Topical Shifts in the Dark Web: A Longitudinal Analysis of Content from the Cybercrime Ecosystem
For cybersecurity researchers, this provides the first large-scale longitudinal mapping of dark web topic evolution, revealing gradual thematic shifts rather than abrupt changes.
This study analyzes 11.4 million dark web snapshots over six years, finding that 75% of discussion volume concentrates in persistent core topics with a median lifespan of 75 months, while short-lived themes account for only 3% of activity.
The dark web hosts a dynamic ecosystem of cybercrime forums and marketplaces that adapt to law enforcement pressure, technological change, and economic incentives. Prior research has extracted cyber threat intelligence from these platforms using static snapshots, with limited attention to how discussions evolve over time. In this study, we conduct a longitudinal analysis of 25,065 websites in the dark web using 11,403,638 HTML snapshots (approximately 1245.38 GB) collected over six years. We develop a longitudinal topic-modeling framework combining domain-specific embeddings, density-based clustering and temporal aggregation to measure topic prevalence and lifecycle at the website level. Our analysis identifies 55 thematic clusters. We find that approximately 75% of total discussion volume is concentrated in a small set of persistent core topics, while short-lived themes account for approximately 3% of activity. The median topic lifespan is 75 months, indicating gradual thematic evolution rather than abrupt replacement.