-
A six-year dataset covering more than 25,000 dark web sites and 11 million archived snapshots tracked underground discussion patterns from 2020 to 2026.
-
Community and transactional topics dominated observed activity, with file-sharing topics representing the single largest identified category.
-
Researchers found that dark web topics rarely disappear quickly, with a median lifespan of 75 months and declining themes fading gradually over an average of nearly two and a half years.
Activities on the dark web often blow open to the public when marketplaces get seized, during huge data leaks, or unexpected surges in nefarious operations.
Those events create the impression of a fast-moving ecosystem where trends replace each other constantly and attention shifts without warning. A six-year study now challenges that picture.
Researchers compiled a dataset covering more than 25,000 dark web sites and tracked what people actually discussed in underground forums and marketplaces over time. The team pulled out from over 11 million snapshots from archives gathered from 2020 to 2026.
Their findings pointed to a more structured, stable environment than most observers expect, one where a small number of recurring themes drive the vast majority of activity.
Underground Forums Follow Predictable Patterns
The research organized all observed discussion activity into four extensive classes: community activity, infrastructure, transactions, and products.
Community discussions covered coordination, information sharing, and general interaction between participants. Transactional topics focused on financial exchange, payment mechanisms, and the security of those transactions.
Infrastructure topics covered the technical and operational components that support underground operations, including tools and supporting technologies. Product-associated topics looked into the peddling of bad services and goods across forums and marketplaces.
Topics on transactions and community activities together recorded the largest share of observed volume during the study period. Infrastructure and product-related discussions represented minute volumes of the overall dataset.
At the individual topic level, file-sharing topics stood out as the single largest category identified. Other highly active areas included forum reputation systems, forum features, online shopping activity, banking-related discussions, database activity, and infrastructure services.
The type of platform also shaped which topics rose to the top. Forums concentrated activity around reputation, features, and security. Marketplaces showed a heavier focus on online shopping, stolen banking and payment credentials, and forged document services.
Researchers identified 55 final topic groups across the entire dataset, and every one of them qualified as a recurring or continuous topic. Not a single group appeared only once during the observation window. The data also showed that activity did not spread evenly across those 55 groups. A small number of dominant themes captured the bulk of participation throughout the study period.
Dark Web Topics Last Far Longer Than Expected
The lifespan data produced some of the study’s most striking findings.
The mid-range of topic lifespan across the dataset was up to 75 months. According to the researchers, even the grouped topics with the shortest lifespan stayed active for a minimum of two years. They described thematic change within cybercrime ecosystems as a gradual process, one that rarely takes the form of sudden emergence followed by equally sudden disappearance.
Among topics that did decline before the final observation period, the team measured the average gap between peak activity and the last recorded instance of that topic. The figure came out to 28 months. Declining topics, the researchers found, typically faded across multiple observation periods rather than vanishing from one window to the next.
The sale of stolen data is one of those persistent topics. A recent dark web listing offers 41 million telecom records from the US and Europe, demonstrating how the trade in personal information continues year after year.
What this Means for the Security Community
The persistence and concentration of dark web activity carry significant implications for the organizations and researchers working against cybercrime.
Recurring and predictable themes give law enforcement agencies, security teams, and researchers a more reliable foundation for long-term monitoring. Stable patterns are easier to track consistently, and they make it harder for criminal actors to obscure behavioral shifts behind surface-level noise.
The study also challenges the common assumption that dark web ecosystems reinvent themselves frequently. Criminal communities, not unlike any other online communities, tend to organize around stable, recurring interests. Disrupting those interests requires sustained effort rather than reactive responses to isolated incidents.
For the broader public, the findings confirm a straightforward point. The underground economy trading in stolen data, credentials, and forged documents is not a temporary or erratic phenomenon. It is a structured, persistent system, and understanding how it operates remains the first step toward building more effective defenses.
