{ "version": "1.0", "built_date": "2026-10-30", "chapter_key": "stolen-credentials", "title": "Stolen Accounts, Botnet Logs & Combolists", "creator": "Brandefense Research Team", "source": "Brandefense Blackhole", "period": { "start": "2026-01-01", "end": "2026-10-27", "label": "1 January-27 October 2026", "date_field": "post time (the post creation timestamp)", "partial_month": "2026-10", "window_rule": "Query windows of at most 7 days, never across a month boundary." }, "headline": { "cleaned_est": { "c_combolist": 115032, "c_botnet_log": 66979, "k_combolist": 7964, "c_search_breach_bots": 96946 }, "raw_total": { "c_combolist": 622249, "c_botnet_log": 1051851, "k_combolist": 21302, "c_search_breach_bots": 1129059 }, "kept_pct_of_raw": { "c_combolist": 18.5, "c_botnet_log": 6.4, "k_combolist": 37.4, "c_search_breach_bots": 8.6 }, "definition": "Cleaned post estimate: collected posts per label after removing noise, template bots, mirrors, off-topic text and duplicates, Jan-27 Oct 2026, sum of monthly estimates. Not offers, sellers or a market total. The Combolist and Botnet Log samples overlap by 0.8%; sets are not added together.", "caveat": "Sampling bands per month in observed-records.csv; class labels changed in May-July." }, "sets": [ { "set_id": "c_combolist", "label": "Combolist (email / username - passwords)", "kind": "class label", "short_label": "Combolist class", "raw_total": 622249, "cleaned_est": 115032, "kept_pct_of_raw": 18.5, "sample_posts_fetched": 14867, "sample_posts_kept": 3776, "windows": 48, "windows_complete": 0, "windows_sampled": 48, "forum_share_kept_min_pct": 7.1, "forum_share_kept_max_pct": 23.8, "estimate_note": "Sum of monthly cleaned estimates. Monthly bands are 95% cluster-bootstrap sampling bands; no period band is formed by adding band ends." }, { "set_id": "c_botnet_log", "label": "Botnet Log", "kind": "class label", "short_label": "Botnet Log class", "raw_total": 1051851, "cleaned_est": 66979, "kept_pct_of_raw": 6.4, "sample_posts_fetched": 14832, "sample_posts_kept": 1888, "windows": 48, "windows_complete": 0, "windows_sampled": 48, "forum_share_kept_min_pct": 0.0, "forum_share_kept_max_pct": 9.2, "estimate_note": "Sum of monthly cleaned estimates. Monthly bands are 95% cluster-bootstrap sampling bands; no period band is formed by adding band ends." }, { "set_id": "k_combolist", "label": "\"combolist\" keyword", "kind": "keyword query", "short_label": "Combolist keyword", "raw_total": 21302, "cleaned_est": 7964, "kept_pct_of_raw": 37.4, "sample_posts_fetched": 9141, "sample_posts_kept": 2810, "windows": 48, "windows_complete": 26, "windows_sampled": 22, "forum_share_kept_min_pct": 38.3, "forum_share_kept_max_pct": 82.9, "estimate_note": "Sum of monthly cleaned estimates. Monthly bands are 95% cluster-bootstrap sampling bands; no period band is formed by adding band ends." }, { "set_id": "c_search_breach_bots", "label": "Search via Breach Bots", "kind": "class label", "short_label": "Breach-bot class", "raw_total": 1129059, "cleaned_est": 96946, "kept_pct_of_raw": 8.6, "sample_posts_fetched": 4736, "sample_posts_kept": 859, "windows": 48, "windows_complete": 0, "windows_sampled": 48, "forum_share_kept_min_pct": 0.0, "forum_share_kept_max_pct": 4.6, "estimate_note": "Sum of monthly cleaned estimates. Monthly bands are 95% cluster-bootstrap sampling bands; no period band is formed by adding band ends." } ], "monthly": [ { "set_id": "c_combolist", "month": "2026-01", "source": "new_pull", "windows": 5, "raw_total": 45684, "n_fetched": 1990, "kept_n": 798, "kept_share_weighted_pct": 39.9, "cleaned_est": 18206, "band_low": 16955, "band_high": 19596, "naive_pooled_low": 17345, "naive_pooled_high": 19311, "kept_share_unweighted_pct": 40.1, "forum_share_kept_pct": 21.2, "class_label_break_window": false, "partial_month": false }, { "set_id": "c_combolist", "month": "2026-02", "source": "new_pull", "windows": 4, "raw_total": 163728, "n_fetched": 1600, "kept_n": 162, "kept_share_weighted_pct": 10.1, "cleaned_est": 16560, "band_low": 13844, "band_high": 19207, "naive_pooled_low": 14312, "naive_pooled_high": 19156, "kept_share_unweighted_pct": 10.1, "forum_share_kept_pct": 21.2, "class_label_break_window": false, "partial_month": false }, { "set_id": "c_combolist", "month": "2026-03", "source": "new_pull", "windows": 5, "raw_total": 121190, "n_fetched": 2000, "kept_n": 276, "kept_share_weighted_pct": 13.6, "cleaned_est": 16520, "band_low": 14491, "band_high": 18245, "naive_pooled_low": 14976, "naive_pooled_high": 18640, "kept_share_unweighted_pct": 13.8, "forum_share_kept_pct": 16.1, "class_label_break_window": false, "partial_month": false }, { "set_id": "c_combolist", "month": "2026-04", "source": "new_pull", "windows": 5, "raw_total": 91728, "n_fetched": 2000, "kept_n": 397, "kept_share_weighted_pct": 16.4, "cleaned_est": 15022, "band_low": 12637, "band_high": 17301, "naive_pooled_low": 16658, "naive_pooled_high": 19864, "kept_share_unweighted_pct": 19.9, "forum_share_kept_pct": 19.4, "class_label_break_window": false, "partial_month": false }, { "set_id": "c_combolist", "month": "2026-05", "source": "new_pull", "windows": 5, "raw_total": 67782, "n_fetched": 1365, "kept_n": 242, "kept_share_weighted_pct": 15.6, "cleaned_est": 10562, "band_low": 9093, "band_high": 12166, "naive_pooled_low": 10706, "naive_pooled_high": 13451, "kept_share_unweighted_pct": 17.7, "forum_share_kept_pct": 7.1, "class_label_break_window": true, "partial_month": false }, { "set_id": "c_combolist", "month": "2026-06", "source": "new_pull", "windows": 5, "raw_total": 45399, "n_fetched": 1250, "kept_n": 385, "kept_share_weighted_pct": 22.3, "cleaned_est": 10122, "band_low": 7883, "band_high": 12445, "naive_pooled_low": 12849, "naive_pooled_high": 15170, "kept_share_unweighted_pct": 30.8, "forum_share_kept_pct": 12.8, "class_label_break_window": true, "partial_month": false }, { "set_id": "c_combolist", "month": "2026-07", "source": "new_pull", "windows": 5, "raw_total": 19716, "n_fetched": 1208, "kept_n": 460, "kept_share_weighted_pct": 38.4, "cleaned_est": 7567, "band_low": 6180, "band_high": 8658, "naive_pooled_low": 6976, "naive_pooled_high": 8054, "kept_share_unweighted_pct": 38.1, "forum_share_kept_pct": 7.4, "class_label_break_window": true, "partial_month": false }, { "set_id": "c_combolist", "month": "2026-08", "source": "new_pull", "windows": 5, "raw_total": 24691, "n_fetched": 1244, "kept_n": 427, "kept_share_weighted_pct": 34.4, "cleaned_est": 8501, "band_low": 7581, "band_high": 9368, "naive_pooled_low": 7836, "naive_pooled_high": 9138, "kept_share_unweighted_pct": 34.3, "forum_share_kept_pct": 18.1, "class_label_break_window": false, "partial_month": false }, { "set_id": "c_combolist", "month": "2026-09", "source": "new_pull", "windows": 5, "raw_total": 21872, "n_fetched": 1250, "kept_n": 350, "kept_share_weighted_pct": 29.8, "cleaned_est": 6519, "band_low": 5925, "band_high": 7121, "naive_pooled_low": 5595, "naive_pooled_high": 6683, "kept_share_unweighted_pct": 28.0, "forum_share_kept_pct": 15.5, "class_label_break_window": false, "partial_month": false }, { "set_id": "c_combolist", "month": "2026-10", "source": "new_pull", "windows": 4, "raw_total": 20459, "n_fetched": 960, "kept_n": 279, "kept_share_weighted_pct": 26.7, "cleaned_est": 5453, "band_low": 4365, "band_high": 6452, "naive_pooled_low": 5376, "naive_pooled_high": 6550, "kept_share_unweighted_pct": 29.1, "forum_share_kept_pct": 23.8, "class_label_break_window": false, "partial_month": true }, { "set_id": "c_botnet_log", "month": "2026-01", "source": "new_pull", "windows": 5, "raw_total": 98539, "n_fetched": 1954, "kept_n": 246, "kept_share_weighted_pct": 5.4, "cleaned_est": 5322, "band_low": 4398, "band_high": 6458, "naive_pooled_low": 11028, "naive_pooled_high": 13928, "kept_share_unweighted_pct": 12.6, "forum_share_kept_pct": 9.2, "class_label_break_window": false, "partial_month": false }, { "set_id": "c_botnet_log", "month": "2026-02", "source": "new_pull", "windows": 4, "raw_total": 219859, "n_fetched": 1600, "kept_n": 66, "kept_share_weighted_pct": 4.0, "cleaned_est": 8736, "band_low": 6628, "band_high": 11434, "naive_pooled_low": 7157, "naive_pooled_high": 11464, "kept_share_unweighted_pct": 4.1, "forum_share_kept_pct": 8.9, "class_label_break_window": false, "partial_month": false }, { "set_id": "c_botnet_log", "month": "2026-03", "source": "new_pull", "windows": 5, "raw_total": 283989, "n_fetched": 2000, "kept_n": 48, "kept_share_weighted_pct": 2.4, "cleaned_est": 6863, "band_low": 5235, "band_high": 8538, "naive_pooled_low": 5154, "naive_pooled_high": 8996, "kept_share_unweighted_pct": 2.4, "forum_share_kept_pct": 7.0, "class_label_break_window": false, "partial_month": false }, { "set_id": "c_botnet_log", "month": "2026-04", "source": "new_pull", "windows": 5, "raw_total": 132304, "n_fetched": 1983, "kept_n": 153, "kept_share_weighted_pct": 6.8, "cleaned_est": 8967, "band_low": 7056, "band_high": 10955, "naive_pooled_low": 8760, "naive_pooled_high": 11872, "kept_share_unweighted_pct": 7.7, "forum_share_kept_pct": 0.0, "class_label_break_window": false, "partial_month": false }, { "set_id": "c_botnet_log", "month": "2026-05", "source": "new_pull", "windows": 5, "raw_total": 88924, "n_fetched": 1368, "kept_n": 86, "kept_share_weighted_pct": 5.4, "cleaned_est": 4796, "band_low": 3299, "band_high": 6473, "naive_pooled_low": 4552, "naive_pooled_high": 6846, "kept_share_unweighted_pct": 6.3, "forum_share_kept_pct": 0.0, "class_label_break_window": true, "partial_month": false }, { "set_id": "c_botnet_log", "month": "2026-06", "source": "new_pull", "windows": 5, "raw_total": 73480, "n_fetched": 1249, "kept_n": 162, "kept_share_weighted_pct": 8.4, "cleaned_est": 6147, "band_low": 4148, "band_high": 8322, "naive_pooled_low": 8244, "naive_pooled_high": 10984, "kept_share_unweighted_pct": 13.0, "forum_share_kept_pct": 0.9, "class_label_break_window": true, "partial_month": false }, { "set_id": "c_botnet_log", "month": "2026-07", "source": "new_pull", "windows": 5, "raw_total": 57375, "n_fetched": 1213, "kept_n": 158, "kept_share_weighted_pct": 12.4, "cleaned_est": 7128, "band_low": 5778, "band_high": 8425, "naive_pooled_low": 6453, "naive_pooled_high": 8628, "kept_share_unweighted_pct": 13.0, "forum_share_kept_pct": 1.7, "class_label_break_window": true, "partial_month": false }, { "set_id": "c_botnet_log", "month": "2026-08", "source": "new_pull", "windows": 5, "raw_total": 62246, "n_fetched": 1250, "kept_n": 159, "kept_share_weighted_pct": 12.5, "cleaned_est": 7770, "band_low": 6671, "band_high": 8980, "naive_pooled_low": 6839, "naive_pooled_high": 9139, "kept_share_unweighted_pct": 12.7, "forum_share_kept_pct": 0.0, "class_label_break_window": false, "partial_month": false }, { "set_id": "c_botnet_log", "month": "2026-09", "source": "new_pull", "windows": 5, "raw_total": 23020, "n_fetched": 1250, "kept_n": 416, "kept_share_weighted_pct": 26.9, "cleaned_est": 6196, "band_low": 5124, "band_high": 7352, "naive_pooled_low": 7072, "naive_pooled_high": 8273, "kept_share_unweighted_pct": 33.3, "forum_share_kept_pct": 2.3, "class_label_break_window": false, "partial_month": false }, { "set_id": "c_botnet_log", "month": "2026-10", "source": "new_pull", "windows": 4, "raw_total": 12115, "n_fetched": 965, "kept_n": 394, "kept_share_weighted_pct": 41.7, "cleaned_est": 5054, "band_low": 4714, "band_high": 5470, "naive_pooled_low": 4576, "naive_pooled_high": 5326, "kept_share_unweighted_pct": 40.8, "forum_share_kept_pct": 2.5, "class_label_break_window": false, "partial_month": true }, { "set_id": "k_combolist", "month": "2026-01", "source": "foundation_raw", "windows": 5, "raw_total": 3291, "n_fetched": 614, "kept_n": 368, "kept_share_weighted_pct": 61.6, "cleaned_est": 2026, "band_low": 1965, "band_high": 2087, "naive_pooled_low": 1843, "naive_pooled_high": 2098, "kept_share_unweighted_pct": 59.9, "forum_share_kept_pct": 