We study the networks of Twitter users posting information about Ransomware and Virus and other malware since 2010. We collected more than 200k tweets about 25 attacks measuring the impact of these outbreaks on the social network. We used the mention network as paradigm of network analysis showing that the networks have a similar behavior in terms of topology and tweet/retweet volumes. A detailed analysis on the data allowed us to better understand the role of the major technical web sites in diffusing the news of each new epidemic, while a study of the social media response reveal how this one is strictly correlated with the media hype but it is not directly proportional to the virus/ransomware diffusion. In fact ransomware is perceived as a problem hundred times more relevant than worms or botnets. We investigated the hypothesis of Early Warning signals in Twitter of malware attacks showing that, despite the popularity of the platform and its large user base, the chances of identifying early warning signals are pretty low. Finally we study the most active users, their distribution and their tendency of discussing more attack and how in time the users switch from a topic to another. Investigating the quality of the information on Twitter about malware we saw a great quality and the possibility to use this information as automatic classification of new attacks.
Since the early days of personal computers the diffusion of malicious code has triggered concern and attention. During the first years the majority of the malware was mostly related to the ”worm” or ”virus” categories and their diffusion used mostly physical devices (for instance the floppy disk) or basic networking services. Nowadays the attacks are mostly related to social engineering manipulation of the victims using psychological tricks to convince people to download and install malicious email attachments or online offensive code. The development of Ransomware tools with encryption strategies able to block the system and ask for a ransom is a relatively recent threat. The development of crypto-currencies such as the BitCoin gave to hackers and organized crime a new source of financing using the ransomware:3 discuss the pros and cons of paying or not paying the ransom. Other authors6 made an economic model taking into account the bargaining phase of the attack when a user can ask for a discount in the ransom he eventually have to pay. This will create a market that involves a limited possibility of negotiation for users and cyber criminals and some feedback loops that further develop the market. More recently new generations of Ransomware attacks are specializing in targeting companies, that are more vulnerable to the disruption caused by the encryption and lock strategy. Finally with the rise of the IoT devices connected to the network, minimally managed and with basic hardware, the threat is becoming alarming as several ransomware are able to infect also industrial plants Corresponding author. The author collected the data, conceived the experiment(s), analysed the results. †The author conceived the experiment(s) and the reviewed the manuscript. ‡The author conceived the experiment(s) and the reviewed the manuscript.
§The author conceived the experiment(s) and the reviewed the manuscript. relying on IoT devices. There are concerns (https://www.eset.com/us/business/resources/ tech-briefs/rot-ransomware-of-things/) that the IoT devices can be transformed in RoT ”Ransomware of Things” a new menace to industrial business, civil infrastructures potentially very lucrative for the criminal groups.
In this paper we study the networks of Twitter users discussing about 25 relevant and worldwide diffused Viruses (Trojan, Worms, Spywares) and Ransomware attacks, as well as a Botnet. Twitter microblogging platform is used for posting news and discussing trending topics. Press agencies, bloggers, professionals and users interact with short messages discussing popular subjects (mostly related to politics, sport and gossip) but also more specialized ones like coding and ICT security. In the space of 140 characters users post general info, create hashtags, mention other users and attach short urls pointing to news. Following and counting the news from links it is possible to estimate the prevalence of a source in the debate and the overall diffusion of a topic.
We have tracked the evolution of posts about malwares from 2010 till September 2017. For each malware, we created the mention networks of the users discussing about the attacks and have computed the main features of those networks from a topological perspective; we then estimated the social media impact and the driving force of the news sources (i.e. the relative importance of the specialized press in spreading the news about the outbreak).
We focused on questions related to the characteristics of the users tweeting about malware, trying to answer to questions like: who are the early reporters? are they mostly from specialized press or rather individuals acting independently? We compare their hashtags and the precision they use in describing the malware threat. Finally, we used temporal networks analysis to study the effectiveness of the networks in diffusing the information among other users. In particular we investigated whether the users discussing of an attack were also active commenting other malwares. This overlap is of fundamental importance to understand if there is a core of users that constantly report news about malware; these users will be likely a source of information about new unseen attacks and thus of early warnings.
