CCRNetOur public work
RESEARCH HISTORY · 2024–2025

From an uncertain prototype to a governed research program.

CCRNet did not begin with a finished platform, a mature governance model, or even a completely defined mission. It began as an experiment: collect fragmented information about fraud and cybercrime, create enough test data to build with, and determine whether AI-assisted systems could identify patterns that would be difficult to see one report at a time.

The first MVP was rough, exploratory, and substantially different from the program CCRNet is developing today. This page documents what we built, what the surviving archive contains, what we got wrong, and how those lessons changed our direction.

i

This page describes an early research prototype.

Its records were not verified findings of criminal conduct. Its generated summaries were not law-enforcement alerts, and locations displayed by the prototype should not be interpreted as verified crime locations.

THE ORIGINAL IDEA

A global map of connected cybercrime activity.

Our original concept was broad and ambitious. We wanted to create a system capable of collecting reports and external threat information, structuring the material, and using artificial intelligence to identify repeated names, accounts, infrastructure, tactics, payment methods, locations, and other possible connections.

The long-term vision was a global crime map that could show where incidents appeared to occur and reveal relationships across reports that might otherwise remain isolated.

At that stage, however, CCRNet was an MVP with limited data, inconsistent schemas, no mature provenance model, and no reliable method for determining whether every record represented a real event, a test, a simulation, or generated material.

CHRONOLOGY

Late 2024 through 2025.

  1. Late 2024

    Prototype question

    CCRNet began testing whether fragmented fraud and cybercrime information could be structured, searched, and compared with AI-assisted workflows.

  2. Late 2024–early 2025

    Data assembly experiments

    The MVP combined generated scenarios, legacy form-shaped records, and high-level online-source collection experiments without a mature provenance model.

  3. 2025

    Analysis and mapping trials

    Prototype code explored categorization, generated summaries, possible cross-record connections, and map visualizations for exploratory review.

  4. Later 2025

    Governance reset

    The archive showed that provenance, synthetic-data boundaries, source lineage, restricted publication, and human review had to be foundational rather than added later.

HOW THE EARLY DATA WAS ASSEMBLED

Three source categories, all treated with caution.

CCRNet cannot verify that any surviving legacy form record represents a genuine public submission. We therefore treat the legacy intake corpus as unverified and do not present it as evidence of a crime.

01
SOURCE CATEGORY

Online-source collection

During the early research period, we experimented with scripts that collected material from selected dark-web forums and Telegram channels. The objective was to explore whether fragmented online threat information could be converted into records that an analysis system could search and compare.

Collection did not establish that a claim was accurate, that an identity was authentic, or that a crime had occurred. Much of the collected material was noisy, duplicated, incomplete, promotional, deceptive, or potentially harmful.

02
SOURCE CATEGORY

A public reporting form

An early CCRNet website included a form through which people could theoretically report scams and fraud.

We do not recall receiving a confirmed genuine report through that system, and the surviving records do not provide enough provenance to settle the question. Some legacy form records may be internal tests, demonstrations, adversarial submissions, or other prototype data.

CCRNet therefore treats the entire legacy form corpus as unverified. It is not being presented as a collection of victim reports and is not evidence that any named person committed a crime.

03
SOURCE CATEGORY

Synthetic fraud scenarios

Because we did not have a reliable corpus of genuine reports with which to test the system, we used AI and procedural generation to produce synthetic fraud scenarios.

The generated records included incident narratives, transaction details, actors, locations, and other attributes intended to exercise the MVP’s database, analysis, alert-generation, and mapping features.

Synthetic data allowed development to continue, but the early generator produced details that could appear more realistic than they should have. Some generated records used plausible names, addresses, contact details, and precise-looking coordinates.

Those fields were artificial, but they were not always labeled or designed clearly enough to prevent confusion. That became one of the project’s most important lessons.

WHAT WE BUILT

What the MVP attempted to do.

1

Structure

Convert reports, generated scenarios, and collected online material into searchable records.

2

Categorize

Use keyword rules and AI-assisted processing to assign fraud types and related classifications.

3

Connect

Run experimental agentic workflows intended to identify repeated indicators, similar narratives, shared tactics, or possible relationships across records.

