In recent years, cybercrime has risen substantially. New media are used as platforms for the trading of ready-to-use cybercrime products and as virtual locations for offenders to converge. This...Show moreIn recent years, cybercrime has risen substantially. New media are used as platforms for the trading of ready-to-use cybercrime products and as virtual locations for offenders to converge. This study illustrates how Telegram is utilized for the trading of phishing tools and methods, by offenders to find co-offenders and to co-offend. The study employs a netnographic research framework consisting of a combined method including an observational study and quantitative data analysis. The results describe a variety of phishing-related products that are advertised on Telegram in addition to the range of activities and behaviours occurring in relation to these markets. The value of this research is two-fold, namely (i) describing and mapping a part of the cybercriminal ecosystem and thereby improving our knowledge and situational awareness and (ii) developing and applying a blended method of netnography and data analysis, providing numbers with the qualitative observations.Show less