If you built your picture of the cybercrime economy from forum monitoring alone, you would conclude that most listings never sell. The thread gets three replies, the seller stops responding, the listing ages out. What actually happened is that the conversation moved to a Jabber address in the seller's signature, and concluded there.
XMPP has been the underground's trade channel for over a decade, for rational reasons: federated infrastructure with no central operator to subpoena, mature OTR/OMEMO encryption habits, and cultural inertia from the era when every serious forum required a Jabber contact for escrow deals.
For defenders, the asymmetry is stark. Forum monitoring is a commodity that a dozen vendors sell. The negotiation layer, where prices, samples and victim names actually change hands, is close to unmonitored. Not because observing it is impossible, but because building and maintaining collection there is slow, unglamorous work that does not demo well at conferences.
WHERE THE DEAL ACTUALLY CLOSES
coverage indicativeUNDERGROUND FORUMS
the storefront · access listed, prices hinted
TELEGRAM CHANNELS
the distribution · samples, combolists, victim announcements
XMPP / JABBER
JABBERNAUT IS HEREthe negotiation · price, escrow, delivery. the deal closes here
Bars: share of industry coverage per layer (indicative). Monitoring only the top layer means seeing the ad and missing the transaction.
Jabbernaut is built for that layer. What matters to a defender is not the advertisement but the exchange that follows it, where the price is agreed, the sample changes hands and the victim is named. That is what we show, under NDA.
The Jabbernaut research desk
Written from primary sources. No third-party feed was harmed.