4

Visualize

Display generated summaries and map markers so patterns could be explored geographically.

The map was a prototype visualization—not a validated crime map. Many locations came from synthetic records, and a marker did not establish that an incident had occurred at that location.

WHAT THE ARCHIVE CONTAINS

Surviving prototype files, not verified incidents.

288

Legacy complaint-shaped records

Surviving records shaped like complaint or incident intake data.

265

Primary synthetic-generator schema matches

Records among the complaint-shaped corpus that match the primary synthetic-generator schema.

23

Older or different complaint-shaped schemas

Complaint-shaped records with older or different schemas and uncertain origin.

288

Generated summary or alert-shaped records

Prototype outputs shaped like AI-generated summaries or alerts, not validated alerts.

13

Separate legacy reporting-form export

Records from a separate legacy form export whose origin cannot be verified.

200

Scraped thread-page records

Collected page records preserved without publishing raw source content or targets.

113

Scraped member-page records

Collected member-page records preserved without usernames, targets, or operational details.

Several

Prototype JavaScript files

Files for synthetic generation, keyword categorization, Telegram collection, local collection, and source targeting.

These numbers describe files in a surviving prototype archive. They do not represent 288 confirmed crimes, 13 verified public reports, 200 criminal cases, or 113 identified offenders.

WHAT WE LEARNED

What did not work, and what changed.

Provenance has to come first

A system must record whether information is synthetic, submitted, observed, simulated, inferred, or derived. That origin cannot be reconstructed reliably after the fact.

Synthetic data must look synthetic

Generated data should use reserved domains, fictional identifiers, controlled geography, reproducible seeds, explicit labels, and evaluation relationships designed in advance.

Collection is not verification

Scraping or receiving a claim does not make the claim true. Collected material remains an allegation or observation until independently assessed.

Maps can imply certainty that does not exist

Precise-looking markers can cause people to interpret generated or approximate locations as verified facts.

AI output needs traceable sources

An agentic system may generate persuasive summaries and connections even when its source material is incomplete or unreliable. Every meaningful conclusion needs source lineage and qualified human review.

Transparency does not require publishing harmful raw material

A responsible archive can disclose methods, counts, limitations, transformations, and exclusion decisions without exposing personal information, illicit-source content, or operational collection targets.

WHY CCRNET CHANGED DIRECTION

The MVP did not become the mission. Its failures helped define the mission.

The early prototype showed that the difficult part was not placing reports in a database or asking an AI model to summarize them. The difficult part was creating trustworthy knowledge from material with different origins, permissions, reliability levels, and handling requirements.

CCRNet has since moved toward a more deliberate public-benefit research program focused on isolated knowledge architecture, reproducible retrieval, explicit provenance, source-linked results, controlled data use, human-reviewed connection suggestions, responsible model development, and public education.

The goal remains to make cybercrime information more useful. The difference is that the current direction begins with governance, evidence boundaries, and reproducibility rather than treating them as features to add later.

TRANSPARENCY AND PUBLIC ARCHIVE

Documented, restricted, and not published raw.

CCRNet is preserving an integrity record of the historical archive for internal research documentation. The original archive will not be offered as a public download because it contains identifying information, uncertain-origin form records, raw material collected from illicit online communities, operational collection details, and synthetic fields that could be mistaken for real identities or locations.

The public transparency package will instead contain:

  • An archive manifest.
  • Aggregate record counts.
  • Provenance classifications and confidence levels.
  • Data dictionaries and historical schemas.
  • A description of collection and generation methods.
  • Known limitations and quality problems.
  • An explicit exclusion log explaining what was withheld and why.
  • Sanitized or newly generated synthetic examples.
  • Cleaned research code that cannot expose collection targets or personal information.
  • Checksums and release-version information.

A sanitized transparency package is being prepared. Raw legacy records will not be publicly distributed.

Public exclusion log

The prepared CSV in public/EXCLUSION_LOG.csv is embedded below as a sanitized release-decision table. It documents aggregate record groups, provenance classifications, public-release status, and public notes without exposing raw records, source targets, or identifiers.