81.3, "class_label_break_window": false, "partial_month": false }, { "set_id": "k_combolist", "month": "2026-02", "source": "foundation_raw", "windows": 4, "raw_total": 3367, "n_fetched": 400, "kept_n": 203, "kept_share_weighted_pct": 50.9, "cleaned_est": 1712, "band_low": 1510, "band_high": 1915, "naive_pooled_low": 1544, "naive_pooled_high": 1873, "kept_share_unweighted_pct": 50.7, "forum_share_kept_pct": 82.9, "class_label_break_window": false, "partial_month": false }, { "set_id": "k_combolist", "month": "2026-03", "source": "foundation_raw", "windows": 5, "raw_total": 2585, "n_fetched": 605, "kept_n": 285, "kept_share_weighted_pct": 49.5, "cleaned_est": 1281, "band_low": 1147, "band_high": 1411, "naive_pooled_low": 1116, "naive_pooled_high": 1321, "kept_share_unweighted_pct": 47.1, "forum_share_kept_pct": 78.1, "class_label_break_window": false, "partial_month": false }, { "set_id": "k_combolist", "month": "2026-04", "source": "foundation_raw", "windows": 5, "raw_total": 1842, "n_fetched": 1011, "kept_n": 500, "kept_share_weighted_pct": 51.0, "cleaned_est": 939, "band_low": 878, "band_high": 1001, "naive_pooled_low": 854, "naive_pooled_high": 968, "kept_share_unweighted_pct": 49.5, "forum_share_kept_pct": 79.3, "class_label_break_window": false, "partial_month": false }, { "set_id": "k_combolist", "month": "2026-05", "source": "foundation_raw", "windows": 5, "raw_total": 1274, "n_fetched": 1274, "kept_n": 362, "kept_share_weighted_pct": 28.4, "cleaned_est": 362, "band_low": 362, "band_high": 362, "naive_pooled_low": 331, "naive_pooled_high": 394, "kept_share_unweighted_pct": 28.4, "forum_share_kept_pct": 59.7, "class_label_break_window": false, "partial_month": false }, { "set_id": "k_combolist", "month": "2026-06", "source": "foundation_raw", "windows": 5, "raw_total": 1980, "n_fetched": 977, "kept_n": 190, "kept_share_weighted_pct": 13.1, "cleaned_est": 259, "band_low": 252, "band_high": 266, "naive_pooled_low": 338, "naive_pooled_high": 437, "kept_share_unweighted_pct": 19.4, "forum_share_kept_pct": 45.2, "class_label_break_window": false, "partial_month": false }, { "set_id": "k_combolist", "month": "2026-07", "source": "foundation_raw", "windows": 5, "raw_total": 1404, "n_fetched": 1404, "kept_n": 316, "kept_share_weighted_pct": 22.5, "cleaned_est": 316, "band_low": 316, "band_high": 316, "naive_pooled_low": 286, "naive_pooled_high": 348, "kept_share_unweighted_pct": 22.5, "forum_share_kept_pct": 38.3, "class_label_break_window": false, "partial_month": false }, { "set_id": "k_combolist", "month": "2026-08", "source": "foundation_raw", "windows": 5, "raw_total": 1513, "n_fetched": 1513, "kept_n": 283, "kept_share_weighted_pct": 18.7, "cleaned_est": 283, "band_low": 283, "band_high": 283, "naive_pooled_low": 254, "naive_pooled_high": 314, "kept_share_unweighted_pct": 18.7, "forum_share_kept_pct": 50.2, "class_label_break_window": false, "partial_month": false }, { "set_id": "k_combolist", "month": "2026-09", "source": "foundation_raw", "windows": 5, "raw_total": 1870, "n_fetched": 758, "kept_n": 197, "kept_share_weighted_pct": 22.0, "cleaned_est": 412, "band_low": 378, "band_high": 446, "naive_pooled_low": 430, "naive_pooled_high": 547, "kept_share_unweighted_pct": 26.0, "forum_share_kept_pct": 80.1, "class_label_break_window": false, "partial_month": false }, { "set_id": "k_combolist", "month": "2026-10", "source": "foundation_raw", "windows": 4, "raw_total": 2176, "n_fetched": 585, "kept_n": 106, "kept_share_weighted_pct": 17.2, "cleaned_est": 374, "band_low": 295, "band_high": 453, "naive_pooled_low": 331, "naive_pooled_high": 467, "kept_share_unweighted_pct": 18.1, "forum_share_kept_pct": 79.0, "class_label_break_window": false, "partial_month": true }, { "set_id": "c_search_breach_bots", "month": "2026-01", "source": "foundation_raw", "windows": 5, "raw_total": 155319, "n_fetched": 500, "kept_n": 54, "kept_share_weighted_pct": 9.0, "cleaned_est": 14038, "band_low": 7896, "band_high": 20547, "naive_pooled_low": 13004, "naive_pooled_high": 21474, "kept_share_unweighted_pct": 10.8, "forum_share_kept_pct": 0.7, "class_label_break_window": false, "partial_month": false }, { "set_id": "c_search_breach_bots", "month": "2026-02", "source": "foundation_raw", "windows": 4, "raw_total": 305214, "n_fetched": 400, "kept_n": 9, "kept_share_weighted_pct": 2.3, "cleaned_est": 6878, "band_low": 2250, "band_high": 11506, "naive_pooled_low": 3626, "naive_pooled_high": 12881, "kept_share_unweighted_pct": 2.2, "forum_share_kept_pct": 0.0, "class_label_break_window": false, "partial_month": false }, { "set_id": "c_search_breach_bots", "month": "2026-03", "source": "foundation_raw", "windows": 5, "raw_total": 311700, "n_fetched": 500, "kept_n": 31, "kept_share_weighted_pct": 7.6, "cleaned_est": 23771, "band_low": 3511, "band_high": 44030, "naive_pooled_low": 13721, "naive_pooled_high": 27012, "kept_share_unweighted_pct": 6.2, "forum_share_kept_pct": 0.0, "class_label_break_window": false, "partial_month": false }, { "set_id": "c_search_breach_bots", "month": "2026-04", "source": "foundation_raw", "windows": 5, "raw_total": 143918, "n_fetched": 467, "kept_n": 38, "kept_share_weighted_pct": 2.7, "cleaned_est": 3894, "band_low": 2171, "band_high": 5584, "naive_pooled_low": 8614, "naive_pooled_high": 15790, "kept_share_unweighted_pct": 8.1, "forum_share_kept_pct": 4.6, "class_label_break_window": false, "partial_month": false }, { "set_id": "c_search_breach_bots", "month": "2026-05", "source": "foundation_raw", "windows": 5, "raw_total": 23982, "n_fetched": 500, "kept_n": 124, "kept_share_weighted_pct": 24.3, "cleaned_est": 5823, "band_low": 5175, "band_high": 6500, "naive_pooled_low": 5088, "naive_pooled_high": 6899, "kept_share_unweighted_pct": 24.8, "forum_share_kept_pct": 0.0, "class_label_break_window": true, "partial_month": false }, { "set_id": "c_search_breach_bots", "month": "2026-06", "source": "foundation_raw", "windows": 5, "raw_total": 27255, "n_fetched": 500, "kept_n": 121, "kept_share_weighted_pct": 23.2, "cleaned_est": 6318, "band_low": 4649, "band_high": 8004, "naive_pooled_low": 5629, "naive_pooled_high": 7670, "kept_share_unweighted_pct": 24.2, "forum_share_kept_pct": 0.0, "class_label_break_window": true, "partial_month": false }, { "set_id": "c_search_breach_bots", "month": "2026-07", "source": "foundation_raw", "windows": 5, "raw_total": 16732, "n_fetched": 469, "kept_n": 161, "kept_share_weighted_pct": 32.9, "cleaned_est": 5505, "band_low": 4134, "band_high": 6302, "naive_pooled_low": 5049, "naive_pooled_high": 6482, "kept_share_unweighted_pct": 34.3, "forum_share_kept_pct": 0.0, "class_label_break_window": true, "partial_month": false }, { "set_id": "c_search_breach_bots", "month": "2026-08", "source": "foundation_raw", "windows": 5, "raw_total": 20185, "n_fetched": 500, "kept_n": 159, "kept_share_weighted_pct": 33.0, "cleaned_est": 6668, "band_low": 5520, "band_high": 7855, "naive_pooled_low": 5626, "naive_pooled_high": 7268, "kept_share_unweighted_pct": 31.8, "forum_share_kept_pct": 0.0, "class_label_break_window": false, "partial_month": false }, { "set_id": "c_search_breach_bots", "month": "2026-09", "source": "foundation_raw", "windows": 5, "raw_total": 46001, "n_fetched": 500, "kept_n": 63, "kept_share_weighted_pct": 11.4, "cleaned_est": 5253, "band_low": 4010, "band_high": 6496, "naive_pooled_low": 4588, "naive_pooled_high": 7267, "kept_share_unweighted_pct": 12.6, "forum_share_kept_pct": 0.0, "class_label_break_window": false, "partial_month": false }, { "set_id": "c_search_breach_bots", "month": "2026-10", "source": "foundation_raw", "windows": 4, "raw_total": 78753, "n_fetched": 400, "kept_n": 99, "kept_share_weighted_pct": 23.9, "cleaned_est": 18798, "band_low": 10983, "band_high": 26612, "naive_pooled_low": 16360, "naive_pooled_high": 23001, "kept_share_unweighted_pct": 24.7, "forum_share_kept_pct": 0.0, "class_label_break_window": false, "partial_month": true } ], "raw_to_kept": { "c_combolist": { "raw_total": 622249, "off_topic_pct": 56.9, "template_bot_pct": 11.9, "short_text_pct": 11.8, "dup_pct": 0.6, "mirror_pct": 0.3, "noise_pct": 0.0, "kept_pct": 18.5 }, "c_botnet_log": { "raw_total": 1051851, "off_topic_pct": 61.3, "template_bot_pct": 26.3, "short_text_pct": 4.9, "dup_pct": 0.2, "mirror_pct": 1.0, "noise_pct": 0.0, "kept_pct": 6.4 }, "k_combolist": { "raw_total": 21302, "off_topic_pct": 0.0, "template_bot_pct": 59.0, "short_text_pct": 0.0, "dup_pct": 1.7, "mirror_pct": 0.2, "noise_pct": 1.8, "kept_pct": 37.4 }, "c_search_breach_bots": { "raw_total": 1129059, "off_topic_pct": 18.3, "template_bot_pct": 65.7, "short_text_pct": 4.5, "dup_pct": 2.3, "mirror_pct": 0.5, "noise_pct": 0.0, "kept_pct": 8.6 } }, "raw_vs_cleaned": { "c_combolist": { "raw_peak_month": "2026-02", "raw_peak": 163728, "raw_last_month": "2026-10", "raw_last": 20459, "raw_change_peak_to_last_pct": -88.0, "cleaned_monthly_min": 5453, "cleaned_monthly_max": 18206 }, "c_botnet_log": { "raw_peak_month": "2026-03", "raw_peak": 283989, "raw_last_month": "2026-10", "raw_last": 12115, "raw_change_peak_to_last_pct": -96.0, "cleaned_monthly_min": 4796, "cleaned_monthly_max": 8967 }, "note": "Descriptive of retrieved label counts only. The span crosses the May-July class-label change, so it is not a trend of the activity. For Botnet Log the raw fall comes from automated high-volume posting removed by cleaning; cleaned monthly estimates stayed within one range. This does not show stable supply. No cross-May-July class trend is claimed." }, "composition": { "method": "Hand labels of a seeded probability-proportional-to-weight sample of kept posts, strata set x quarter, read blind to the classifier. Intervals: stratified bootstrap, 1,000 draws, percentile 95%.", "n_total": 240, "sets": { "c_botnet_log": { "n_labelled": 160, "weighted_population_posts": 66862.0, "classes": [ { "category": "bank_account_listings_and_requests", "label": "Bank-account listings and requests", "share_pct": 23.8, "low_pct": 17.1, "high_pct": 31.1, "n_labelled": 36 }, { "category": "game_account_lots", "label": "Game-account lots", "share_pct": 21.3, "low_pct": 15.1, "high_pct": 28.0, "n_labelled": 30 }, { "category": "buy_side_account_or_cookie_submissions", "label": "Buy-side account or cookie submissions", "share_pct": 17.0, "low_pct": 11.1, "high_pct": 23.0, "n_labelled": 34 }, { "category": "not_an_offer", "label": "Not an offer (replies, chatter, notices)", "share_pct": 11.3, "low_pct": 6.6, "high_pct": 16.7, "n_labelled": 17 }, { "category": "stealer_log_clouds_strict", "label": "Stealer-log clouds for sale or access (strict)", "share_pct": 6.3, "low_pct": 2.6, "high_pct": 10.4, "n_labelled": 9 }, { "category": "tools_bots_and_services", "label": "Tools, bots and service menus", "share_pct": 4.8, "low_pct": 1.5, "high_pct": 8.9, "n_labelled": 7 }, { "category": "credential_files_and_pointers", "label": "Credential files, samples and pointers", "share_pct": 4.6, "low_pct": 1.4, "high_pct": 8.4, "n_labelled": 9 }, { "category": "other_accounts_and_cookies_for_sale", "label": "Other accounts and cookies for sale", "share_pct": 4.4, "low_pct": 1.4, "high_pct": 8.4, "n_labelled": 8 }, { "category": "unspecified_log_posts", "label": "\"Log\" posts with no identifiable product", "share_pct": 3.1, "low_pct": 0.7, "high_pct": 6.2, "n_labelled": 4 }, { "category": "wanted_requests_for_logs_or_files", "label": "Wanted posts for logs or credential files", "share_pct": 2.3, "low_pct": 0.0, "high_pct": 5.4, "n_labelled": 3 }, { "category": "stealer_log_clouds_promo_or_mirror", "label": "Promotions and notices of such clouds", "share_pct": 1.2, "low_pct": 0.0, "high_pct": 3.1, "n_labelled": 3 } ] }, "c_combolist": { "n_labelled": 80, "weighted_population_posts": 114762.0, "classes": [ { "category": "credential_files_and_pointers", "label": "Credential files, samples and pointers", "share_pct": 36.8, "low_pct": 