URLytics: Profiling Forum Users from their Posted URLs

Online forums contain a substantial amount of data, but very few studies have focused on mining the URLs posted by users. How can we fully leverage these posted URLs to extract as much information as possible about forum users? We perform a systematic study for extracting as much information as possible about forum users via their URL posting behavior. Within this study we develop a series of tools to analyze the data. Given a forum, we extract the following information: (a) basic statistics and a profile of the forum, (b) a profile for each user based on their referral to accounts in other platforms, (c) identification of communities within the forum, and (d) detection of malicious behavior. Most prior works focus on analyzing the text found in user posts rather than on URLs themselves, as we do here. In our study, we analyze three online security forums and find interesting results: (a) we identify 7% of the users posting social media links on other platforms, (b) we detect 148 groups of users that engage in communities on external social media platforms, (c) we expose 139 malicious users that collectively posted 328 malicious URLs. Additionally, we identify 17 groups with membership spanning across multiple forums, and discover numerous other groups that engage in coordinated malicious behavior. Our work is a significant step towards an all-encompassing system for profiling forum users at large.