Download the exclusion log CSV
Source fileRecord groupCountProvenanceRelease statusPublic disclosurePublic note
research.zipComplete historical MVP archive8 source filesmixedwithheldPublish manifest, SHA-256 checksum, aggregate counts, methods, limitations, and this exclusion logThe original archive is preserved as a restricted historical research record and is not offered as a public download.
ccrnet-export.jsonComplaint-shaped records matching the primary synthetic-generator schema265 recordssyntheticreplacedPublish a newly generated synthetic dataset with explicit origin labels, reserved domains, fictional identifiers, controlled geography, fixed seeds, and evaluation ground truthCounts, schema documentation, generation methodology, and quality findings may be published; the original records should not be released.
ccrnet-export.jsonComplaint-shaped records using older or different schemas23 recordsunknown or mixedwithheldPublish aggregate count, field-level schema differences, and a statement that origin could not be establishedThese records must not be described as verified victim reports or confirmed crimes.
ccrnet-export.jsonGenerated summary or alert-shaped records288 recordsderived AI outputaggregate onlyPublish record count, output schema, high-level methodology, and newly generated safe examples linked to the public synthetic datasetRefer to these records as prototype generated summaries, not verified alerts, findings, or law-enforcement intelligence.
fraud-reporter-export.jsonLegacy reporting-form records13 recordslegacy form record of uncertain originwithheldPublish aggregate count, empty schema, available field names, and an explanation of provenance uncertaintyCCRNet cannot verify that any surviving record represents a genuine public report and therefore treats the entire legacy intake corpus as unverified.
fraud-reporter-export.jsonLegacy records containing attachment or storage references5 records with attachment referenceslegacy form record of uncertain originwithheldDisclose only that attachment references existed and were excluded; do not publish URLs, storage paths, filenames, or mediaAny referenced storage objects should be audited separately for access controls, retention, and deletion requirements.
ccpro-export.jsonScraped thread-page records200 recordsobserved online sourceaggregate onlyPublish counts, collection window where known, duplication statistics, field completeness, high-level categories, and non-operational paraphrased examplesCollection established only that material was observed; it did not verify claims, identities, or criminal conduct.
ccpro-export.jsonScraped member-page records113 recordsobserved online sourceaggregate onlyPublish record count and the finding that the captured page bodies provided little or no substantive variationDo not present member-page records as identified offenders or verified criminal profiles.
synthetic_data.jsHistorical synthetic-data generator1 source fileresearch codereconstructedPublish a rewritten generator using safe fictional values, explicit provenance, deterministic seeds, documented prompts, and reproducible evaluation relationshipsDocument the historical approach and its limitations, but release only the safer replacement generator.
keywords.jsPrototype keyword classifier1 source fileresearch coderelease after reviewPublish a cleaned version with tests, category documentation, limitations, and removal of any sensitive examples or environment-specific referencesDescribe it as a simple first-match substring baseline used during early prototyping.
bot.jsHistorical Telegram collection prototype1 source fileoperational research codereconstructedPublish non-operational pseudocode or a safe architectural reconstruction with target identifiers, storage behavior, media downloading, authentication setup, and external posting removedDiscuss the collection workflow at a high level without publishing target locations or a ready-to-run illicit-source collector.
bot-local.jsHistorical local collection and storage prototype1 source fileoperational research codereconstructedPublish non-operational pseudocode or a safe architectural reconstruction with local paths, target identifiers, download behavior, and storage implementation removedDocument what the prototype attempted to do, but do not publish a directly usable collector for illicit-source material.
channels.jsConfigured Telegram collection targets20 targetsoperational configurationwithheldDisclose only the number and general source type; do not publish names, handles, links, identifiers, or access pathsThe public archive may state that the prototype contained a configured list of 20 Telegram collection targets.

CCRNet’s early MVP was not a finished intelligence platform. It was an attempt to understand whether fragmented cybercrime data could be structured and connected with emerging AI systems.

Some of its assumptions were wrong. Its data boundaries were not mature enough. Its visualizations could imply more certainty than the underlying records supported.

Publishing that history is part of the work. The purpose of this archive is not to defend every early decision; it is to show how those decisions informed a more responsible direction.

Explore current CCRNet research