25.8, "high_pct": 47.7, "n_labelled": 33 }, { "category": "not_an_offer", "label": "Not an offer (replies, chatter, notices)", "share_pct": 19.2, "low_pct": 10.6, "high_pct": 28.9, "n_labelled": 15 }, { "category": "other_accounts_and_cookies_for_sale", "label": "Other accounts and cookies for sale", "share_pct": 18.9, "low_pct": 9.8, "high_pct": 28.9, "n_labelled": 14 }, { "category": "buy_side_account_or_cookie_submissions", "label": "Buy-side account or cookie submissions", "share_pct": 11.9, "low_pct": 4.6, "high_pct": 20.7, "n_labelled": 8 }, { "category": "wanted_requests_for_logs_or_files", "label": "Wanted posts for logs or credential files", "share_pct": 7.0, "low_pct": 1.0, "high_pct": 14.6, "n_labelled": 4 }, { "category": "tools_bots_and_services", "label": "Tools, bots and service menus", "share_pct": 6.3, "low_pct": 1.8, "high_pct": 12.1, "n_labelled": 6 } ] } }, "confidence_note": "Game-account lots are a moderate-confidence reading: the posts list in-game specifications, which the first reading rules had mistaken for e-mail accounts. Combolist classes with no hand-labelled post are not listed.", "rounding_rule": "Every percentage is the source fraction times 100 rounded half-up to one decimal (0.1505 prints 15.1; 0.2382 prints 23.8). Counts are exact. The same printed value is used in the JSON, CSVs, charts and pages.", "cloud_audit": { "definition": { "strict": "Stealer-log clouds, feeds, subscriptions or raw log packs from infected machines that the post offers for sale or access (priced, or with an explicit buy/join/contact line for access). Requests for such logs are wanted posts. Bank 'logs' and game 'logs' never count.", "broad": "Strict plus promotions, channel invitations and relayed notices of such clouds that carry no terms.", "as_labelled": "The earlier form label 'logs and clouds', which also held wanted posts, retail 'log' requests and trade slang (unaudited)." }, "botnet_log_hand_label": { "strict": { "share_pct": 6.3, "low_pct": 2.6, "high_pct": 10.4, "n_labelled": 9 }, "broad": { "share_pct": 7.4, "low_pct": 3.5, "high_pct": 12.1, "n_labelled": 12 }, "as_labelled": { "share_pct": 12.0, "low_pct": 7.2, "high_pct": 17.4, "n_labelled": 18 } }, "combolist_strict_n_labelled": 0, "combolist_strict_rule_of_three_upper_pct": 3.8, "family_share": { "three_sets_without_lookup_bots": { "strict": { "share_pct": 2.2, "low_pct": 0.9, "high_pct": 6.0, "denominator_cleaned_posts": 189975 }, "broad": { "share_pct": 2.6, "low_pct": 1.2, "high_pct": 6.6, "denominator_cleaned_posts": 189975 }, "as_labelled_unaudited": { "share_pct": 4.2, "low_pct": 2.5, "high_pct": 8.4, "denominator_cleaned_posts": 189975 } }, "four_sets_with_lookup_bots": { "strict": { "share_pct": 1.5, "low_pct": 0.6, "high_pct": 4.6, "denominator_cleaned_posts": 286921 }, "broad": { "share_pct": 1.7, "low_pct": 0.8, "high_pct": 5.0, "denominator_cleaned_posts": 286921 }, "as_labelled_unaudited": { "share_pct": 2.8, "low_pct": 1.7, "high_pct": 6.2, "denominator_cleaned_posts": 286921 } } }, "classifier_cloud_form_precision_pct": { "eval2_as_labelled": { "precision_pct": 37.5, "n_pred": 8, "tp": 3 }, "eval3_as_labelled_tuned_sample": { "precision_pct": 45.0, "n_pred": 20, "tp": 9 }, "eval3_against_strict_tier": { "precision_pct": 20.0, "n_pred": 20, "tp": 4 } }, "note": "Strict = clouds, feeds or raw log packs offered for sale or access. Broad adds promotions and relayed notices. As first labelled = the earlier \"logs and clouds\" label, which also held wanted posts and trade slang (unaudited). Family figures scale the Botnet Log hand share by that set weight, add the Combolist hand zero (upper end by the rule of three) and use classifier shares for the keyword and breach-bot sets." }, "label_audit": { "n_entries": 23, "n_changed": 21, "note": "Labels re-read after the independent review; changes are logged privately." }, "other_views": { "c_botnet_log": { "mode_group": [ { "category": "sale", "label": "Sale", "share_pct": 61.7, "low_pct": 53.6, "high_pct": 69.9, "n_labelled": 93 }, { "category": "wanted_or_exchange", "label": "Wanted or exchange", "share_pct": 23.1, "low_pct": 16.2, "high_pct": 29.9, "n_labelled": 42 }, { "category": "none_or_unclear", "label": "None or unclear", "share_pct": 11.1, "low_pct": 6.5, "high_pct": 16.5, "n_labelled": 16 }, { "category": "free_share", "label": "Free share", "share_pct": 4.0, "low_pct": 1.4, "high_pct": 7.4, "n_labelled": 9 } ], "form_group": [ { "category": "single_accounts_and_cookies_and_bank_logs", "label": "Single accounts and cookies and bank logs", "share_pct": 67.3, "low_pct": 59.6, "high_pct": 74.9, "n_labelled": 109 }, { "category": "not_an_offer_or_other", "label": "Not an offer or other", "share_pct": 15.0, "low_pct": 9.5, "high_pct": 20.7, "n_labelled": 21 }, { "category": "logs_and_clouds", "label": "Logs and clouds (as first labelled, unaudited)", "share_pct": 12.0, "low_pct": 7.2, "high_pct": 17.4, "n_labelled": 18 }, { "category": "credential_files_and_pointers", "label": "Credential files and pointers", "share_pct": 4.6, "low_pct": 1.4, "high_pct": 8.4, "n_labelled": 9 }, { "category": "lookup_search_bots", "label": "Lookup search bots", "share_pct": 1.0, "low_pct": 0.0, "high_pct": 2.7, "n_labelled": 2 }, { "category": "checker_config_tool", "label": "Checker config tool", "share_pct": 0.2, "low_pct": 0.0, "high_pct": 0.6, "n_labelled": 1 } ], "account_type": [ { "category": "mixed/unspecified", "label": "Mixed / unspecified", "share_pct": 25.1, "low_pct": 18.8, "high_pct": 32.0, "n_labelled": 50 }, { "category": "finance/payment/bank", "label": "Finance / payment / bank", "share_pct": 24.8, "low_pct": 18.0, "high_pct": 32.1, "n_labelled": 38 }, { "category": "gaming", "label": "Gaming", "share_pct": 24.4, "low_pct": 17.8, "high_pct": 31.1, "n_labelled": 34 }, { "category": "none (no product)", "label": "None (no product)", "share_pct": 11.1, "low_pct": 6.5, "high_pct": 16.5, "n_labelled": 16 }, { "category": "social media", "label": "Social media", "share_pct": 7.4, "low_pct": 3.5, "high_pct": 12.0, "n_labelled": 11 }, { "category": "other", "label": "Other", "share_pct": 2.3, "low_pct": 0.0, "high_pct": 5.4, "n_labelled": 3 }, { "category": "cloud/SaaS/corporate", "label": "Cloud / saas / corporate", "share_pct": 1.8, "low_pct": 0.0, "high_pct": 4.1, "n_labelled": 3 }, { "category": "shopping/e-commerce/delivery", "label": "Shopping / e-commerce / delivery", "share_pct": 1.5, "low_pct": 0.0, "high_pct": 3.7, "n_labelled": 2 }, { "category": "streaming/video", "label": "Streaming / video", "share_pct": 0.9, "low_pct": 0.0, "high_pct": 2.6, "n_labelled": 2 }, { "category": "email/webmail", "label": "Email / webmail", "share_pct": 0.7, "low_pct": 0.0, "high_pct": 2.2, "n_labelled": 1 } ] }, "c_combolist": { "mode_group": [ { "category": "sale", "label": "Sale", "share_pct": 39.3, "low_pct": 27.1, "high_pct": 51.6, "n_labelled": 29 }, { "category": "free_share", "label": "Free share", "share_pct": 21.4, "low_pct": 12.2, "high_pct": 31.9, "n_labelled": 22 }, { "category": "none_or_unclear", "label": "None or unclear", "share_pct": 20.4, "low_pct": 11.5, "high_pct": 30.5, "n_labelled": 17 }, { "category": "wanted_or_exchange", "label": "Wanted or exchange", "share_pct": 18.9, "low_pct": 9.8, "high_pct": 28.9, "n_labelled": 12 } ], "form_group": [ { "category": "credential_files_and_pointers", "label": "Credential files and pointers", "share_pct": 43.8, "low_pct": 31.5, "high_pct": 54.7, "n_labelled": 37 }, { "category": "single_accounts_and_cookies_and_bank_logs", "label": "Single accounts and cookies and bank logs", "share_pct": 30.7, "low_pct": 19.9, "high_pct": 42.7, "n_labelled": 22 }, { "category": "not_an_offer_or_other", "label": "Not an offer or other", "share_pct": 20.7, "low_pct": 11.7, "high_pct": 30.7, "n_labelled": 16 }, { "category": "checker_config_tool", "label": "Checker config tool", "share_pct": 4.7, "low_pct": 1.0, "high_pct": 9.6, "n_labelled": 5 } ], "account_type": [ { "category": "email/webmail", "label": "Email / webmail", "share_pct": 32.7, "low_pct": 21.6, "high_pct": 45.1, "n_labelled": 30 }, { "category": "mixed/unspecified", "label": "Mixed / unspecified", "share_pct": 26.5, "low_pct": 15.4, "high_pct": 37.4, "n_labelled": 19 }, { "category": "none (no product)", "label": "None (no product)", "share_pct": 19.2, "low_pct": 10.6, "high_pct": 28.9, "n_labelled": 15 }, { "category": "other", "label": "Other", "share_pct": 5.4, "low_pct": 1.0, "high_pct": 10.9, "n_labelled": 5 }, { "category": "social media", "label": "Social media", "share_pct": 5.2, "low_pct": 1.0, "high_pct": 11.6, "n_labelled": 4 }, { "category": "gaming", "label": "Gaming", "share_pct": 3.2, "low_pct": 0.0, "high_pct": 8.7, "n_labelled": 2 }, { "category": "streaming/video", "label": "Streaming / video", "share_pct": 3.1, "low_pct": 0.0, "high_pct": 7.8, "n_labelled": 2 }, { "category": "cloud/SaaS/corporate", "label": "Cloud / saas / corporate", "share_pct": 2.2, "low_pct": 0.0, "high_pct": 6.7, "n_labelled": 1 }, { "category": "music", "label": "Music", "share_pct": 2.2, "low_pct": 0.0, "high_pct": 6.7, "n_labelled": 1 }, { "category": "VPN/proxy", "label": "Vpn / proxy", "share_pct": 0.2, "low_pct": 0.0, "high_pct": 0.7, "n_labelled": 1 } ] } }, "quarter_tables": "Not published: 40 posts per quarter per set cannot support quarter comparisons, and class labels changed in May-July." }, "bank_listings": { "basis": "classifier, not hand labels", "sampled_listings": 310, "share_with_price_term_pct": 47.4, "share_naming_a_balance_pct": 41.3, "rule": "Asking price and claimed balance are different quantities; they are never pooled, averaged or compared as a ratio (see the Fraud chapter, record FR-O036)." }, "buy_side": { "definition": "Buy-side post: the poster pays for accounts, cookies or sessions that others submit (WTB/need/rate-sheet wording), product form single accounts or cookies. Classifier recall about 0.6 may miss wanted posts; it does not establish a lower bound for their share.", "hand_label": { "c_botnet_log": { "share_pct": 17.0, "low_pct": 11.1, "high_pct": 23.0, "n_labelled": 34 }, "c_combolist": { "share_pct": 11.9, "low_pct": 4.6, "high_pct": 20.7, "n_labelled": 8 } }, "classifier_estimate": { "c_botnet_log": { "share_pct": 14.9, "low_pct": 12.7, "high_pct": 17.3, "sampled_posts": 390 }, "c_combolist": { "share_pct": 10.2, "low_pct": 9.0, "high_pct": 11.5, "sampled_posts": 380 } }, "structure": { "sample": { "distinct_texts_in_population": 371, "texts_read_in_full": 70, "not_buy_side": 1, "buy_side_posts_coded": 69, "note": "Distinct wanted-mode cookie or single-account texts in the Botnet Log and Combolist sets that match a loose wording filter; the filter is not evidence of structure. Coding is by reading." }, "post_type": { "multi_product_rate_sheet": { "n": 31, "of": 69, "share_pct": 44.9, "low_pct": 33.8, "high_pct": 56.6 }, "single_product_rate_post": { "n": 28, "of": 69, "share_pct": 40.6, "low_pct": 29.8, "high_pct": 52.4 }, "submission_notice_without_rates": { "n": 6, "of": 69, "share_pct": 8.7, "low_pct": 4.0, "high_pct": 17.7 }, "request_without_rates_or_sheet": { "n": 4, "of": 69, "share_pct": 5.8, "low_pct": 2.3, "high_pct": 14.0 } }, "among_posts_with_stated_rates": { "two_factor_as_sheet_column": { "n": 28, "of": 59, "share_pct": 47.5, "low_pct": 35.3, "high_pct": 60.0 }, "two_factor_in_product_label_only": { "n": 7, "of": 59, "share_pct": 11.9, "low_pct": 5.9, "high_pct": 22.5 }, "two_factor_absent": { "n": 24, "of": 59, "share_pct": 40.7, "low_pct": 29.1, "high_pct": 53.4 }, "cookie_as_sheet_column": { "n": 34, "of": 59, "share_pct": 57.6, "low_pct": 44.9, "high_pct": 69.4 }, "cookie_in_product_label_only": { "n": 11, "of": 59, "share_pct": 18.6, "low_pct": 10.7, "high_pct": 30.4 }, "cookie_absent": { "n": 14, "of": 59, "share_pct": 23.7, "low_pct": 14.7, "high_pct": 36.0 }, "friend_or_follower_count_specified": { "n": 