Crime VIP: A Closed-Access Underground Hacking Forum

Abstract

We present XIN, the dataset of a closed-access Russian-English underground hacking forum. It contains a collection ≈1.3M posts from over 20 years (Feb 2005-Aug 2025), and - to the best of our knowledge - is the largest collection of a closed-access underground hacking forum available for research. While there is a wide range of underground forum datasets available, there is a lack of non-English forums, and especially closed-access forums. Those are particularly challenging to crawl as the access is gated. Hence, a limited few-shot opportunity requires extreme care when crawling to avoid detection, which leads to account banning. Our stealthy data collection spanned 5 years (2020-2025). The statistical analysis of our data mirrors how cybercrime gradually shifted from technical, hands-on hacking to an industry where different building blocks can be assembled and applied in the absence of a broad or profound technical understanding. This dataset will contribute to a more complete evaluation of the cybercriminal landscape, shedding light on the activity that happens in closed-door, non-English communities.