In our paper we decided to leverage on Twitter to gather informations about each attack. Our goals is to estimate the impact in terms of overall discussion (number of tweets, users involved, hashtags created and so on), temporal patterns (attention peaks, user overlap among different attacks) and media diffusion (analysis of cited blogs and unique news in tweets). Users tweeting about malware do improve our knowledge of the infection, and help us in estimating the perceived importance of a topic and the level of awareness. In specific domains such as political debate and online voting the Twitter platform proved also to be a good forecast tool (see the case of American Idol in2) or simply a tool to understand the development of the events like the Chilean student movement’s protest described in5. In a more theoretical way authors like8 are studying the diffusion of rumors on Twitter using epidemiological models. The attention of the users on the social media platform remains low: in7 the authors show how the majority of the interactions of each user are focusing on a small subsample of his/her social network. Indeed not all friends and followers are equally important for a user. Moreover the number of topics discussed daily in the platform is not large: the general tendency is commenting the daily news. In our perspective this limited attention of the users can partly explain why the topic of the cybersecurity in Twitter is far less popular than other threats such as terrorism: media generally ignore the topic and prefers other menaces. Monitoring Twitter to detect emergent information (topic trends) is an important research topic. We aknowledge the contribution to the general discussion to several early works such as TwitterMonitor9, enBlogue from1 and frameworks for real time tweet analysis4. We reused the concept of dynamic sliding time window from this last work in order to explore the volumes of tweets for Ransomware epidemics across time. The weekly interval is enough to cover the required time frame for volumes and hashtags. The resulting mention networks, however, are studied globally.
The selection of the attacks was done with the main criteria of ensuring a uniform temporal coverage: we wanted to study the evolution of the interest on malware since 2010 till present (mid Sep 2017). We do distinguish the attacks as worms, viruses and ransomware, as well as a botnet: Mirai. The complete list of the malware is reported in 1.
The data from Twitter were collected using the Search interface directly from the main website using scraping techniques in order to overcome the limitation of the Search API that limits the available results to the last 7 days of each search query. The scraping action allowed to recover 214463 tweets that after a filtering process become 206040 tweets related to the 25 attacks. The filter on queries and tweets we introduced is based on the BoW (Bag of Words) methodology i.e. searching and saving only the tweets that contain one or more words in a selected set. In the search query we specify terms closely related to the malware and variants of the malware name. For instance to study the WannaCry infection the word ”WannaCry” is in the BoW along ”WannaCrypt” (a variant of the original name) as well as the word ”EternalBlue” that is the code name for the exploit used to infect the machines with the ransomware. To acquire this knowledge on the attacks we revised several news articles on specialized press and the referring security bulletins. As a general remark there are limited possibilities of collision when the name of an attack can be confused with a username: this is the case of ”VBmania” an old virus that collides with a username calling himself ”vbmania”. In this case in the filtering procedure we removed the tweets having as author ”VBmania”.
Several user networks can be created using the Twitter data: a) the direct network of friendship and followership b) a user-to-user mention network c) a hashtag network d) a topic network.
The first approach based on a direct network of friendship/followership is possible when the dataset of tweets refers to a recent period of time and the number of users is not too large. In this case a query with the Twitter API is used to extract the connections of each user in the database. This approach can only be used to extract the network as it is today and it is not suitable for the attacks that took place before 2017: the social network around each user might have changed since then in ways that we cannot reconstruct.
The second approach of building a mention network is the one we followed for our analysis. It is the most robust method as mentions are likely to imply also a friendship or a follower relation. Notice however that the mention network does not imply existence of a reciprocal link, i.e. the mentioning act has a direction. In fact, there are users that cite other users and are never cited back. In our analysis this approach has the main advantage of enablin us to reconstruct the network as it was at the time of the attack without the need of using the actual social relationships that can be different from those at the time of the attacks.
The third approach, that requires building a hashtag network, uses the hashtag overlap in the tweet of two users to infer an undirected connection. If two users use the same set of hashtags when twitting about the same attack it is likely that they are connected or interested in the same topics. This relation is of semantic nature and can be explored only using large databases of tweets for several attacks that, currently, we do not have. Another disadvantage of this approach is that the search query procedure is focusing on a constant set of words (the bag of words) and it does not consider all possible hashtags related to the given attack. Indeed to build a network of hashtags we need a dataset of tweets containing an exhaustive set of hashtags about each attack and not only the original BoW. The feasibility of this approach is limited when the volumes of tweets are scarce.
