W3", "title": "The label surge does not establish an offer surge", "text": "In an AI-coded sample, 38.2% of posts (95% interval 28.1–49.5) were access offers from January to August, against 4.9% (2.0–11.4) from 12 September to 27 October. Counting each ad once (cleaning-kept posts), offer posts per day were about 24 (16–34) from 1 August to 11 September, 30 (24–37) from January to August and 38 (22–65) from 12 September to 27 October: no detectable change. Counting every copy, 1 August–11 September is about 291 a day (223–355), roughly three quarters of it one repeated shell/cPanel bot ad.", "limit": "AI coder, sample of 350 draws plus 110 for 1 Aug–11 Sep; January–August straddles the May–July taxonomy break (level comparison only); approximate intervals." }, { "id": "W4", "title": "Where the extra 1,760 posts a day came from", "text": "Of the rise from 530 to 2,290 posts a day, consumer account selling accounts for about +809 (46%), carding, mule and SIM buying +380 (22%), repeated spam +256 (15%) and VPN or proxy config sharing +143 (8%). Access offers fall by about 176 a day (band −302 to −50), driven by the decline of one bot ad.", "limit": "Rough bands; shares of posts, not of distinct messages." }, { "id": "W5", "title": "Not platform-wide growth", "text": "Mean daily posts 12–30 September over 25 August–10 September: Initial Access 4.67 (473 to 2,209 a day); Phishing 1.92; Carding 1.74; Combolist 1.13; Data Leak 0.52; Malicious Software 0.51; Botnet Log 0.33; whole-corpus one-minute proxy 0.88.", "limit": "Neither platform growth nor label reassignment is demonstrated." }, { "id": "W6", "title": "Broad, not concentrated", "text": "The top five channels held 42.1% of labelled posts before the step (1 Aug–10 Sep) and 12.7% after (12 Sep–23 Oct). Distinct message families rose from about 292 to 1,318 a day: the step is breadth, not repetition. Channels already seen before 11 September went from 530 to about 1,852 posts a day; 1,569 of them rose and 748 fell.", "limit": "Shares only; no channel names." }, { "id": "W7", "title": "Corporate network access offers", "text": "120 unique corporate network access offers were found by a targeted full-text read of 469 candidate texts. 59 (49%) claim admin, root or system rights; 76 (63%) state a revenue claim; 67 (56%) carry a fixed price. 15 offers carry one contact identifier and template (14 of the 23 firewall listings plus 1 firewall-and-VPN listing).", "limit": "Lower bound; seller claims unverified; never a market price." }, { "id": "W8", "title": "Commodity access is sold by unit, lot, plan and month", "text": "In a priced-post sample of 139 commodity offers, 41 describe spec tiers, 24 a warranty or replacement window, 21 are itemised lists and 13 accept escrow. Dated asking terms remain separate catalogue records; units and packaging terms are counted without pooling prices.", "limit": "Advertised prices in a sampled, unevenly stratified set; not market prices." }, { "id": "W9", "title": "A regex warning", "text": "The foundation corporate-access regex was correct in 1 of 39 sampled hits; the earlier \"corporate about 5%\" and 10–16% regex shares are not supported. Corporate network offers were 2 of 79 offer draws in the random sample.", "limit": "Do not reuse regex-derived subtype shares." }, { "id": "W10", "title": "Cleaning correction", "text": "The foundation estimated 15,059 cleaned posts for September and 16,479 for October from 400–500 post samples. With full data the same rules give 11,699 and 9,920. April (4,070 to 3,047) was also re-pulled.", "limit": "Cleaned posts are not offers." } ], "ai_disclosure": "Why AI agents. Brandefense Blackhole, our cybercrime database, collects around 17 to 23 million dark web and Telegram posts a month. Reading that volume by hand, and linking a recruitment ad on one forum to a leak-site claim on another and a price list in a Telegram channel weeks later, is beyond what a human team can do alone. Claude Opus 5.5 prepared the research: it searched the data, sorted and translated posts and drafted the text. Codex Astra then