Most dark web activity revolves around a handful of topics

Dark web activity often becomes visible during marketplace seizures, major data leaks, or sudden spikes in criminal activity. Those events can create an impression of an ecosystem where attention shifts quickly and new trends regularly replace old ones.

A six-year dataset covering more than 25,000 dark web sites tracked what people discussed in underground forums and marketplaces and how those discussions changed over time. The work drew from more than 11 million archived snapshots collected between 2020 and 2026.

The topics that dominated discussion

Discussion activity fell into four broader categories: community activity, transactions, infrastructure, and products.

Community discussions covered coordination, information sharing, and interaction among participants. Transactional topics focused on financial exchange, payment mechanisms, transaction security, and related processes. Infrastructure topics included technical and operational components, such as tools and supporting technologies. Product-related discussions covered the trade of illicit goods and services.

Community and transactional discussions together accounted for most observed discussion volume during the study period, while infrastructure and product-related topics represented smaller portions of the dataset.

File-sharing discussions represented the largest individual topic identified in the dataset. Other highly active discussion areas included forum reputation systems, forum functions, online shopping activity, banking-related discussions, database-related activity, and infrastructure services.

Activity also differed between platforms. Topics including “Forum Reputation,” “Forum Features,” and “Forum Security” appeared more prominently in forums, while online shopping activity, stolen bank and payment accounts, and forged document services showed stronger representation within marketplaces.

A small number of themes drove most activity

Activity also remained concentrated around a limited number of themes.

All 55 final topic groups identified during the research were classified as recurring or continuous topics. No final topic cluster appeared only once during the observation window.

The researchers noted that discussion activity remained concentrated within a small number of dominant themes.

Topics remained active for years

Topic lifespan measurements also showed long periods of activity among identified themes. The median topic lifespan reached 75 months, indicating gradual thematic evolution rather than abrupt replacement.

“Even the shortest lived grouped topics remain active for at least two years. This indicates that thematic change in cybercrime ecosystems rarely takes the form of abrupt emergence and disappearance,” researchers added.

Among topics that disappeared before the final observed period, the mean time between peak activity and last observed activity reached 28 months. Researchers stated that declining topics generally faded over multiple periods rather than disappearing immediately.