The last approach is a generalization of the hashtag network model, it uses the broad concept of topic to establish a connection among two users that will be connected if, for a given malware, will have most of the topics in common. This methodology is even less accurate of the one of the hashtags as it relies on the ability of completing a list of the topics related to an attack and correctly classifying the tweets per each topic.
Creating a network using the mentions is for Twitter the most straightfoward approach, in our case the selection of tweets is also taking into account the majority of the well known hashtags related to each infection. In fact to search and filter an attak we need a BoW considering all terms, also the hashtags. As a final result despite che choice of the mention network to analyze the malware, the presence of the hashtags ensures a better level of completeness in the data acquisition phase.
To build the mention networks we count the number of direct citations between two users as weights of the links. To guarantee that the weights remain in the interval 0-1, they are rescaled according to the simple Min-Max rescaler: wi j =
wi j max(w) min(w) min(w) where wi j is the number of citations between node i and node j (user i author of the tweets 1; 2; :::; m is citing user j in the tweets).
The analysis on the mention networks of the attacks aims at the simplest topological characteristics: edge density, average degree, and size of the network. Instead to better understand the existence of temporal patterns we computed the pairwise Jaccard index for each network looking at the nodes of each graph:
Ji j =
jNi \ N jj jNij + jN jj jNi \ N jj (1) where jNij indicated the size of the network i, and jNi \ N jj is the number of common nodes of the pair i; j. The idea behind this index is computing the fraction of nodes that are common to two different networks. We want to understand if there is a common set of specialized users that constantly talk about the attacks and if this set change in time.
1https://www.theverge.com/2017/7/2/15910826/nato-response-petya-attack-state-actor-russia-ukraine and https://www.theverge.com/2017/6/28/15888632/petya-goldeneye-ransomware-cyberattack-ukraine-russia 2The number of collected tweets refer to a single year after the discovery of the attack: we discarded late references to the malware the great attention on the media, the estimated number of computers infected by WannaCry is estimated in 400k (https://blog.barkly.com/wannacry-ransomware-statistics-2017), a number The most interesting and spectacular change we see in the data (Fig. 5) is linked to the popularity of the ransomware attacks. Petya and Wannacry became trending topics and their total impact on twitter is two order of magnitude larger of each previous case. Clearly the volumes of reconstructed discussion on Twitter can be influenced by precision of our analysis and by our ability of using the correct set of words for the Bag of Word model. Further investigations will be carried out to check whether the 2016 drop in Fig. 5 is real or due our choice of search keywords. smaller than the far less popular CryptoLocker (http://www.hongkiat.com/blog/famous-malicious-computer-viruses/) whose victims were around 500k. Finally, the attention to a botnet such as Mirai (https://www. theguardian.com/technology/2016/oct/26/ddos-attack-dyn-mirai-botnet ) is far behind the concern for the ransomware epidemics, in spite of the immense power of such tools. With Mirai, hundreds of thousands of infected zombie computers and enslaved IoT devices (that are particularly difficult to secure and patch) are able to shutdown large portions of the national Internet infrastructure with massive DDos attacks. Notice that all the techniques, botnets, viruses in form of network worms, and encryption payloads can be used together in sophisticate attacks. For instance a botnet can spread malicious emails containing a payload that infects a computer with a worm, able to further explore the network looking for potential new victims running non secured computers. The worm can eventually activate a crypto attack and ask for a ransomware, or can instead change its nature enslaving the computer to the original botnet. The network analysis in Tab. 2 focuses on basic network measures: we see that, despite the different sizes of the networks, if a graph has at least 100 nodes the average degree remains quite constant. Figure 1 confirms that the networks with at least 100 nodes have a strict proportionality of number of nodes and number of edges. This is a simple yet powerful indication of the network formation around those topics on Twitter: networks of citations in Twitter have by constraint an upper boundary in terms of degree; with only 140 characters the number of users that can be cited is not large. However it is still not obvious that a user is citing in his tweets no more than two other users for all the outbreaks. The results is a network that is almost fully connected even if the average degree is not so large. users unique htags relative tweets total tweets attack
