A Bulletproof Business? Towards Detecting Infrastructure-as-a-Service Offerings on Telegram
Researchers detect cybercrime infrastructure-as-a-service ads across more than one million Telegram messages.
The paper introduces a taxonomy for Telegram messages advertising cybercriminal infrastructure-as-a-service, with six categories spanning compute, network, and communication services and trust attributes for Bulletproof hosting, payment security, and transparency. After testing keyword, TF-IDF, and exploratory LLM classifiers on 261 annotated messages, the authors apply TF-IDF to 1,116,071 messages from 167 communities. It assigns an infrastructure category to 207,244 messages (18.57%) across 113 communities; one community accounts for 50.3% of positives, and Bulletproof claims appear in 37.66% of them.
- Taxonomy covers six infrastructure categories and three trust attributes.
- TF-IDF labeled 207,244 of 1,116,071 messages, or 18.57 percent.
- One community accounted for 50.3 percent of positive messages.
- Bulletproof claims appeared in 37.66 percent of those ads.
Full article161 words · extracted from arxiv.org · click to collapse
Cybercriminal operations increasingly depend on reusable digital infrastructure---including hosting, proxies, and virtual private networks (VPNs)---rented through Cybercrime-as-a-Service markets and advertised on platforms such as Telegram. We present a taxonomy for identifying Telegram messages advertising cybercriminal Infrastructure-as-a-Service (IaaS). The taxonomy comprises six service categories across compute, network, and communication infrastructure, together with three trust attributes: Bulletproof, Payment Security, and Transparency. Using 261 human-annotated messages, we evaluate keyword-based and TF--IDF classifiers and examine prompt-based large language models as exploratory baselines. We select a TF--IDF pipeline and apply it to 1,116,071 messages from 167 cybercrime-related Telegram communities. The pipeline assigns at least one infrastructure category to 207,244 messages (18.57%) spanning 113 communities. Classified advertising is highly concentrated: a single community accounts for 50.3% of infrastructure-positive messages, while the trust-attribute classifiers identify Bulletproof claims in 37.66% of those messages. These findings characterize the scale, composition, and concentration of infrastructure advertising on Telegram and can inform the prioritization of communities and actors for monitoring and investigation.
Text extracted automatically; images, tables and formatting may be missing. Original: https://arxiv.org/abs/2609.27428