TeleHunt: A Framework and Tool for Efficient Cybercriminal Community Discovery on Telegram
For cybersecurity researchers, it provides the first systematic comparison of Telegram discovery strategies and a large labeled dataset, though the approach is incremental.
TeleHunt is a framework for discovering cybercriminal communities on Telegram using reference-driven snowballing strategies. It evaluates seed source, pointer type, and exploration strategy, producing a labeled dataset of over 172 million messages from 6,022 communities.
This paper presents TeleHunt, a framework and tool for evaluating the effectiveness of different strategies to discover cybercriminal communities on Telegram. TeleHunt employs a set of reference-driven snowballing strategies, integrating message-level classification, contextual filtering, and market-segment labeling. Using open- and dark-web seeds, we systematically evaluate how seed source, pointer type, and exploration strategy influence discovery outcomes in three dimensions: efficiency, accessibility, and rediscovery. Our work provides (i) a modular cybercrime content discovery pipeline, (ii) the first systematic comparison of Telegram discovery strategies with an empirical characterization of market-segment accessibility, and (iii) a labeled dataset of over 172 million messages from 6,022 Telegram communities.