39, "of": 59, "share_pct": 66.1, "low_pct": 53.4, "high_pct": 76.9 }, "signup_route_specified": { "n": 27, "of": 59, "share_pct": 45.8, "low_pct": 33.7, "high_pct": 58.3 }, "report_time_or_acceptance_stated": { "n": 34, "of": 59, "share_pct": 57.6, "low_pct": 44.9, "high_pct": 69.4 }, "admin_vs_member_rates_distinguished": { "n": 22, "of": 59, "share_pct": 37.3, "low_pct": 26.1, "high_pct": 50.0 }, "volume_tiers_by_batch_size": { "n": 12, "of": 59, "share_pct": 20.3, "low_pct": 12.0, "high_pct": 32.3 } }, "origin_statement_among_all_buy_side_posts": { "none": { "n": 52, "of": 69, "share_pct": 75.4, "low_pct": 64.0, "high_pct": 84.0 }, "creation_wording_in_text": { "n": 3, "of": 69, "share_pct": 4.3, "low_pct": 1.5, "high_pct": 12.0 }, "method_or_training_pointer": { "n": 3, "of": 69, "share_pct": 4.3, "low_pct": 1.5, "high_pct": 12.0 }, "naming_or_registration_rules": { "n": 6, "of": 69, "share_pct": 8.7, "low_pct": 4.0, "high_pct": 17.7 }, "live_check_before_submitting": { "n": 4, "of": 69, "share_pct": 5.8, "low_pct": 2.3, "high_pct": 14.0 }, "buyer_check": { "n": 1, "of": 69, "share_pct": 1.4, "low_pct": 0.3, "high_pct": 7.8 } }, "same_sheet_variant_pairs": { "sheets_with_a_pair": 9, "of_priced_multi_product_sheets": 31 }, "automated_parse": { "distinct_texts": 371, "sheets_with_parsed_rates": 201 }, "note": "Earlier cue percentages counted keyword mentions in a wider filter population and are retired. Rates are not published here: stated rates are what a poster says it pays per submitted item, in taka as written, and are never pooled with sale prices." }, "does_not_show": [ "Whether the submitted accounts were stolen, self-registered, bought in bulk or aged and resold; the posts never say where accounts come from.", "Whether any payment was made, who the end buyers are, or how many suppliers respond.", "Rates are quoted without a stated unit; the per-item reading follows the sheet wording. Currency is usually 'tk' or 'bdt' (Bangladeshi taka, as written) and amounts are small; they must not be pooled with sale prices in other units." ] }, "price_units": { "basis": "Posts, not terms. Unweighted sampled kept posts that state at least one amount, by the unit the post names. One post can name several units, so unit columns do not add up to priced posts. side = asking (sale or access terms) or buy_side (what the poster says it pays per submitted item).", "columns": [ "priced_posts", "posts_with_period", "posts_with_lines", "posts_with_item", "posts_with_lookup", "posts_with_gb", "posts_with_other", "posts_with_unspecified", "posts_with_only_unspecified" ], "rows": [ { "set_id": "ALL SETS", "product_form": "ALL FORMS", "side": "asking", "priced_posts": 1206, "posts_with_period": 317, "posts_with_lines": 5, "posts_with_item": 208, "posts_with_lookup": 51, "posts_with_gb": 0, "posts_with_other": 0, "posts_with_unspecified": 758, "posts_with_only_unspecified": 649 }, { "set_id": "ALL SETS", "product_form": "ALL FORMS", "side": "buy_side", "priced_posts": 351, "posts_with_period": 32, "posts_with_lines": 2, "posts_with_item": 331, "posts_with_lookup": 0, "posts_with_gb": 0, "posts_with_other": 0, "posts_with_unspecified": 15, "posts_with_only_unspecified": 12 }, { "set_id": "ALL SETS", "product_form": "bank_log_listing", "side": "asking", "priced_posts": 155, "posts_with_period": 7, "posts_with_lines": 0, "posts_with_item": 155, "posts_with_lookup": 0, "posts_with_gb": 0, "posts_with_other": 0, "posts_with_unspecified": 0, "posts_with_only_unspecified": 0 }, { "set_id": "ALL SETS", "product_form": "bulk_combolist", "side": "asking", "priced_posts": 301, "posts_with_period": 160, "posts_with_lines": 5, "posts_with_item": 7, "posts_with_lookup": 1, "posts_with_gb": 0, "posts_with_other": 0, "posts_with_unspecified": 183, "posts_with_only_unspecified": 129 }, { "set_id": "ALL SETS", "product_form": "bulk_combolist", "side": "buy_side", "priced_posts": 7, "posts_with_period": 1, "posts_with_lines": 1, "posts_with_item": 0, "posts_with_lookup": 0, "posts_with_gb": 0, "posts_with_other": 0, "posts_with_unspecified": 5, "posts_with_only_unspecified": 5 }, { "set_id": "ALL SETS", "product_form": "checker_config_tool", "side": "asking", "priced_posts": 44, "posts_with_period": 20, "posts_with_lines": 0, "posts_with_item": 0, "posts_with_lookup": 0, "posts_with_gb": 0, "posts_with_other": 0, "posts_with_unspecified": 28, "posts_with_only_unspecified": 24 }, { "set_id": "ALL SETS", "product_form": "checker_config_tool", "side": "buy_side", "priced_posts": 2, "posts_with_period": 2, "posts_with_lines": 0, "posts_with_item": 0, "posts_with_lookup": 0, "posts_with_gb": 0, "posts_with_other": 0, "posts_with_unspecified": 2, "posts_with_only_unspecified": 0 }, { "set_id": "ALL SETS", "product_form": "free_drop_pointer", "side": "asking", "priced_posts": 52, "posts_with_period": 8, "posts_with_lines": 0, "posts_with_item": 0, "posts_with_lookup": 0, "posts_with_gb": 0, "posts_with_other": 0, "posts_with_unspecified": 45, "posts_with_only_unspecified": 44 }, { "set_id": "ALL SETS", "product_form": "logs_and_clouds", "side": "asking", "priced_posts": 64, "posts_with_period": 36, "posts_with_lines": 0, "posts_with_item": 0, "posts_with_lookup": 0, "posts_with_gb": 0, "posts_with_other": 0, "posts_with_unspecified": 45, "posts_with_only_unspecified": 28 }, { "set_id": "ALL SETS", "product_form": "logs_and_clouds", "side": "buy_side", "priced_posts": 3, "posts_with_period": 1, "posts_with_lines": 0, "posts_with_item": 1, "posts_with_lookup": 0, "posts_with_gb": 0, "posts_with_other": 0, "posts_with_unspecified": 2, "posts_with_only_unspecified": 1 }, { "set_id": "ALL SETS", "product_form": "lookup_search_bot", "side": "asking", "priced_posts": 60, "posts_with_period": 25, "posts_with_lines": 0, "posts_with_item": 0, "posts_with_lookup": 49, "posts_with_gb": 0, "posts_with_other": 0, "posts_with_unspecified": 0, "posts_with_only_unspecified": 0 }, { "set_id": "ALL SETS", "product_form": "other", "side": "asking", "priced_posts": 39, "posts_with_period": 8, "posts_with_lines": 0, "posts_with_item": 0, "posts_with_lookup": 0, "posts_with_gb": 0, "posts_with_other": 0, "posts_with_unspecified": 37, "posts_with_only_unspecified": 31 }, { "set_id": "ALL SETS", "product_form": "other", "side": "buy_side", "priced_posts": 7, "posts_with_period": 0, "posts_with_lines": 0, "posts_with_item": 1, "posts_with_lookup": 0, "posts_with_gb": 0, "posts_with_other": 0, "posts_with_unspecified": 6, "posts_with_only_unspecified": 6 }, { "set_id": "ALL SETS", "product_form": "session_cookies_tokens", "side": "asking", "priced_posts": 56, "posts_with_period": 6, "posts_with_lines": 0, "posts_with_item": 1, "posts_with_lookup": 0, "posts_with_gb": 0, "posts_with_other": 0, "posts_with_unspecified": 51, "posts_with_only_unspecified": 49 }, { "set_id": "ALL SETS", "product_form": "session_cookies_tokens", "side": "buy_side", "priced_posts": 211, "posts_with_period": 17, "posts_with_lines": 1, "posts_with_item": 210, "posts_with_lookup": 0, "posts_with_gb": 0, "posts_with_other": 0, "posts_with_unspecified": 0, "posts_with_only_unspecified": 0 }, { "set_id": "ALL SETS", "product_form": "single_or_few_accounts", "side": "asking", "priced_posts": 406, "posts_with_period": 29, "posts_with_lines": 0, "posts_with_item": 44, "posts_with_lookup": 1, "posts_with_gb": 0, "posts_with_other": 0, "posts_with_unspecified": 349, "posts_with_only_unspecified": 334 }, { "set_id": "ALL SETS", "product_form": "single_or_few_accounts", "side": "buy_side", "priced_posts": 121, "posts_with_period": 11, "posts_with_lines": 0, "posts_with_item": 119, "posts_with_lookup": 0, "posts_with_gb": 0, "posts_with_other": 0, "posts_with_unspecified": 0, "posts_with_only_unspecified": 0 }, { "set_id": "ALL SETS", "product_form": "url_login_pass_file", "side": "asking", "priced_posts": 29, "posts_with_period": 18, "posts_with_lines": 0, "posts_with_item": 1, "posts_with_lookup": 0, "posts_with_gb": 0, "posts_with_other": 0, "posts_with_unspecified": 20, "posts_with_only_unspecified": 10 }, { "set_id": "c_botnet_log", "product_form": "ALL FORMS", "side": "asking", "priced_posts": 454, "posts_with_period": 82, "posts_with_lines": 0, "posts_with_item": 150, "posts_with_lookup": 3, "posts_with_gb": 0, "posts_with_other": 0, "posts_with_unspecified": 261, "posts_with_only_unspecified": 227 }, { "set_id": "c_botnet_log", "product_form": "ALL FORMS", "side": "buy_side", "priced_posts": 135, "posts_with_period": 12, "posts_with_lines": 1, "posts_with_item": 130, "posts_with_lookup": 0, "posts_with_gb": 0, "posts_with_other": 0, "posts_with_unspecified": 3, "posts_with_only_unspecified": 1 }, { "set_id": "c_botnet_log", "product_form": "bank_log_listing", "side": "asking", "priced_posts": 147, "posts_with_period": 6, "posts_with_lines": 0, "posts_with_item": 147, "posts_with_lookup": 0, "posts_with_gb": 0, "posts_with_other": 0, "posts_with_unspecified": 0, "posts_with_only_unspecified": 0 }, { "set_id": "c_botnet_log", "product_form": "bulk_combolist", "side": "asking", "priced_posts": 21, "posts_with_period": 11, "posts_with_lines": 0, "posts_with_item": 0, "posts_with_lookup": 0, "posts_with_gb": 0, "posts_with_other": 0, "posts_with_unspecified": 13, "posts_with_only_unspecified": 10 }, { "set_id": "c_botnet_log", "product_form": "checker_config_tool", "side": "asking", "priced_posts": 6, "posts_with_period": 5, "posts_with_lines": 0, "posts_with_item": 0, "posts_with_lookup": 0, "posts_with_gb": 0, "posts_with_other": 0, "posts_with_unspecified": 4, "posts_with_only_unspecified": 1 }, { "set_id": "c_botnet_log", "product_form": "checker_config_tool", "side": "buy_side", "priced_posts": 1, "posts_with_period": 1, "posts_with_lines": 0, "posts_with_item": 0, "posts_with_lookup": 0, "posts_with_gb": 0, "posts_with_other": 0, "posts_with_unspecified": 1, "posts_with_only_unspecified": 0 }, { "set_id": "c_botnet_log", "product_form": "logs_and_clouds", "side": "asking", "priced_posts": 60, "posts_with_period": 34, "posts_with_lines": 0, "posts_with_item": 0, "posts_with_lookup": 0, "posts_with_gb": 0, "posts_with_other": 0, "posts_with_unspecified": 42, "posts_with_only_unspecified": 26 }, { "set_id": "c_botnet_log", "product_form": "logs_and_clouds", "side": "buy_side", "priced_posts": 3, "posts_with_period": 1, "posts_with_lines": 0, "posts_with_item": 1, "posts_with_lookup": 0, "posts_with_gb": 0, "posts_with_other": 0, "posts_with_unspecified": 2, "posts_with_only_unspecified": 1 }, { "set_id": "c_botnet_log", "product_form": "lookup_search_bot", "side": "asking", "priced_posts": 10, "posts_with_period": 9, "posts_with_lines": 0, "posts_with_item": 0, "posts_with_lookup": 3, "posts_with_gb": 0, "posts_with_other": 0, "posts_with_unspecified": 0, "posts_with_only_unspecified": 0 }, { "set_id": "c_botnet_log", "product_form": "other", "side": "asking", "priced_posts": 8, "posts_with_period": 6, "posts_with_lines": 0, "posts_with_item": 0, "posts_with_lookup": 0, "posts_with_gb": 0, "posts_with_other": 0, "posts_with_unspecified": 8, "posts_with_only_unspecified": 2 }, { "set_id": "c_botnet_log", "product_form": "session_cookies_tokens", "side": "asking", "priced_posts": 31, "posts_with_period": 2, "posts_with_lines": 0, "posts_with_item": 0, "posts_with_lookup": 0, "posts_with_gb": 0, "posts_with_other": 0, "posts_with_unspecified": 29, "posts_with_only_unspecified": 29 }, { "set_id": "c_botnet_log", "product_form": "session_cookies_tokens", "side": "buy_side", "priced_posts": 126, "posts_with_period": 9, "posts_with_lines": 1, "posts_with_item": 125, "posts_with_lookup": 0, "posts_with_gb": 0, "posts_with_other": 0, "posts_with_unspecified": 0, "posts_with_only_unspecified": 0 }, { "set_id": "c_botnet_log", "product_form": "single_or_few_accounts", "side": "asking", "priced_posts": 162, "posts_with_period": 2, "posts_with_lines": 0, "posts_with_item": 2, "posts_with_lookup": 