TeleHunt: A Framework and Tool for Efficient Cybercriminal Community Discovery on Telegram
2026-06-03 • Cryptography and Security
Cryptography and Security
AI summaryⓘ
The authors created TeleHunt, a tool that helps find groups involved in cybercrime on Telegram by testing different search methods. They used starting points from both open and dark web sources and checked how these affect finding communities based on how fast, accessible, and repeatable the searches are. Their study includes a flexible method for discovering cybercrime content, a detailed comparison of search strategies on Telegram, and a large labeled dataset of messages from thousands of groups. This work helps to better understand how to identify cybercriminal activity on messaging platforms.
Telegramcybercriminal communitiessnowballing strategiesmessage classificationdark webcontent discoverymarket segmentationsocial media analysisdata labeling
Authors
Roy Ricaldi, Victor Asanache, Luca Allodi
Abstract
This paper presents TeleHunt, a framework and tool for evaluating the effectiveness of different strategies to discover cybercriminal communities on Telegram. TeleHunt employs a set of reference-driven snowballing strategies, integrating message-level classification, contextual filtering, and market-segment labeling. Using open- and dark-web seeds, we systematically evaluate how seed source, pointer type, and exploration strategy influence discovery outcomes in three dimensions: efficiency, accessibility, and rediscovery. Our work provides (i) a modular cybercrime content discovery pipeline, (ii) the first systematic comparison of Telegram discovery strategies with an empirical characterization of market-segment accessibility, and (iii) a labeled dataset of over 172 million messages from 6,022 Telegram communities.