The temporal evolution of the attacks is shown in Fig. 2 where, for graphical purposes, the activity is normalized to the unity: for instance the WannaCry crisis was thousands of times more intense that the WaledDac infection. In general the activity is represented by a low count of tweets followed by an outbreak in the form of a peak (see Fig. 3). The users are commenting with low volumes till the point a hashtag becomes popular or the mainstream media start reporting about the infection. The more an attack was popularized the more the infection has sudden peaks of large size. For instance while Petya and WannaCry have large peaks, the Linux.Darlloz worm with less than one thousand tweets have a more flat and low rate of citations during the entire year of recording. Fig. 4 shows how the different attacks were covered on the media (as extracted from the tweets resolving the media url inside) and on Twitter in a similar way: there is a strict proportionality of the number of media news and number of tweets. This is true for all sizes: from the 20 unique tweets of the NGRBot to the 147k tweets of the WannaCry outbreak. The relatively constant average degree and the strict proportionality of number of tweets and media is something that we believe be embedded in the Twitter platform and its 140 character message. It is also interesting to notice that this behaviour remained almost unchanged for the last 7 years. The most interesting and spectacular change we see in the data (Fig. 5) is linked to the popularity of the ransomware attacks. Petya and Wannacry became trending topics and their total impact on twitter is two order of magnitude larger of each previous case. Clearly the volumes of reconstructed discussion on Twitter can be influenced by precision of our analysis and by our ability of using the correct set of words for the Bag of Word model. Further investigations will be carried out to check whether the 2016 drop in Fig. 5 is real or due our choice of search keywords. edges avg degree edge density start 2.35 2.17 1.75 2.12 1.75 1.64 1.53 1.78 1.50 1.49 1.37 1.95 1.47 1.38 1.48 1.66 1.25 2.21 1.18 2.77 1.23 0.00 1.43 0.00 nan
To better understand how an attack develops on Twitter, we can compare the peaks of three main incidents that we selected because of their large volumes. In Fig. 3 the large peak and following decay of WannaCry is shown with the tendency line (using a 7 days moving average to remove the weekly periodicity ) in comparison with Petya, and CryptoLocker. In spite of the different size of the peaks, the plots show an identical behavior of burst and decay. The decay part is similar also in the time interval: for more than 100 days the topic is still very active on Twitter, while the rise of the peak is almost instantaneous.
Applying the equation 1 to each pair of networks we verify the existence of a small cluster from Cryptolocker to TorrentLocker and Fusob: during the year 2014 and 2015 (see Fig. 6). This overlap of the user base (nodes of the networks) is mostly due to the contemporaneity of the attacks, but the same temporal patter of overlap is not always present in the data. For instance Petya and WannaCry are developing in the same period but their Jaccard index is much lower, i.e. their user bases tend to overlap less. Long range overlaps are less likely to appear: the fraction of users in common between the old SpyEye and WannaCry is not large compared to the almost contemporaneous infection Kenzero.
To improve our understanding of each infection we studied two other social dimensions: a) the most popular media covering each attack b) the most popular hashtags in each dataset.
The media coverage analysis is a simple count of how many times a given source reported information about the incident. In particular we count the appearance of each baseline domain (such as nytimes.com or theguardian.com ) in the entire sequence of tweets. Notice that in Twitter the majority of the links are shortened by services such as bit.ly and we have to use a software to unshorten each url. After many years several urls are broken and no more available from the original redirect service and also some shortening services have been shut down. Moreover a small part of urls were not correctly pasted in the original tweets. The sum of all those broken links is reported in Tab. 3 as ”unresolved”. We also performed a manual classification of the first 100 sites, distinguishing several categories: hacking blogs or tech magazines, general news, advertising sites, generic information or service websites, tools and software such as github. Other fine grain classifications can eventually be obtained by considering individual sites. We notice, for instance, that