0, "posts_with_gb": 0, "posts_with_other": 0, "posts_with_unspecified": 159, "posts_with_only_unspecified": 158 }, { "set_id": "c_botnet_log", "product_form": "single_or_few_accounts", "side": "buy_side", "priced_posts": 5, "posts_with_period": 1, "posts_with_lines": 0, "posts_with_item": 4, "posts_with_lookup": 0, "posts_with_gb": 0, "posts_with_other": 0, "posts_with_unspecified": 0, "posts_with_only_unspecified": 0 }, { "set_id": "c_botnet_log", "product_form": "url_login_pass_file", "side": "asking", "priced_posts": 9, "posts_with_period": 7, "posts_with_lines": 0, "posts_with_item": 1, "posts_with_lookup": 0, "posts_with_gb": 0, "posts_with_other": 0, "posts_with_unspecified": 6, "posts_with_only_unspecified": 1 }, { "set_id": "c_combolist", "product_form": "ALL FORMS", "side": "asking", "priced_posts": 550, "posts_with_period": 151, "posts_with_lines": 1, "posts_with_item": 51, "posts_with_lookup": 5, "posts_with_gb": 0, "posts_with_other": 0, "posts_with_unspecified": 406, "posts_with_only_unspecified": 348 }, { "set_id": "c_combolist", "product_form": "ALL FORMS", "side": "buy_side", "priced_posts": 210, "posts_with_period": 19, "posts_with_lines": 0, "posts_with_item": 201, "posts_with_lookup": 0, "posts_with_gb": 0, "posts_with_other": 0, "posts_with_unspecified": 7, "posts_with_only_unspecified": 7 }, { "set_id": "c_combolist", "product_form": "bank_log_listing", "side": "asking", "priced_posts": 3, "posts_with_period": 1, "posts_with_lines": 0, "posts_with_item": 3, "posts_with_lookup": 0, "posts_with_gb": 0, "posts_with_other": 0, "posts_with_unspecified": 0, "posts_with_only_unspecified": 0 }, { "set_id": "c_combolist", "product_form": "bulk_combolist", "side": "asking", "priced_posts": 175, "posts_with_period": 97, "posts_with_lines": 1, "posts_with_item": 5, "posts_with_lookup": 1, "posts_with_gb": 0, "posts_with_other": 0, "posts_with_unspecified": 107, "posts_with_only_unspecified": 71 }, { "set_id": "c_combolist", "product_form": "bulk_combolist", "side": "buy_side", "priced_posts": 3, "posts_with_period": 1, "posts_with_lines": 0, "posts_with_item": 0, "posts_with_lookup": 0, "posts_with_gb": 0, "posts_with_other": 0, "posts_with_unspecified": 2, "posts_with_only_unspecified": 2 }, { "set_id": "c_combolist", "product_form": "checker_config_tool", "side": "asking", "priced_posts": 9, "posts_with_period": 3, "posts_with_lines": 0, "posts_with_item": 0, "posts_with_lookup": 0, "posts_with_gb": 0, "posts_with_other": 0, "posts_with_unspecified": 7, "posts_with_only_unspecified": 6 }, { "set_id": "c_combolist", "product_form": "free_drop_pointer", "side": "asking", "priced_posts": 45, "posts_with_period": 1, "posts_with_lines": 0, "posts_with_item": 0, "posts_with_lookup": 0, "posts_with_gb": 0, "posts_with_other": 0, "posts_with_unspecified": 44, "posts_with_only_unspecified": 44 }, { "set_id": "c_combolist", "product_form": "logs_and_clouds", "side": "asking", "priced_posts": 4, "posts_with_period": 2, "posts_with_lines": 0, "posts_with_item": 0, "posts_with_lookup": 0, "posts_with_gb": 0, "posts_with_other": 0, "posts_with_unspecified": 3, "posts_with_only_unspecified": 2 }, { "set_id": "c_combolist", "product_form": "lookup_search_bot", "side": "asking", "priced_posts": 6, "posts_with_period": 6, "posts_with_lines": 0, "posts_with_item": 0, "posts_with_lookup": 3, "posts_with_gb": 0, "posts_with_other": 0, "posts_with_unspecified": 0, "posts_with_only_unspecified": 0 }, { "set_id": "c_combolist", "product_form": "other", "side": "asking", "priced_posts": 30, "posts_with_period": 2, "posts_with_lines": 0, "posts_with_item": 0, "posts_with_lookup": 0, "posts_with_gb": 0, "posts_with_other": 0, "posts_with_unspecified": 28, "posts_with_only_unspecified": 28 }, { "set_id": "c_combolist", "product_form": "other", "side": "buy_side", "priced_posts": 6, "posts_with_period": 0, "posts_with_lines": 0, "posts_with_item": 1, "posts_with_lookup": 0, "posts_with_gb": 0, "posts_with_other": 0, "posts_with_unspecified": 5, "posts_with_only_unspecified": 5 }, { "set_id": "c_combolist", "product_form": "session_cookies_tokens", "side": "asking", "priced_posts": 22, "posts_with_period": 4, "posts_with_lines": 0, "posts_with_item": 1, "posts_with_lookup": 0, "posts_with_gb": 0, "posts_with_other": 0, "posts_with_unspecified": 19, "posts_with_only_unspecified": 17 }, { "set_id": "c_combolist", "product_form": "session_cookies_tokens", "side": "buy_side", "priced_posts": 85, "posts_with_period": 8, "posts_with_lines": 0, "posts_with_item": 85, "posts_with_lookup": 0, "posts_with_gb": 0, "posts_with_other": 0, "posts_with_unspecified": 0, "posts_with_only_unspecified": 0 }, { "set_id": "c_combolist", "product_form": "single_or_few_accounts", "side": "asking", "priced_posts": 238, "posts_with_period": 24, "posts_with_lines": 0, "posts_with_item": 42, "posts_with_lookup": 1, "posts_with_gb": 0, "posts_with_other": 0, "posts_with_unspecified": 186, "posts_with_only_unspecified": 173 }, { "set_id": "c_combolist", "product_form": "single_or_few_accounts", "side": "buy_side", "priced_posts": 116, "posts_with_period": 10, "posts_with_lines": 0, "posts_with_item": 115, "posts_with_lookup": 0, "posts_with_gb": 0, "posts_with_other": 0, "posts_with_unspecified": 0, "posts_with_only_unspecified": 0 }, { "set_id": "c_combolist", "product_form": "url_login_pass_file", "side": "asking", "priced_posts": 18, "posts_with_period": 11, "posts_with_lines": 0, "posts_with_item": 0, "posts_with_lookup": 0, "posts_with_gb": 0, "posts_with_other": 0, "posts_with_unspecified": 12, "posts_with_only_unspecified": 7 }, { "set_id": "c_combolist + k_combolist (pooled, named)", "product_form": "bulk_combolist", "side": "asking", "priced_posts": 280, "posts_with_period": 149, "posts_with_lines": 5, "posts_with_item": 7, "posts_with_lookup": 1, "posts_with_gb": 0, "posts_with_other": 0, "posts_with_unspecified": 170, "posts_with_only_unspecified": 119 }, { "set_id": "c_combolist + k_combolist (pooled, named)", "product_form": "bulk_combolist", "side": "buy_side", "priced_posts": 7, "posts_with_period": 1, "posts_with_lines": 1, "posts_with_item": 0, "posts_with_lookup": 0, "posts_with_gb": 0, "posts_with_other": 0, "posts_with_unspecified": 5, "posts_with_only_unspecified": 5 }, { "set_id": "c_search_breach_bots", "product_form": "ALL FORMS", "side": "asking", "priced_posts": 35, "posts_with_period": 3, "posts_with_lines": 0, "posts_with_item": 0, "posts_with_lookup": 28, "posts_with_gb": 0, "posts_with_other": 0, "posts_with_unspecified": 6, "posts_with_only_unspecified": 6 }, { "set_id": "c_search_breach_bots", "product_form": "lookup_search_bot", "side": "asking", "priced_posts": 29, "posts_with_period": 3, "posts_with_lines": 0, "posts_with_item": 0, "posts_with_lookup": 28, "posts_with_gb": 0, "posts_with_other": 0, "posts_with_unspecified": 0, "posts_with_only_unspecified": 0 }, { "set_id": "c_search_breach_bots", "product_form": "other", "side": "asking", "priced_posts": 1, "posts_with_period": 0, "posts_with_lines": 0, "posts_with_item": 0, "posts_with_lookup": 0, "posts_with_gb": 0, "posts_with_other": 0, "posts_with_unspecified": 1, "posts_with_only_unspecified": 1 }, { "set_id": "c_search_breach_bots", "product_form": "session_cookies_tokens", "side": "asking", "priced_posts": 3, "posts_with_period": 0, "posts_with_lines": 0, "posts_with_item": 0, "posts_with_lookup": 0, "posts_with_gb": 0, "posts_with_other": 0, "posts_with_unspecified": 3, "posts_with_only_unspecified": 3 }, { "set_id": "c_search_breach_bots", "product_form": "single_or_few_accounts", "side": "asking", "priced_posts": 2, "posts_with_period": 0, "posts_with_lines": 0, "posts_with_item": 0, "posts_with_lookup": 0, "posts_with_gb": 0, "posts_with_other": 0, "posts_with_unspecified": 2, "posts_with_only_unspecified": 2 }, { "set_id": "k_combolist", "product_form": "ALL FORMS", "side": "asking", "priced_posts": 167, "posts_with_period": 81, "posts_with_lines": 4, "posts_with_item": 7, "posts_with_lookup": 15, "posts_with_gb": 0, "posts_with_other": 0, "posts_with_unspecified": 85, "posts_with_only_unspecified": 68 }, { "set_id": "k_combolist", "product_form": "ALL FORMS", "side": "buy_side", "priced_posts": 6, "posts_with_period": 1, "posts_with_lines": 1, "posts_with_item": 0, "posts_with_lookup": 0, "posts_with_gb": 0, "posts_with_other": 0, "posts_with_unspecified": 5, "posts_with_only_unspecified": 4 }, { "set_id": "k_combolist", "product_form": "bank_log_listing", "side": "asking", "priced_posts": 5, "posts_with_period": 0, "posts_with_lines": 0, "posts_with_item": 5, "posts_with_lookup": 0, "posts_with_gb": 0, "posts_with_other": 0, "posts_with_unspecified": 0, "posts_with_only_unspecified": 0 }, { "set_id": "k_combolist", "product_form": "bulk_combolist", "side": "asking", "priced_posts": 105, "posts_with_period": 52, "posts_with_lines": 4, "posts_with_item": 2, "posts_with_lookup": 0, "posts_with_gb": 0, "posts_with_other": 0, "posts_with_unspecified": 63, "posts_with_only_unspecified": 48 }, { "set_id": "k_combolist", "product_form": "bulk_combolist", "side": "buy_side", "priced_posts": 4, "posts_with_period": 0, "posts_with_lines": 1, "posts_with_item": 0, "posts_with_lookup": 0, "posts_with_gb": 0, "posts_with_other": 0, "posts_with_unspecified": 3, "posts_with_only_unspecified": 3 }, { "set_id": "k_combolist", "product_form": "checker_config_tool", "side": "asking", "priced_posts": 29, "posts_with_period": 12, "posts_with_lines": 0, "posts_with_item": 0, "posts_with_lookup": 0, "posts_with_gb": 0, "posts_with_other": 0, "posts_with_unspecified": 17, "posts_with_only_unspecified": 17 }, { "set_id": "k_combolist", "product_form": "checker_config_tool", "side": "buy_side", "priced_posts": 1, "posts_with_period": 1, "posts_with_lines": 0, "posts_with_item": 0, "posts_with_lookup": 0, "posts_with_gb": 0, "posts_with_other": 0, "posts_with_unspecified": 1, "posts_with_only_unspecified": 0 }, { "set_id": "k_combolist", "product_form": "free_drop_pointer", "side": "asking", "priced_posts": 7, "posts_with_period": 7, "posts_with_lines": 0, "posts_with_item": 0, "posts_with_lookup": 0, "posts_with_gb": 0, "posts_with_other": 0, "posts_with_unspecified": 1, "posts_with_only_unspecified": 0 }, { "set_id": "k_combolist", "product_form": "lookup_search_bot", "side": "asking", "priced_posts": 15, "posts_with_period": 7, "posts_with_lines": 0, "posts_with_item": 0, "posts_with_lookup": 15, "posts_with_gb": 0, "posts_with_other": 0, "posts_with_unspecified": 0, "posts_with_only_unspecified": 0 }, { "set_id": "k_combolist", "product_form": "other", "side": "buy_side", "priced_posts": 1, "posts_with_period": 0, "posts_with_lines": 0, "posts_with_item": 0, "posts_with_lookup": 0, "posts_with_gb": 0, "posts_with_other": 0, "posts_with_unspecified": 1, "posts_with_only_unspecified": 1 }, { "set_id": "k_combolist", "product_form": "single_or_few_accounts", "side": "asking", "priced_posts": 4, "posts_with_period": 3, "posts_with_lines": 0, "posts_with_item": 0, "posts_with_lookup": 0, "posts_with_gb": 0, "posts_with_other": 0, "posts_with_unspecified": 2, "posts_with_only_unspecified": 1 }, { "set_id": "k_combolist", "product_form": "url_login_pass_file", "side": "asking", "priced_posts": 2, "posts_with_period": 0, "posts_with_lines": 0, "posts_with_item": 0, "posts_with_lookup": 0, "posts_with_gb": 0, "posts_with_other": 0, "posts_with_unspecified": 2, "posts_with_only_unspecified": 2 } ], "sets_named": [ "c_combolist", "k_combolist", "c_botnet_log", "c_search_breach_bots", "ALL SETS", "c_combolist + k_combolist (pooled, named)" ], "period_terms_bulk_combolist": { "period_terms": 607, "commonest": [ { "access_period": "7 days", "terms": 144 }, { "access_period": "30 days", "terms": 125 }, { "access_period": "90 days", "terms": 65 }, { "access_period": "lifetime", "terms": 59 } ], "note": "Terms are price tiers of the same ads; one post can