{"ID":3050141,"CreatedAt":"2026-06-04T02:13:16.786527022Z","UpdatedAt":"2026-06-06T08:58:50.400332682Z","DeletedAt":null,"paper_url":"https://arxiv.org/abs/2606.04657","arxiv_id":"2606.04657","title":"TeleHunt: A Framework and Tool for Efficient Cybercriminal Community Discovery on Telegram","abstract":"This paper presents TeleHunt, a framework and tool for evaluating the effectiveness of different strategies to discover cybercriminal communities on Telegram. TeleHunt employs a set of reference-driven snowballing strategies, integrating message-level classification, contextual filtering, and market-segment labeling. Using open- and dark-web seeds, we systematically evaluate how seed source, pointer type, and exploration strategy influence discovery outcomes in three dimensions: efficiency, accessibility, and rediscovery. Our work provides (i) a modular cybercrime content discovery pipeline, (ii) the first systematic comparison of Telegram discovery strategies with an empirical characterization of market-segment accessibility, and (iii) a labeled dataset of over 172 million messages from 6,022 Telegram communities.","short_abstract":"This paper presents TeleHunt, a framework and tool for evaluating the effectiveness of different strategies to discover cybercriminal communities on Telegram. TeleHunt employs a set of reference-driven snowballing strategies, integrating message-level classification, contextual filtering, and market-segment labeling. U...","url_abs":"https://arxiv.org/abs/2606.04657","url_pdf":"https://arxiv.org/pdf/2606.04657v1","authors":"[\"Roy Ricaldi\",\"Victor Asanache\",\"Luca Allodi\"]","published":"2026-06-03T09:31:58Z","proceeding":"cs.CR","tasks":"[\"cs.CR\"]","methods":"[\"LoRA\"]","has_code":false}