the majority of links are internals from twitter to twitter; i.e. they are the results of users citing other tweets (not a retweet) or adding links to facebook pages (there is also room to expand the analysis also in Facebook following those links). The large prevalence of hacking related magazines is a sign of the high technical skills of the users posting about malwares. Among others the hackernews.com magazine is the most relevant source of information on malwares on WannaCry #wannacry #ransomware #cybersecurity #infosec #petya #cyberattack #security #eternalblue #malware #wannacrypt #gameover #zeus #cryptolocker #cybercrime #securityaffairs #malware #security #botnet #infosec #fbi #tinba #malware #trojan #tinbapore #cybersecurity #conficker #infosec #gozi # #zeus Xafecopy #xafecopy #trojan #malware #xafecopytrojan #india #androidpic #mobile #security #phone #cybersecurity Gameover ZeuS
TorrentLocker
VBMania Tiny Banker Trojan
ZeroAccess
The study of the most frequent hashtags (see Tab. 4) reveals that Ransomware attacks such as WannaCry and Petya are often associated in tweets and hashtags. Another name for WannaCry is WannaCrypt an alternative term pointing to the encryption threat. Also the name ”eternalblue” that reports information about the actual exploit is in the WannaCry list. Mirai is associated with the powerful Petya #petya #ransomware #wannacry #notpetya #cybersecurity #cyberattack #infosec #malware #security #goldeneye #torrentlocker #ransomware #malware #cryptolocker #bitcoin #decrypter #infosec #security #securityaffairs #eset #zeroaccess #rootkit #malware #security #tdl3 #tdl4 #malwares #infosec #twitter #analysis WaleDac #waledac #botnet #microsoft #malware #operationb49 #cybercrime #infosec #spam #securitytrends #stormworm
CryptoLocker #cryptolocker #ransomware #malware #security #virus #infosec #gozeus #gameoverzeus #zeus #cybersecurity #hereyouhave #virus #vbmania #security #spam #worm #email #pgvirus #viruses #networkworld Reveton #reveton #ransomware #malware #fbi #virus #citadel #infosec #ransom #security #scareware Kenzero #kenzero #yfmwomensday #porn #trojan #virus #japan #hentai #japanese #zar #gamers
Mirai #mirai #botnet #iot #ddos #cybersecurity #infosec #malware #security #miraibotnet #nanog69 Shamoon #shamoon #virus #malware #windows #aramco #security #flame #saudi #hacking #it Stuxnet #stuxnet #trojan #security #cyberwar #cyber #military #social #cyberwarfare #cybercrime #scada NGRBot #ngrbot #trojan #worm #malware #mcafeepic
Linux.Darlloz #linux #onlinevirus #infosec #security #worm #iot #symantec #php #malware #freeantivirus Duqu #duqu #stuxnet #worm #security #twitter #malware #virus #infosec #iran #symantec BASHLITE #bashlite #shellshock #busybox #wwwjoweeomicilcom #bash #malware #infosec #africa #security #caboverde Fusob #fusob #hcacronyms #saynotodrilling
SpyEye #spyeye #zeus #malware #trojan #android #security #botnet #infosec #cybercrime #banking sKyWIper #skywiper #flamer #flame #stuxnet #duqu #infosec #malware #theflame #cyberwar #iran CryptoLocker.F #symantec #latestthreats #threat Alureon #alureon #jmu #chesapeakehall botnet and the ddos that it can create. Linux.Darlloz is correctly seen as a worm targeting the linux platform. In general the classification of the each attack using their hashtags is pretty accurate. Each malware is recognized as virus, ransomware, botnet, worm and so on and all the synonym names are present like for wannacry. The hashtag list proved to be a good classification tool to understand the nature of each malware and providing a quick classification.
url twitter.com unresolved www.youtube.com thehackernews.com www.facebook.com www2.themsphub.com www.bbc.co.uk threatpost.com www.zdnet.com www.symantec.com cm.gy www.theguardian.com www.infosecurity-magazine.com www.wired.com www.bleepingcomputer.com www.bbc.com www.cnet.com www.carbonblack.com or-argent.eu www.linkedin.com securityintelligence.com www.forbes.com www.reuters.com blogs.technet.microsoft.com engage2demand.cisco.com
freq
The distribution of number of tweets per user and of number of retweets per each attack is reported in Fig. 8 and Fig. 7. Again the linearity in log-scale indicates the rarity of users tweeting thousands of tweets and the abundance of those with few tweets; retweets follow the same exponential logic. A bit of variability is present when the size of the attack is not large.
To collect data from the Twitter Search we specified a time interval and a set of keywords related to each RansomWare/Virus attacks. Each interval was selected according to the informations reported in the specialized press and the corresponding Wikipedia pages of each malware. We decided to further explore the possibility of using Twitter to detect some early warning about some malware attack. Our aim has been to get the first tweet mentioning the threat and to compare it with the information obtained from specialized press.
