This dissertation investigates the measurement of profit-driven cybercrime, defined as crimes facilitated or committed using computers, networks, or hardware devices with financial motivations. While cybercrime has been extensively studied, its true scale remains difficult to determine due to underreporting and the challenges of distinguishing malicious from benign online activity. Existing research often remains divided between large-scale Internet measurements, which provide breadth but lack depth, and criminological studies, which offer detailed insights but rely on smaller datasets. This work argues that socio-technical measurements, combining both perspectives, can improve understanding and governance of cybercrime.

The research is structured around five studies. The first two chapters focus on cryptojacking, a cybercrime involving the unauthorized use of computing resources for cryptocurrency mining. The first study assesses the prevalence of cryptojacking on websites, identifying attack vectors, targeted website categories, and large-scale campaigns. The second extends this inquiry to compromised infrastructure, particularly MikroTik routers, revealing a broader and more organized set of cryptojacking operations. Using Internet traffic analysis and campaign mapping, this chapter uncovers the operational lifecycles of infected infrastructure and the varying sophistication of attackers.

The third study addresses phishing, particularly targeting Dutch citizens. By examining the development and trade of phishing kits, the research uncovers the full life cycle of phishing campaigns against the Dutch financial sector. Insights into attackers’ techniques, including their use of TLS certificates and phishing kit usage, inform policy recommendations for anti-phishing initiatives.

The fourth study examines the anti-abuse ecosystem, focusing on how intermediaries such as hosting providers handle abuse reports. Through access to the internal data of a Dutch hosting provider, the study shows that responses depend largely on the source and type of abuse notification. Governance instruments like blocklisting or law enforcement pressure prove more effective in eliciting responses than individual reports, highlighting gaps in current mitigation practices.

The fifth study reviews 38 academic works on phishing, booter services, and remote access trojans, structuring them through the concept of value chains. By comparing methods and data sources, and incorporating reflections from law enforcement professionals, the study identifies which scientific measurements are considered most valuable. This highlights the need for measurement approaches that align more closely with law enforcement priorities, especially regarding the development and monetization components of cybercrime.

The dissertation concludes by emphasizing that Internet measurements of cybercrime must reflect the intent and decision-making processes of criminals, as well as incorporate geographical demarcation to match the jurisdictional constraints of law enforcement agencies. Value chain analysis, lifecycle mapping, and campaign analysis emerge as tools for structuring meaningful measurements. Ultimately, the research demonstrates that bridging technical and criminological approaches produces insights that better serve governance needs and provide actionable intelligence for law enforcement.

Off-the-shelf, easy-to-deploy phishing kits are believed to lower the threshold for criminal entrepreneurs going phishing. That is, the practice of harvesting user credentials by tricking victims into disclosing these on fraudulent websites. But, how do these kits impact the phishing landscape? And, how often are they used? We leverage the use of TLS certificates by phishers to uncover possible Dutch phishing domains aimed at the financial sector between September 2020 and January 2021. We collect 70 different Dutch phishing kits in the un- derground economy, and identify 10 distinct kit families. We create unique fingerprints of these kits to measure their preva- lence in the wild. With this novel method, we identify 1,363 Dutch phishing domains that deploy these phishing kits, and capture their end-to-end life cycle – from domain registration, kit deployment, to take-down. We find the median uptime of phishing domains to be just 24 hours, indicating that phishers do act fast. Our analysis of the deployed phishing kits reveals that only a small number of different kits are in use. We dis- cover that phishers increase their luring capabilities by using decoy pages to trick victims into disclosing their credentials. In this paper, we paint a comprehensive picture of the tac- tics, techniques and procedures (TTP) prevalent in the Dutch phishing landscape and present public policy takeaways for anti-phishing initiatives.

Since the release of a browser-based cryptominer by Coinhive in 2017, the easy use of these miners has skyrocketed illicit cryptomining in 2017 and continued in 2018. This method of monetizing websites attracted website owners, as well as criminals seeking new ways to earn a profit. In this paper, we perform two large studies into the world of cryptojacking, focused on organized cryptomining and the spread of cryptojacking on the Internet. We have identified 204 cryptojacking campaigns, an order of magnitude more than previous work, which indicates that these campaigns are heavily underestimated by previous studies. We discovered that criminals have chosen third-party software - such as WordPress - as their new method for spreading cryptojacking infections efficiently. With a novel method of using NetFlow data we estimated the popularity of mining applications, which showed that while Coinhive has a larger installation base, CoinImp WebSocket proxies were digesting significantly more traffic in the second half of 2018. After crawling a random sample of 49M domains, ~20% of the Internet, we conclude that cryptojacking is present on 0.011% of all domains and that adult content is the most prevalent category of websites affected.