checked every number against the dataset files and tested each claim, and anything that did not hold was removed. Brandefense analysts reviewed and approved the findings.", "license": "CC BY 4.0 for original aggregates, charts and editorial paraphrases; raw source content is excluded.", "attribution": "Source: Brandefense Research Team, Initial Access Offers, 2026, v1.0. Data: Brandefense Blackhole, posts labelled Initial Access Selling, 1 Jan–27 Oct 2026. Observed posts, not market totals.", "assets": { "charts": [ { "id": "chart-daily-step", "title": "Exact daily labelled posts and the 12 September step", "alt": "Bar chart of exact daily posts labelled Initial Access Selling, 1 January to 27 October 2026. Counts sit near a few hundred a day until 10 September (361), rise to 673 on 11 September and 2,011 on 12 September, then average about 2,290 a day.", "svg": "chart-daily-step.svg", "png": "chart-daily-step.png" }, { "id": "chart-offer-share", "title": "Raw posts rose 4.3 times; de-duplicated access offers per day did not rise detectably", "alt": "Interval chart of access offer posts per day among cleaning-kept posts from an AI-coded sample: about 24 (16 to 34) from 1 August to 11 September, 30 (24 to 37) from January to August and 38 (22 to 65) from 12 September to 27 October. These bands are descriptive; the joint ratio of the de-duplicated figures is about 1.6 (approximate 95% range 0.8 to 3.1). Counting every copy, the 1 August to 11 September figure is about 291 a day, dominated by one repeated bot ad.", "svg": "chart-offer-share.svg", "png": "chart-offer-share.png" }, { "id": "chart-cross-label", "title": "Other labels moved both ways around 12 September", "alt": "Horizontal bars of the ratio of mean daily posts 12 to 30 September over 25 August to 10 September, with absolute change: Initial Access 4.67 (473 to 2,209 a day), Phishing 1.92 (plus 4,197), Carding 1.74, Combolist 1.13, whole-corpus proxy 0.88, Data Leak 0.52 (minus 2,083), Malicious Software 0.51, Botnet Log 0.33.", "svg": "chart-cross-label.svg", "png": "chart-cross-label.png" }, { "id": "chart-corporate-anatomy", "title": "What 120 corporate network access offers describe", "alt": "Bar charts of claimed privilege level (59 admin, root or system; 24 user level; 17 domain admin; 17 unstated; 3 mixed) and access method (firewall or network device 23, web application or database 17, RDP 12, VPN 12 and others) across 120 offers.", "svg": "chart-corporate-anatomy.svg", "png": "chart-corporate-anatomy.png" }, { "id": "chart-packaging", "title": "How commodity access is packaged", "alt": "Bar charts of pricing unit (per piece 69, no unit 14, per bulk lot 14, per plan 13, per month 10 and others) and packaging terms (spec tiers 41, warranty or replacement window 24, itemised list 21, country choice 18, escrow 13 and others) across 139 commodity offers.", "svg": "chart-packaging.svg", "png": "chart-packaging.png" }, { "id": "chart-increment-decomposition", "title": "Where the extra 1,760 posts a day came from", "alt": "Horizontal bars of the change in posts a day by content category between samples of 1 August to 11 September and 12 September to 27 October, scaled to mean daily posts of 530 (1 August to 10 September) and 2,290 (12 September to 23 October): consumer account selling plus 809, carding and mule trade plus 380, repeated spam plus 256, config sharing plus 143, chat plus 121, unclear plus 121, access offers minus 176, buyer requests minus 38. Bands are rough.", "svg": "chart-increment-decomposition.svg", "png": "chart-increment-decomposition.png" } ], "social": [ "social-cover.png", "social-spike.png", "social-corporate.png", "social-packaging.png" ], "tables": [ "monthly.csv", "daily-totals.csv", "cross-label-daily.csv", "sample-composition.csv", "retrieval-windows.csv", "counting-units.csv", "offers-per-day.csv", "increment-decomposition.csv", "family-first-seen.csv" ], "catalogue": [ "offer-catalog.html", "offer-catalog.csv", "offer-catalog.json" ], "documents": [ "methodology.html", "data-dictionary.html", "license.html", "press-kit.html" ] } }