list several tiers. Shown only for the period pattern." }, "unit_extraction_accuracy_pct": { "dev": 73.9, "eval": 62.7, "eval2": 49.0 }, "caveats": [ "Unweighted counts from a stratified sample (set x quarter), not prevalence.", "Unit labels come from a rule-based extractor; accuracy on hand-checked priced posts is 49-74% across samples, so read the pattern, not single cells.", "\"Only no unit stated\" counts posts whose every amount lacks a unit.", "Buy-side rates are what a poster says it pays per submitted item; they are not sale prices and are not pooled with them.", "Amounts, currencies and roles are never pooled, averaged or converted." ], "catalogue": { "records": 45, "price_terms": 64, "price_term_roles": { "asking_price": 12, "claimed_balance": 6, "rental_price": 1, "buy_side_rate": 12, "subscription_price": 23, "per_lookup_price": 4, "renewal_price": 2, "per_lines_price": 3, "lump_sum_price": 1 }, "selection": "Purposive, not representative." } }, "subscription_tiers": { "definition": "Distinct post texts (URLs and handles removed) in kept posts of the four sets that list one or more access-period prices and are not buy-side. Prices are as written; price per day is computed (price divided by days of the period) in the currency as written and is NOT written in the posts. Second figures (strike-through or discount displays) and renewal prices are kept apart. Only aggregates are published here; no per-plan amounts.", "groups": { "credential_list_or_cloud_plans": { "distinct_texts": 233, "copies_in_sample": 236, "texts_with_one_tier": 13, "texts_with_two_or_more_tiers": 220, "share_of_distinct_texts_pct": { "has_trial": 34.5, "has_lifetime": 42.7, "renewal_wording": 3.6, "second_figure_on_a_tier": 6.8, "discount_wording": 15.0, "says_private": 81.8, "says_fresh_or_daily": 64.1, "says_valid": 31.8, "bot_or_auto_purchase": 18.6, "crypto_payment": 19.5, "support_line": 22.7, "free_sample_or_drop": 10.0 }, "by_set": { "c_combolist": 105, "c_botnet_log": 58, "k_combolist": 57, "c_search_breach_bots": 0 }, "per_day_logic": { "segments_with_3plus_core_tiers": 174, "per_day_falls_at_every_step": 144, "per_day_never_rises": 152, "median_ratio_longest_to_shortest_core_tier_per_day": 0.4, "ratio_p25_p75": [ 0.29, 0.53 ], "segments_with_30day_and_lifetime": 99, "median_lifetime_price_in_30day_prices": 4.3, "lifetime_to_30day_p25_p75": [ 3.1, 6.7 ] }, "commonest_period_ladders": [ { "ladder": "7 days > 30 days", "segments": 28 }, { "ladder": "7 days > 30 days > lifetime", "segments": 17 }, { "ladder": "3 days > 7 days > 10 days > 30 days", "segments": 17 }, { "ladder": "3 days > 7 days > 30 days", "segments": 15 }, { "ladder": "3 days > 7 days > 30 days > 90 days > lifetime", "segments": 15 }, { "ladder": "7 days > 30 days > 90 days > 180 days > 365 days", "segments": 11 } ], "tier_count_distribution": { "2": 19, "3": 44, "4": 63, "5": 48, "6": 20, "7": 15, "8": 7, "10": 2, "11": 1, "19": 1 } }, "lookup_bot_plan": { "distinct_texts": 21, "copies_in_sample": 21, "texts_with_one_tier": 3, "texts_with_two_or_more_tiers": 18, "share_of_distinct_texts_pct": { "has_trial": 5.6, "has_lifetime": 38.9, "renewal_wording": 5.6, "second_figure_on_a_tier": 16.7, "discount_wording": 33.3, "says_private": 83.3, "says_fresh_or_daily": 38.9, "says_valid": 22.2, "bot_or_auto_purchase": 100.0, "crypto_payment": 33.3, "support_line": 16.7, "free_sample_or_drop": 44.4 }, "by_set": { "c_combolist": 3, "c_botnet_log": 11, "k_combolist": 3, "c_search_breach_bots": 1 }, "per_day_logic": { "segments_with_3plus_core_tiers": 14, "per_day_falls_at_every_step": 10, "per_day_never_rises": 10, "median_ratio_longest_to_shortest_core_tier_per_day": 0.78, "ratio_p25_p75": [ 0.11, 0.78 ], "segments_with_30day_and_lifetime": 7, "median_lifetime_price_in_30day_prices": 10.0, "lifetime_to_30day_p25_p75": [ 4.5, 10.0 ] }, "commonest_period_ladders": [ { "ladder": "7 days > 14 days > 30 days", "segments": 6 }, { "ladder": "30 days > 30 days > 30 days > 120 days > lifetime", "segments": 2 }, { "ladder": "1 day > 7 days > 30 days > lifetime", "segments": 1 }, { "ladder": "30 days > 90 days > lifetime", "segments": 1 }, { "ladder": "30 days > 90 days", "segments": 1 }, { "ladder": "1 day > 7 days > 30 days > 90 days > 365 days", "segments": 1 } ], "tier_count_distribution": { "2": 1, "3": 8, "4": 3, "5": 4, "7": 1, "9": 1 } }, "tool_or_checker_plan": { "distinct_texts": 24, "copies_in_sample": 27, "texts_with_one_tier": 5, "texts_with_two_or_more_tiers": 19, "share_of_distinct_texts_pct": { "has_trial": 31.6, "has_lifetime": 63.2, "renewal_wording": 15.8, "second_figure_on_a_tier": 10.5, "discount_wording": 57.9, "says_private": 68.4, "says_fresh_or_daily": 57.9, "says_valid": 5.3, "bot_or_auto_purchase": 73.7, "crypto_payment": 78.9, "support_line": 26.3, "free_sample_or_drop": 52.6 }, "by_set": { "c_combolist": 2, "c_botnet_log": 5, "k_combolist": 12, "c_search_breach_bots": 0 }, "per_day_logic": { "segments_with_3plus_core_tiers": 13, "per_day_falls_at_every_step": 6, "per_day_never_rises": 9, "median_ratio_longest_to_shortest_core_tier_per_day": 0.67, "ratio_p25_p75": [ 0.39, 0.78 ], "segments_with_30day_and_lifetime": 11, "median_lifetime_price_in_30day_prices": 6.0, "lifetime_to_30day_p25_p75": [ 1.8, 25.1 ] }, "commonest_period_ladders": [ { "ladder": "7 days > 30 days > 90 days > 180 days > 365 days > lifetime", "segments": 4 }, { "ladder": "7 days > 14 days > 30 days", "segments": 3 }, { "ladder": "365 days", "segments": 3 }, { "ladder": "30 days > 30 days > 365 days > lifetime", "segments": 3 }, { "ladder": "7 days > 7 days > 30 days > 30 days > lifetime > lifetime", "segments": 2 }, { "ladder": "3 days > 7 days > 30 days", "segments": 2 } ], "tier_count_distribution": { "3": 9, "4": 1, "5": 3, "6": 4, "7": 1, "17": 1 } }, "account_seller_plan": { "distinct_texts": 22, "copies_in_sample": 23, "texts_with_one_tier": 4, "texts_with_two_or_more_tiers": 18, "share_of_distinct_texts_pct": { "has_trial": 11.1, "has_lifetime": 22.2, "renewal_wording": 0.0, "second_figure_on_a_tier": 5.6, "discount_wording": 11.1, "says_private": 55.6, "says_fresh_or_daily": 22.2, "says_valid": 5.6, "bot_or_auto_purchase": 0.0, "crypto_payment": 27.8, "support_line": 16.7, "free_sample_or_drop": 5.6 }, "by_set": { "c_combolist": 15, "c_botnet_log": 1, "k_combolist": 2, "c_search_breach_bots": 0 }, "per_day_logic": { "segments_with_3plus_core_tiers": 13, "per_day_falls_at_every_step": 11, "per_day_never_rises": 11, "median_ratio_longest_to_shortest_core_tier_per_day": 0.5, "ratio_p25_p75": [ 0.47, 0.58 ], "segments_with_30day_and_lifetime": 4, "median_lifetime_price_in_30day_prices": 4.2, "lifetime_to_30day_p25_p75": [ 3.3, 10.0 ] }, "commonest_period_ladders": [ { "ladder": "7 days > 14 days > 30 days > 90 days", "segments": 4 }, { "ladder": "7 days > 30 days > 90 days", "segments": 2 }, { "ladder": "7 days > 30 days", "segments": 2 }, { "ladder": "7 days > 21 days > 60 days > 150 days", "segments": 1 }, { "ladder": "7 days > 30 days > lifetime", "segments": 1 }, { "ladder": "3 days > 7 days > 30 days > lifetime", "segments": 1 } ], "tier_count_distribution": { "2": 4, "3": 4, "4": 7, "5": 3 } }, "other_plan": { "distinct_texts": 7, "copies_in_sample": 7, "texts_with_one_tier": 1, "texts_with_two_or_more_tiers": 6, "share_of_distinct_texts_pct": { "has_trial": 16.7, "has_lifetime": 50.0, "renewal_wording": 0.0, "second_figure_on_a_tier": 66.7, "discount_wording": 100.0, "says_private": 66.7, "says_fresh_or_daily": 66.7, "says_valid": 0.0, "bot_or_auto_purchase": 33.3, "crypto_payment": 0.0, "support_line": 50.0, "free_sample_or_drop": 0.0 }, "by_set": { "c_combolist": 0, "c_botnet_log": 6, "k_combolist": 0, "c_search_breach_bots": 0 }, "per_day_logic": { "segments_with_3plus_core_tiers": 4, "per_day_falls_at_every_step": 3, "per_day_never_rises": 4, "median_ratio_longest_to_shortest_core_tier_per_day": 0.32, "ratio_p25_p75": [ 0.32, 0.47 ], "segments_with_30day_and_lifetime": 2, "median_lifetime_price_in_30day_prices": 25.0, "lifetime_to_30day_p25_p75": [ 5.0, 25.0 ] }, "commonest_period_ladders": [ { "ladder": "7 days > 14 days > 30 days > 90 days > 365 days", "segments": 3 }, { "ladder": "lifetime", "segments": 1 }, { "ladder": "21 days > 30 days", "segments": 1 }, { "ladder": "7 days > 14 days > 30 days > 90 days > lifetime", "segments": 1 }, { "ladder": "7 days > 30 days > lifetime", "segments": 1 } ], "tier_count_distribution": { "3": 2, "5": 4 } } }, "per_day_note": "Per-day prices are computed by dividing a price as written by the days of its period. The posts never state them. Ratios compare tiers inside one ad; amounts are never pooled across ads or currencies." }, "repetition": { "definition": "Repeat key = normalised text with URLs, handles and digits removed (at least 25 characters). A cluster is the set of kept sampled posts of one set sharing a key; because only part of each window was fetched, repetition seen in the sample is a lower bound. Shared text does not show common ownership.", "kept_posts_repeated": { "c_combolist": { "kept_sampled_posts": 3776, "posts_with_text_over_24_chars": 3719, "share_in_repeated_clusters_pct": 4.8, "ci_low_pct": 4.0, "ci_high_pct": 5.7, "clusters_of_2plus": 79, "largest_cluster_sampled_posts": 4, "share_in_clusters_in_2plus_channels_pct": 1.0, "top10_clusters_share_pct": 0.86 }, "c_botnet_log": { "kept_sampled_posts": 1888, "posts_with_text_over_24_chars": 1856, "share_in_repeated_clusters_pct": 4.3, "ci_low_pct": 3.2, "ci_high_pct": 5.8, "clusters_of_2plus": 42, "largest_cluster_sampled_posts": 5, "share_in_clusters_in_2plus_channels_pct": 0.8, "top10_clusters_share_pct": 1.67 }, "k_combolist": { "kept_sampled_posts": 2810, "posts_with_text_over_24_chars": 2288, "share_in_repeated_clusters_pct": 3.8, "ci_low_pct": 2.9, "ci_high_pct": 5.0, "clusters_of_2plus": 64, "largest_cluster_sampled_posts": 4, "share_in_clusters_in_2plus_channels_pct": 1.4, "top10_clusters_share_pct": 1.66 }, "c_search_breach_bots": { "kept_sampled_posts": 859, "posts_with_text_over_24_chars": 849, "share_in_repeated_clusters_pct": 38.6, "ci_low_pct": 32.9, "ci_high_pct": 44.7, "clusters_of_2plus": 94, "largest_cluster_sampled_posts": 25, "share_in_clusters_in_2plus_channels_pct": 30.6, "top10_clusters_share_pct": 9.89 } }, "claims_repeated_vs_single": { "c_combolist": { "fresh": { "repeated": { "share_pct": 52.4, "low_pct": 42.1, "high_pct": 62.5, "n_posts": 131 }, "not_repeated": { "share_pct": 28.1, "low_pct": 25.9, "high_pct": 30.3, "n_posts": 2661 } }, "private": { "repeated": { "share_pct": 37.6, "low_pct": 28.2, "high_pct": 48.0, "n_posts": 131 }, "not_repeated": { "share_pct": 14.9, "low_pct": 13.2, "high_pct": 16.7, "n_posts": 2661 } }, "valid": { "repeated": { "share_pct": 34.3, "low_pct": 25.2, "high_pct": 44.6, "n_posts": 131 }, "not_repeated": { "share_pct": 14.0, "low_pct": 12.4, "high_pct": 15.8, "n_posts": 2661 } } }, "c_botnet_log": { "fresh": { "repeated": { "share_pct": 26.7, "low_pct": 16.5, "high_pct": 40.3, "n_posts": 80 }, "not_repeated": { "share_pct": 17.0, "low_pct": 14.5, "high_pct": 19.8, "n_posts": 1533 } }, "private": { "repeated": { "share_pct": 15.7, "low_pct": 8.1, "high_pct": 28.2, "n_posts": 80 }, "not_repeated": { "share_pct": 12.3, "low_pct": 10.1, "high_pct": 14.8, "n_posts": 1533 } }, "valid": { "repeated": { "share_pct": 7.4, "low_pct": 2.8, "high_pct": 18.0, "n_posts": 80 }, "not_repeated": { "share_pct": 4.7, "low_pct": 3.4, "high_pct": 6.4, "n_posts": 1533 } } }, "k_combolist": { "fresh": { "repeated": { "share_pct": 21.3, "low_pct": 12.6, "high_pct": 33.8, "n_posts": 118 }, "not_repeated": { "share_pct": 29.7, "low_pct": 26.0, "high_pct": 33.8, "n_posts": 1180 } }, "private": { "repeated": { "share_pct": 33.1, "low_pct": 22.2, "high_pct": 46.3, "n_posts": 118 }, "not_repeated": { "share_pct": 33.1, "low_pct": 29.2, "high_pct": 37.2, "n_posts": 1180 } }, "valid": { "repeated": { "share_pct": 