A structured lexicon of the slang used in online fraud and cybercrime, compiled by Threat Hunter’s underground economy research team, free for the whole industry and updated continuously. Most terms come from Chinese-speaking communities; others are in Portuguese, English and Southeast Asian languages. Every entry has a definition, and many also record the term’s role in the fraud supply chain, sanitized real-world usage and what the word means in ordinary contexts, so you can read the slang and keep your detection rules clear of false positives.
Headwords keep the language they’re used in, mostly Chinese. Definitions and notes are written in Chinese for now, and your browser’s translate feature works on them. Everything else on this page is in English.
Categories follow where the slang sits in the supply chain: from raw materials, accounts and devices to monetization and money flow, plus three that run across the whole chain. Pick one to see all of its entries.
UpstreamDownstream+ Across the chain
Browse
Search, filter and read the details
No matching entries. Try other words, or . Missing a term? Suggest a new entry.
Network
connections in one graph
Each dot is an entry and each line a connection between two entries; color shows which part of the supply chain the entry belongs to. Drag to pan, scroll or pinch to zoom, and click any dot to open the entry.
Laying out…
Color only marks the three parts of the chain. Hover over a dot to see its category, or pick one under Category above. You can also browse all entries as a list.
Word families
18 roots that show how slang is made
Slang isn’t random. New terms tend to follow the same word-formation patterns, so when you meet one that isn’t in the lexicon yet, its root tells you roughly where it sits in the chain.
How to use
How to read, use and cite it
How to read an entry
Variants
Other ways the same term is written: alternative spellings, homophones, abbreviations
Definition
What the term means, in one sentence
Role in the chain
What the term does in the underground supply chain, and which links up- and downstream it connects
Example (sanitized)
Real-world usage, with platform names, contact details and links removed
Why no example
Shown in place of an example when none can be published, with the reason
Ambiguity & false positives
What the word means in ordinary contexts, which is where false positives come from
Related
Related entries; click one to keep exploring
Confidence
Frequency
How often the word shows up in our monitoring corpus (common / fairly common / rare); for prioritizing rules, not a measure of risk
Added in
The release that first included the entry
Writing detection rules with it
Fine as rules on their own: obfuscated spellings such as 实符 (for 实付, “amount paid”) and 简届 (for 简介, “bio”) aren’t words in standard Chinese, so a hit is highly suspicious and false positives are rare.
Need combined signals: terms that are also everyday words, such as 丝滑 (“silky smooth”), only count together with co-occurring words such as 通道 (“channel”) and 入金 (“deposit”).
Mind who is speaking: victims use the same words. For example, 假发货 (“fake shipping”) shows up mostly in buyers’ complaints.
Frequency is for prioritizing rules, not a measure of risk.
Get the data and contribute
The full lexicon is free on GitHub as a Markdown document, a spreadsheet (CSV) and structured data (JSON), with entry text in Chinese.
Entry data is licensed under CC BY 4.0: you may copy, adapt and use it commercially, with attribution.
Notes
This lexicon is for security research, risk detection and public education. Every entry describes language and mechanisms only, and provides no operational guidance. Examples are sanitized. Platform categories and industry names in entries do not imply wrongdoing by any party; the platforms being abused are the ones bearing the risk. No one may use this lexicon for unlawful purposes.
