Refunder Ecosystem Analysis Dataset
Description
This dataset preserves online forum discussions from cybercriminal communities focused on 'refunding' -- defrauding online retailers by making false claims against their refunds and returns policies. The communities covered include both 'refund-as-a-service' providers, who offer their expertise in manipulating retailer policies to paying customers in return for a share of the profit, and also 'DIY' refunder communities who share tips and strategies openly. Data is drawn from the refunding-specific boards of the cybercrime forums nulled.to (collected 2024-10-22) and cracked.io (collected 2024-11-05) as well as from Telegram communities linked from those forums (collection ends 2024-12-09). All communications were publicly accessible. In total, the dataset extends to 494,267 posts spread over 3,306 threads/channels. The data for each source is structured as CSV files, with message content recorded within the posts.csv file in each extracted tarball. For the Nulled and Cracked forum data, summary CSV files provide an overview of threads and users, based on public forum information. Also for the Nulled and Cracked forum data, the posts.csv file contains a column 'raw', which preserves the raw HTML content of a post, to accompany the readable text presented in the 'body' column. As many posts within the data are not analytically meaningful (short threads containing little to no discussion, vendors 'bumping' their thread by repeating advertisements for their services, or Telegram bots repeating generic service information) a filtered subset of the data was produced, collecting data across sources. This dataset deduplicates repeated posts, and samples only those threads/channels with (1) more than 3 users contributing and (2) more than ten total messages (once deduplicated). This richer data subset is presented in the filtered_posts.csv file, and extends to 128,356 posts spread over 980 threads/channels. Across all sources, the dataset uses a column to refer to images captured in data collection. These images serve a variety of purposes, from advertisement banners for vendors to screenshots demonstrating that refund attempts were successful. The full image data collection is larger than the repository storage limits for Mendeley Data: please contact the data owner if you wish to make use of image data in your analysis, or if your analysis requires access to unprocessed forms of the originally collected data.
Files
Steps to reproduce
Web forum data (Nulled and Cracked) was collected through the instrumentation of a custom web-crawler, targeted specifically at the refunding boards of these forums. Raw page data was preserved and then parsed to produce a structured representation. Links from these boards to Telegram channels were then extracted and manually filtered to include only publicly-accessible channels linked to refunding activity, and Telegram channel data was then collected via the Telegram API, which permits the export of channel histories for public channels. The raw Telegram JSON exports were preserved, and transformed into a CSV representation. This data collection process and release was approved by the University of Bristol Research Ethics Board (Reference: 2024-21774-23830)
Institutions
- University of BristolEngland, Bristol