24.2, "low_pct": 14.8, "high_pct": 37.0, "n_posts": 118 }, "not_repeated": { "share_pct": 22.8, "low_pct": 19.4, "high_pct": 26.6, "n_posts": 1180 } } }, "c_search_breach_bots": { "fresh": { "repeated": { "share_pct": 0.8, "low_pct": 0.0, "high_pct": 14.3, "n_posts": 30 }, "not_repeated": { "share_pct": 10.1, "low_pct": 2.5, "high_pct": 32.5, "n_posts": 48 } }, "private": { "repeated": { "share_pct": 0.0, "low_pct": 0.0, "high_pct": 13.0, "n_posts": 30 }, "not_repeated": { "share_pct": 7.1, "low_pct": 1.4, "high_pct": 28.9, "n_posts": 48 } }, "valid": { "repeated": { "share_pct": 0.0, "low_pct": 0.0, "high_pct": 13.0, "n_posts": 30 }, "not_repeated": { "share_pct": 4.9, "low_pct": 0.8, "high_pct": 25.9, "n_posts": 48 } } } }, "distinct_text_basis": { "basis": "Each distinct repeated text counted once (copies are not independent); texts not seen twice in the sample counted as posts. Offer posts only: chatter, channel promotion, bare pointers and lookup bots removed. Unweighted. Wilson 95% intervals computed on texts (repeated) and posts (not repeated). Source: read-only check saved with the repetition manuscript.", "sets": { "c_combolist": { "repeated_posts": 131, "distinct_repeated_texts": 57, "not_repeated_posts": 2661, "clusters_by_size": { "2": 42, "3": 13, "4": 2 }, "clusters_with_differing_claim_flags": 0, "claims": { "fresh": { "repeated_texts": { "share_pct": 49.1, "low_pct": 36.6, "high_pct": 61.7, "n": 57 }, "not_repeated_posts": { "share_pct": 25.9, "low_pct": 24.3, "high_pct": 27.6, "n": 2661 }, "stratified_difference_points": { "point": 21.3, "low": 7.2, "high": 34.2 } }, "private": { "repeated_texts": { "share_pct": 29.8, "low_pct": 19.5, "high_pct": 42.7, "n": 57 }, "not_repeated_posts": { "share_pct": 14.6, "low_pct": 13.3, "high_pct": 16.0, "n": 2661 }, "stratified_difference_points": { "point": 14.1, "low": 2.1, "high": 26.8 } }, "valid": { "repeated_texts": { "share_pct": 31.6, "low_pct": 21.0, "high_pct": 44.5, "n": 57 }, "not_repeated_posts": { "share_pct": 14.1, "low_pct": 12.8, "high_pct": 15.5, "n": 2661 }, "stratified_difference_points": { "point": 14.3, "low": 2.2, "high": 26.5 } } }, "strata": { "total": 42, "with_both_kinds": 12, "with_10plus_repeated_and_both": 5 } }, "c_botnet_log": { "repeated_posts": 80, "distinct_repeated_texts": 37, "not_repeated_posts": 1533, "clusters_by_size": { "2": 32, "3": 4, "4": 1 }, "clusters_with_differing_claim_flags": 0, "claims": { "fresh": { "repeated_texts": { "share_pct": 24.3, "low_pct": 13.4, "high_pct": 40.1, "n": 37 }, "not_repeated_posts": { "share_pct": 13.8, "low_pct": 12.2, "high_pct": 15.6, "n": 1533 }, "stratified_difference_points": { "point": -1.8, "low": -12.9, "high": 9.9 } }, "private": { "repeated_texts": { "share_pct": 13.5, "low_pct": 5.9, "high_pct": 28.0, "n": 37 }, "not_repeated_posts": { "share_pct": 15.1, "low_pct": 13.4, "high_pct": 16.9, "n": 1533 }, "stratified_difference_points": { "point": -10.8, "low": -21.0, "high": -0.2 } }, "valid": { "repeated_texts": { "share_pct": 8.1, "low_pct": 2.8, "high_pct": 21.3, "n": 37 }, "not_repeated_posts": { "share_pct": 5.4, "low_pct": 4.4, "high_pct": 6.7, "n": 1533 }, "stratified_difference_points": { "point": -1.8, "low": -8.5, "high": 6.2 } } }, "strata": { "total": 47, "with_both_kinds": 16, "with_10plus_repeated_and_both": 1 } }, "k_combolist": { "repeated_posts": 118, "distinct_repeated_texts": 49, "not_repeated_posts": 1180, "clusters_by_size": { "2": 37, "3": 4, "4": 8 }, "clusters_with_differing_claim_flags": 0, "claims": { "fresh": { "repeated_texts": { "share_pct": 30.6, "low_pct": 19.5, "high_pct": 44.5, "n": 49 }, "not_repeated_posts": { "share_pct": 31.5, "low_pct": 28.9, "high_pct": 34.2, "n": 1180 }, "stratified_difference_points": { "point": 0.8, "low": -11.7, "high": 13.4 } }, "private": { "repeated_texts": { "share_pct": 28.6, "low_pct": 17.8, "high_pct": 42.4, "n": 49 }, "not_repeated_posts": { "share_pct": 29.7, "low_pct": 27.1, "high_pct": 32.3, "n": 1180 }, "stratified_difference_points": { "point": -1.1, "low": -12.0, "high": 11.0 } }, "valid": { "repeated_texts": { "share_pct": 26.5, "low_pct": 16.2, "high_pct": 40.3, "n": 49 }, "not_repeated_posts": { "share_pct": 24.0, "low_pct": 21.6, "high_pct": 26.5, "n": 1180 }, "stratified_difference_points": { "point": 1.0, "low": -10.6, "high": 14.4 } } }, "strata": { "total": 39, "with_both_kinds": 13, "with_10plus_repeated_and_both": 3 } } } }, "size_signatures": { "distinct_signatures": 245, "seen_in_2plus_channels": 19, "seen_in_2plus_channels_and_2plus_months": 14 }, "limits": [ "Exact duplicates and template-bot near-duplicates are removed before 'kept', so repetition among kept posts understates repetition in the raw stream; removed_before_kept shows that part.", "Channel and actor identifiers are used only to count distinct channels inside clusters and are not published.", "Claim flags have precision 0.6-0.9 (precision.json); differences between repeated and single posts must be read with the intervals.", "Claim words are seller wording; they were not tested. Flag precision on hand-read samples is 46-94%." ] }, "exposure": { "definition": "Corporate flag: Office 365, Workspace, Okta, Azure/AWS, 'corp', business mail, EDU domains named in the post. MFA flag: explicit no-2FA / 2FA-disabled / OTP-bypass wording. Session form: cookies, tokens, session files. All are descriptors in the post, not tested properties.", "shares_among_kept_posts": { "c_combolist": { "corporate_or_saas_flag": { "share_pct": 3.4, "low_pct": 2.8, "high_pct": 4.2, "n_posts_sampled": 151 }, "mfa_claim_flag": { "share_pct": 1.3, "low_pct": 0.9, "high_pct": 1.8, "n_posts_sampled": 46 }, "session_cookie_token_form": { "share_pct": 4.5, "low_pct": 3.8, "high_pct": 5.5, "n_posts_sampled": 161 }, "saas_account_type": { "share_pct": 0.3, "low_pct": 0.2, "high_pct": 0.7, "n_posts_sampled": 13 } }, "c_botnet_log": { "corporate_or_saas_flag": { "share_pct": 0.6, "low_pct": 0.3, "high_pct": 1.4, "n_posts_sampled": 15 }, "mfa_claim_flag": { "share_pct": 0.6, "low_pct": 0.3, "high_pct": 1.3, "n_posts_sampled": 12 }, "session_cookie_token_form": { "share_pct": 16.5, "low_pct": 14.3, "high_pct": 19.1, "n_posts_sampled": 454 }, "saas_account_type": { "share_pct": 0.0, "low_pct": 0.0, "high_pct": 0.5, "n_posts_sampled": 2 } }, "k_combolist": { "corporate_or_saas_flag": { "share_pct": 5.1, "low_pct": 4.1, "high_pct": 6.5, "n_posts_sampled": 181 }, "mfa_claim_flag": { "share_pct": 0.3, "low_pct": 0.1, "high_pct": 0.7, "n_posts_sampled": 8 }, "session_cookie_token_form": { "share_pct": 0.3, "low_pct": 0.1, "high_pct": 0.8, "n_posts_sampled": 6 }, "saas_account_type": { "share_pct": 0.3, "low_pct": 0.1, "high_pct": 0.8, "n_posts_sampled": 14 } }, "c_search_breach_bots": { "corporate_or_saas_flag": { "share_pct": 0.0, "low_pct": 0.0, "high_pct": 1.5, "n_posts_sampled": 0 }, "mfa_claim_flag": { "share_pct": 0.0, "low_pct": 0.0, "high_pct": 1.5, "n_posts_sampled": 0 }, "session_cookie_token_form": { "share_pct": 0.2, "low_pct": 0.0, "high_pct": 1.8, "n_posts_sampled": 3 }, "saas_account_type": { "share_pct": 0.0, "low_pct": 0.0, "high_pct": 1.5, "n_posts_sampled": 0 } } }, "hand_label_counts": { "c_botnet_log": { "n": 160, "corporate_flag": 3, "mfa_flag": 0, "session_cookie_form": 29, "saas_account_type": 3 }, "c_combolist": { "n": 80, "corporate_flag": 0, "mfa_flag": 1, "session_cookie_form": 1, "saas_account_type": 1 } }, "flag_precision_by_sample": { "corporate": { "dev": { "n_pred": 5, "tp": 3, "precision_pct": 60.0 }, "eval": { "n_pred": 7, "tp": 5, "precision_pct": 71.4 }, "eval2": { "n_pred": 6, "tp": 4, "precision_pct": 66.7 }, "eval3": { "n_pred": 6, "tp": 2, "precision_pct": 33.3 } }, "mfa": { "dev": { "n_pred": 3, "tp": 0, "precision_pct": 0.0 }, "eval": { "n_pred": 2, "tp": 1, "precision_pct": 50.0 }, "eval2": { "n_pred": 3, "tp": 3, "precision_pct": 100.0 }, "eval3": { "n_pred": 1, "tp": 0, "precision_pct": 0.0 } } }, "verdict": "Corporate/SaaS naming and explicit no-2FA wording are rare in the kept posts of these sets (see shares and n). The session-cookie form is common but mostly buy-side submission sheets and bulk session files for consumer platforms. The counts are too small and the classifier precision for the flags too low (corporate 0.33-0.67, mfa under 10 true cases) to support a stand-alone corporate/session-exposure article; use as a short qualified paragraph." }, "overlap": { "combolist_sample_also_botnet_log": { "sample_share_pct": 0.81, "weighted_share_pct": 0.86, "sample_base": 14867 }, "botnet_log_sample_also_combolist": { "sample_share_pct": 0.82, "weighted_share_pct": 0.52, "sample_base": 14832 }, "botnet_log_stealer_name_in_text": { "sample_share_pct": 5.18, "weighted_share_pct": 8.24, "sample_base": 14832 }, "combolist_stealer_name_in_text": { "sample_share_pct": 0.11, "weighted_share_pct": 0.11, "sample_base": 14867 }, "botnet_log_initial_access_label": { "sample_share_pct": 0.25, "weighted_share_pct": 0.12, "sample_base": 14832 }, "combolist_initial_access_label": { "sample_share_pct": 0.04, "weighted_share_pct": 0.03, "sample_base": 14867 }, "botnet_log_financial_account_label": { "sample_share_pct": 0.94, "weighted_share_pct": 0.33, "sample_base": 14832 }, "combolist_financial_account_label": { "sample_share_pct": 0.69, "weighted_share_pct": 0.49, "sample_base": 14867 }, "combolist_search_breach_bots_label": { "sample_share_pct": 0.33, "weighted_share_pct": 0.36, "sample_base": 14867 }, "botnet_log_search_breach_bots_label": { "sample_share_pct": 0.16, "weighted_share_pct": 0.13, "sample_base": 14832 }, "note": "All fetched posts of the new pull, all months. A post found under two labels is counted once in each set. Stealer-name keywords are a text match, not attribution." }, "precision": { "classifier": "Rule-based; reads form, commercial mode, account type, claim flags and price units. Used for price units, repetition claim words, exposure flags and the extra views. Composition headline shares use hand labels instead.", "headline_sample": "eval2", "samples": { "dev": { "role": "Development sample: rules were written and tuned here; numbers are optimistic.", "n_posts": 240, "accuracy": { "form": { "value_pct": 87.1, "low_pct": 82.2, "high_pct": 90.7 }, "form_group": { "value_pct": 89.6, "low_pct": 85.1, "high_pct": 92.8 }, "mode": { "value_pct": 90.0, "low_pct": 85.6, "high_pct": 93.2 }, "mode_group": { "value_pct": 93.3, "low_pct": 89.4, "high_pct": 95.9 }, "acct": { "value_pct": 85.8, "low_pct": 80.9, "high_pct": 89.7 } } }, "eval": { "role": "First evaluation: blind hand labels; later numbers are second-round after rule changes.", "n_posts": 304, "accuracy": { "form": { "value_pct": 71.4, "low_pct": 66.1, "high_pct": 76.2 }, "form_group": { "value_pct": 76.3, "low_pct": 71.2, "high_pct": 80.7 }, "mode": { "value_pct": 74.7, "low_pct": 69.5, "high_pct": 79.2 }, "mode_group": { "value_pct": 79.6, "low_pct": 74.7, "high_pct": 83.8 }, "acct": { "value_pct": 74.0, "low_pct": 68.8, "high_pct": 78.6 } } }, "eval2": { "role": "Clean evaluation: drawn after the rules were frozen. The number to quote.", "n_posts": 256, "accuracy": { "form": { "value_pct": 69.9, "low_pct": 64.0, "high_pct": 75.2 }, "form_group": { "value_pct": 74.2, "low_pct": 68.5, "high_pct": 79.2 }, "mode": { "value_pct": 72.7, "low_pct": 66.9, "high_pct": 77.8 }, "mode_group": { "value_pct": 78.1, "low_pct": 72.7, "high_pct": 82.8 }, "acct": { "value_pct": 70.7, "low_pct": 64.9, "high_pct": 75.9 } } }, "eval3": { "role": "New-pull hand labels (the headline source for shares); rules v2 were tuned on it, so classifier accuracy here is optimistic.", "n_posts": 240, "accuracy": { "form": { "value_pct": 63.7, "low_pct": 57.5, "high_pct": 69.6 }, "form_group": { "value_pct": 70.4, "low_pct": 64.4, "high_pct": 75.8 }, "mode": { "value_pct": 60.8, "low_pct": 54.5, "high_pct": 66.8 }, "mode_group": { "value_pct": 72.5, "low_pct": 