The task is rendered more complex by the possibility of having some misleading hashtag or
username confused with the malware word. For instance, for 2008 we found a user called ”vbmania” having
nothing in common with the virus. We also noticed that Twitter for the years around 2009-2011 is
somehow less precise in the answers given back by the search. A small fraction of tweets was in those years
totally unrelated with the query. For this reason we carefully filtered out the inaccurate answers using
the keyword selected as Bag of Word. The BoW is created selecting hashtags (i.e #CryptoLocker ) or
direct citations (CryptoLocker) for each malware but filtering out user matches such as ”@vbmania”. The
results of the early signal search made clear that Twitter is behind schedule in reporting the news about
a new attack. We confirmed the accuracy of the time intervals for the majority of the malware, with
the only exception of very old malwares (such as Kenzero and WaleDac) were the first tweet appeared
several months after the official discovery. The interest on malware is clearly growing with time and
has become more evident for the recent attacks of 201
In this paper we presented an analysis of 25 malware attacks in a period of 7 years, from 2010 to 2017 (present) as they appeared in the Twitter platform. We estimated the impact of each attack in terms of total tweets, size of the mentioning network. We analyzed temporal overlap and the usage of the most frequent hashtags as a semantic tool. We also investigated the possibility of some leak on Twitter exposing in advance information about cyber threats. We saw that the networks of users mentioning other users in their tweets on malware tend to form structures with nearly constant average degree. The topological properties of those graphs are interesting: an average of two users are mentioned by each user no matter the size of the network. We also report a strict proportionality from the total number of tweets and media coverage (as extracted from the tweets).
The role of the media is evident in the development of the tweet volumes: the preparation phase, the peak and the decay that characterize all major attacks. After 100 days from the outbreak of the infection there is still signal. The volume of tweets talking about the malware is a proxy for the perceived importance of an attack. The recent Wannacry and Petya incidents received a broad attention while others, like TorrentLocker, were barely present in the social media platform. The threat of the ransomware is by far the most scary for the users.
The tweets themselves can be used to extract more information about each malware: the most frequent hashtags are an easy way to classify each malicious code. This is an interesting feature of the tweets about malware. Usually, in fact, tweet content is noisy, the hashtags reported in the political debate can incorporate sarcasm and other jokes. From our analysis the hashtags about malicious code are instead more informative and less emotive. In particular, from the short messages and their hashtags, the classification of each threat as worm, botnet, ransomware, virus and the targeting platform (windows7, linux, macos) is generally very clear. Finally the hashtags reveal other informations about the presence of synonyms and exploits (for instance EternalBlue and WannaCry) that can be missing from the initial Bag of Word used to collect the tweets.
From our analysis we can infer the overlap of the user communities discussing the different threats especially if the attacks are closer in time and typology. We observed that the family of 2015 cryptolockers were discussed from a common set of users, while the intersection of the users of Petya and Wannacry is smaller even if they are often associated in each tweet. In our study, we also considered the possibility that Twitter might offer some early warning signal about new threats. We explored the presence of tweets about each case and we can exclude anticipatory contents in Twitter. The discussions on the microblogging platform is mostly related to comment about the news as reported by the (specialized) press. In some case the news became viral and the hashtags trending topics for one or two days.
We foresee in the analysis of malware in Twitter two possible interesting directions. Judging the interest and the impact of each attack by the volumes, establishing for instance if the Ransomware is seen as a menace of greater intensity compared to Botnets and DDOS. Also the campaign of information about the risk of each malware can spread through the social networks and rise awareness for the threat.
Another usage is related to the semantic possibilities of these Twitter messages, from a simple screening of the hashtags associated to each attack, we were able to classify the attacks and to gather further details about the exploits, the target platforms, the operating systems. The usage of the user mention network can further increase the quality of the filtering: using the tweets from the most central nodes can eventually lead to gather better information about the threat. Other future directions of research are given by the explanation of network formation: are the professional users the drivers of the network growth? are the large press agencies with their user base those who triggers the reaction with a cascade of retweets? are the mainstream news those that start the reaction of an army of individual users with each of them posting a couple of tweets? are the tools of temporal networks of interest in studying the evolution of the network and its efficiency? why the networks are disappearing after a period of time?
In conclusion we believe that this unique study tracing the impact of malware in Twitter can give the experts in malware an estimation of the awareness on each cybercrime threat and make available to network scientists a clear case of temporal network formation.
G.C. acknowledges EU grant SoBiGData, CoeGSS and OpenMaker. RDN acknowledges the support of the FilieraSicura project.
All the authors conceived the experiment(s), M.P. conducted the experiment(s), M.P. analysed the results. All authors reviewed the manuscript.