66.5, "high_pct": 77.8 }, "acct": { "value_pct": 63.7, "low_pct": 57.5, "high_pct": 69.6 } } } }, "eval2_form_group_labels": [ { "label": "checker_config_tool", "n_true": 17, "n_pred": 17, "precision_pct": 76.5, "recall_pct": 76.5 }, { "label": "credential_files_and_pointers", "n_true": 83, "n_pred": 77, "precision_pct": 81.8, "recall_pct": 75.9 }, { "label": "logs_and_clouds", "n_true": 8, "n_pred": 8, "precision_pct": 37.5, "recall_pct": 37.5 }, { "label": "lookup_search_bots", "n_true": 54, "n_pred": 53, "precision_pct": 94.3, "recall_pct": 92.6 }, { "label": "not_an_offer_or_other", "n_true": 29, "n_pred": 40, "precision_pct": 32.5, "recall_pct": 44.8 }, { "label": "single_accounts_and_cookies_and_bank_logs", "n_true": 65, "n_pred": 61, "precision_pct": 78.7, "recall_pct": 73.8 } ], "label_policy": "A class is reported on its own in public text only if its precision on eval2 is at least 0.70 with n_pred >= 10; weaker classes are merged into groups or reported as 'not separable'.", "rows_csv": "precision.csv", "note": "Single classes below 0.70 precision (stealer-log clouds 37.5%, not-an-offer group 32.5% on eval2) are not reported on their own from the classifier." }, "sampling": { "c_combolist": { "windows": 48, "max_window_days": 7, "windows_with_5_pages": 28, "windows_with_8_pages": 20, "complete_windows": 0, "sampled_windows": 48, "source": "new_pull", "monthly_sample_min": 960, "monthly_sample_max": 2000 }, "c_botnet_log": { "windows": 48, "max_window_days": 7, "windows_with_5_pages": 28, "windows_with_8_pages": 20, "complete_windows": 0, "sampled_windows": 48, "source": "new_pull", "monthly_sample_min": 965, "monthly_sample_max": 2000 }, "k_combolist": { "windows": 48, "max_window_days": 7, "windows_with_5_pages": 0, "windows_with_8_pages": 0, "complete_windows": 26, "sampled_windows": 22, "source": "foundation_raw" }, "c_search_breach_bots": { "windows": 48, "max_window_days": 7, "windows_with_5_pages": 0, "windows_with_8_pages": 0, "complete_windows": 0, "sampled_windows": 48, "source": "foundation_raw" }, "page_size": 50 }, "band_anomaly": { "set_id": "c_botnet_log", "month": "2026-01", "foundation_estimate": 6631, "foundation_band_low": 12318, "foundation_band_high": 18552, "foundation_unweighted_kept_share_pct": 15.4, "foundation_weighted_kept_share_pct": 6.7, "new_unweighted_kept_share_pct": 12.6, "new_weighted_kept_share_pct": 5.4, "new_pooled_unweighted_band_low": 11028, "new_pooled_unweighted_band_high": 13928, "new_estimate": 5322, "new_bootstrap_band_low": 4398, "new_bootstrap_band_high": 6458, "foundation_cells_with_estimate_outside_band": 8 }, "method_figures": { "stable_panel_channels": 300, "bootstrap_draws": 1000, "hand_label_bootstrap_draws": 1000, "claim_flag_precision_min_pct": 46.4, "claim_flag_precision_max_pct": 94.1, "unit_accuracy_min_pct": 49.0, "unit_accuracy_max_pct": 73.9 }, "taxonomy_break": { "months": [ "2026-05", "2026-06", "2026-07" ], "applies_to": [ "c_combolist", "c_botnet_log", "c_search_breach_bots" ], "statement": "The platform changed its class labels around May-July 2026. Class sets must not be compared across that window, and no trend is read across it. The keyword set is not affected by the label change but is affected by coverage shifts." }, "caveats": [ "These are collected posts in saved Blackhole queries, not offers, sellers, victims, transactions or a market total.", "Telegram dominates the collection; forum coverage is small (forum share of kept posts by month shown in observed-records.csv).", "Counts are estimates from random pages of up to 50 posts per window. Monthly bands cover sampling only, not classifier error, October back-fill or the label change.", "Class labels changed around May-July 2026. No trend across that window is claimed. October ends on 27 October.", "Raw label counts are dominated by automated posting; raw-to-cleaned ratios say how much of the stream is removed, not how much supply exists.", "Hand labels come from one AI labeller blind to the classifier. A second AI reader re-labelled 50 posts blind (form-group agreement 94.0%, kappa 0.90); this is a cross-check, not a human audit. Intervals show sampling error only.", "Prices are advertised terms; units differ by product form and are never pooled, averaged or converted.", "Shared text across posts does not show common ownership; claim words (fresh, private, valid) are seller wording, not tested properties.", "Corporate/SaaS naming and no-2FA wording are rare and flagged with low precision; they support one qualified sentence, not a stand-alone claim.", "Actor and channel counts are not people. No global market, loss or capability claim is made. Brandefense analysts approved the findings." ], "findings": [ { "id": "raw-to-kept", "title": "6.4% of raw Botnet Log posts remain after cleaning.", "text": "Raw posts carrying the Combolist and Botnet Log labels shrink to 18.5% and 6.4% once noise, template bots, mirrors, off-topic text and duplicates are removed.", "limit": "Raw counts measure automated posting at least as much as offers; they are not supply." }, { "id": "cleaned-volume", "title": "About 115,032 cleaned Combolist-class posts and 66,979 Botnet Log-class posts.", "text": "Estimated cleaned posts, 1 January to 27 October 2026, sum of monthly estimates with monthly sampling bands in observed-records.csv.", "limit": "Collected posts, not offers or sellers. Class labels changed in May-July; no comparison across it." }, { "id": "botnet-composition", "title": "Bank-account listings lead what the Botnet Log label holds (23.8%).", "text": "In 160 hand-read posts, bank-account listings and requests are 23.8% (17.1-31.1); stealer-log clouds offered for sale or access are 6.3% (2.6-10.4), 7.4% on the broad reading; all are weighted estimates. Unweighted, strict clouds are 9 of 160 posts (5.6%).", "limit": "One AI labeller; sampling interval only." }, { "id": "price-units", "title": "Combolist sale posts more often name an access period than a line count (160 of 301 posts that state an amount).", "text": "Among 301 sampled bulk-combolist sale or access posts that state an amount, 160 name an access period and 5 price per lines; 129 give no unit.", "limit": "Unweighted posts; unit extractor 49-74% accurate on checked posts; amounts never pooled." }, { "id": "repetition-claims", "title": "Repeated Combolist texts say \"fresh\" more often (49.1% vs 25.9%).", "text": "131 repeated offer posts are 57 distinct texts. Counting each text once, they say \"private\" in 29.8% against 14.6%, and \"valid\" in 31.6% against 14.1%.", "limit": "Seller wording, not tested; repeated posts are 4.8% of kept Combolist posts (lower bound)." }, { "id": "band", "title": "An earlier band for these sets was wrong; this package replaces it.", "text": "The earlier January Botnet Log band (12,318-18,552) sat above its own estimate (6,631).", "limit": "Method note, not a finding about the underground." } ], "assets": { "data_json": "stolen-credentials-data.json", "observed_records_csv": "observed-records.csv", "composition_csv": "composition.csv", "price_unit_summary_csv": "price-unit-summary.csv", "subscription_tiers_summary_csv": "subscription-tiers-summary.csv", "buyside_structure_csv": "buyside-structure.csv", "repetition_claims_csv": "repetition-claims.csv", "repetition_share_csv": "repetition-share.csv", "exposure_flags_csv": "exposure-flags.csv", "retrieval_windows_csv": "retrieval-windows.csv", "precision_csv": "precision.csv", "offer_catalog_html": "offer-catalog.html", "offer_catalog_json": "offer-catalog.json", "offer_catalog_csv": "offer-catalog.csv", "offer_price_terms_csv": "offer-price-terms.csv", "offer_validation_json": "offer-validation.json", "methodology": "methodology.html", "dictionary": "data-dictionary.html", "license": "license.html", "qa": "qa.json", "privacy_scan": "privacy-scan.json", "charts": [ { "id": "raw-vs-cleaned", "title": "Raw posts and cleaned posts measure different things", "svg": "chart-raw-vs-cleaned.svg", "png": "chart-raw-vs-cleaned.png", "alt": "Monthly raw total (exact) and cleaned estimate for the Combolist and Botnet Log class labels. Combolist: raw peak 163,728 in February, cleaned estimate 5,453 to 18,206 per month. Botnet Log: raw peak 283,989 in March, cleaned estimate 4,796 to 8,967 per month. Class labels changed between May and July; bars across the shaded months must not be compared." }, { "id": "botnet-log-composition", "title": "What a \"Botnet Log\" label holds", "svg": "chart-botnet-log-composition.svg", "png": "chart-botnet-log-composition.png", "alt": "What the Botnet Log label holds, hand labels of 160 kept posts, weighted shares: Bank-account listings and requests 23.8 percent (17.1 to 31.1); Game-account lots 21.3 percent (15.1 to 28.0); Buy-side account or cookie submissions 17.0 percent (11.1 to 23.0); Not an offer (replies, chatter, notices) 11.3 percent (6.6 to 16.7); Stealer-log clouds for sale or access (strict) 6.3 percent (2.6 to 10.4); Tools, bots and service menus 4.8 percent (1.5 to 8.9); Credential files, samples and pointers 4.6 percent (1.4 to 8.4); Other accounts and cookies for sale 4.4 percent (1.4 to 8.4); \"Log\" posts with no identifiable product 3.1 percent (0.7 to 6.2); Wanted posts for logs or credential files 2.3 percent (0.0 to 5.4); Promotions and notices of such clouds 1.2 percent (0.0 to 3.1). Strict clouds 6.3 percent; broad reading 7.4 percent; first label 12.0 percent. Intervals are 95 percent stratified bootstrap." }, { "id": "price-units", "title": "A credential \"price\" is not one unit", "svg": "chart-price-units.svg", "png": "chart-price-units.png", "alt": "Sampled posts that state an amount, by the unit named (posts, not amounts; one post can name several units). Bulk-combolist sale or access posts: 301 state an amount, 160 name an access period, 5 price per lines, 129 give no unit. Cookie buy-side rates are mostly per item. Amounts are never pooled." }, { "id": "repeated-claims", "title": "Reposted texts claim \"fresh\", \"private\" and \"valid\" more often", "svg": "chart-repeated-claims.svg", "png": "chart-repeated-claims.png", "alt": "Share of Combolist offer posts using each claim word: repeated texts (57 distinct texts, 131 posts) versus posts whose text was not seen twice (n=2,661), 95 percent intervals: fresh 49.1 percent (36.6 to 61.7) versus 25.9 percent (24.3 to 27.6); private 29.8 percent (19.5 to 42.7) versus 14.6 percent (13.3 to 16.0); valid 31.6 percent (21.0 to 44.5) versus 14.1 percent (12.8 to 15.5). Claim words are seller wording, not tested." } ], "social": { "cover": "social-cover.png", "composition": "social-composition.png", "units": "social-units.png", "repetition": "social-repetition.png" }, "report_cover": "stolen-credentials-report-cover.png" }, "ai_disclosure": "Why AI agents. Brandefense Blackhole, our cybercrime database, collects around 17 to 23 million dark web and Telegram posts a month. Reading that volume by hand, and linking a recruitment ad on one forum to a leak-site claim on another and a price list in a Telegram channel weeks later, is beyond what a human team can do alone. Claude Opus 5.5 prepared the research: it searched the data, sorted and translated posts and drafted the text. Codex Astra then checked every number against the dataset files and tested each claim, and anything that did not hold was removed. Brandefense analysts reviewed and approved the findings.", "byline": "Brandefense Research Team · Brandefense Blackhole data · Prepared by Claude Opus 5.5, checked by Codex Astra and approved by Brandefense analysts.", "license": "CC BY 4.0 for original aggregates, charts and editorial paraphrases; raw source content is excluded.", "attribution": "Source: Brandefense Research Team, Stolen Accounts, Botnet Logs & Combolists, 2026, v1.0. Data: Brandefense Blackhole, 1 Jan-27 Oct 2026. Collected posts, not offers or a market total." }