11 Jul 2024

Where to Gather Intelligence for Deep and Dark Web Investigations

Sergio Leal Rodriguez

The surface web, the deep web, and the dark web all provide useful information for analysts to explore and draw from for use in their OSINT investigations. The deep, and the dark web contain far more data compared to the surface web, and though both are used by people from all walks of life, they are often thought to be the source of a sizeable chunk of illegal activities in both the real and digital worlds.

The wealth and type of information contained in the deep and dark web, combined with the higher security access and the degree of anonymity they provide, are what have essentially turned them into prime real estate for threat actors.

By the same token, this flurry of threat actor activity has also led investigators and analysts from various industries to consider the deep and dark web as prime sources of information. However, while gaining access to data on the surface web is quite simple and performed daily, accessing data on the deep and dark web can be considerably trickier and requires more consideration and resources.

So, what are the differences between the deep and dark web? Why is the data they contain so useful not only to threat actors but to investigators and analysts alike?

In our whitepaper, you will find answers to those and more questions. It will also provide you with a list of data sources and ready-to-replicate workflows to support your deep and dark web investigations. Download now or follow along to take a look at some of the insights first!


Differences Between the Surface Web, Deep Web, and Dark Web 🔗︎

Before we delve into the deep and dark web, and why accessing data from these layers is relevant to investigations, let’s quickly touch upon the surface web.

Surface Web 🔗︎

Also known as the visible, open, or public web, the surface web is the most superficial layer of the internet and encompasses everything that is accessible via search engines that use page indexing, such as Google or Bing. Searching the surface web usually returns a good deal of results that can be narrowed down using a range of dorking techniques.

As endless as popular search engine results may often appear, surface web data still amounts to less than 5% of what is contained on the internet. It is precisely that remaining 95% that constitutes the deep and the dark web and our topic at hand.

Deep Web vs. Dark Web 🔗︎

Unlike the surface web, these two layers represent the non-indexed content available on the internet. This means content which cannot be found using common search engines like Google or Bing. However, there are substantial differences between the deep and the dark web.

For instance, unlike the dark web, the deep web doesn’t require specific software to be accessed. Still, its contents can’t be identified, tracked, or crawled by standard search engines because it is either password-protected or kept behind specific internet services for privacy and security reasons.

The data contained within our email inboxes, online banking services, and even job intranets are examples of the deep web. And, as you can imagine, this data is usually only available to the user and the service providers, unless specific allowances for investigators are made in the terms of service, such as for criminal investigations.

The dark web, on the other hand, isn’t indexed by search engines and is accessible via specialized networks such as The Onion Router (TOR), I2P, or Freenet, which are designed to enable anonymous communication over the internet. This makes it a valuable source of intelligence for those who know how to navigate it.

When discussing the key differences between using conventional web browsing and accessing the dark web via specialized networks, it is necessary to distinguish between browsers like Google Chrome and entire networks like TOR.

Google Chrome utilizes standard internet protocols to access websites through easily understandable URLs. In contrast, networks such as TOR operate on unique protocols designed specifically for anonymity. These protocols then affect how URLs are structured. Unlike standard web addresses, TOR URLs are derived from the public key as part of the protocol, making them almost impossible to guess, remember, or understand.

Oftentimes, information stolen from the deep web, be it passwords or other privileged data, ends up being sold on the dark web. However, not everything that transpires there is of a criminal nature. Journalists, activists, and politicians working and reporting under corrupt or totalitarian regimes use it to gather, collaborate, and exchange information without fear of being harassed or prosecuted.

The Scope of Deep and Dark Web Investigations 🔗︎

As mentioned before, some threat actors lurk within the deep web, where they use techniques such as phishing and social engineering to steal personal data, defraud individuals, or get a foothold into a specific organization. They might then turn towards the dark web to profit from their schemes by selling the stolen data or the kits they developed for their schemes.

Others may prefer the enhanced anonymity of the deep and dark web, as it allows them to conduct their illegal activities anonymously, be it hacktivism, exchange of CSAM material, trading illegal goods, such as drugs or weapons, or disseminating content that incites violence and facilitates terrorist activities.

Because of that, analysts and investigators use data from the deep and dark web for different types of investigations:

For one, analysts can study the interactions between extremist groups, criminal organizations on dark web forums, and, in specific cases, law enforcement can use seized data from private messages to support their investigations.

For others, the deep and dark web can help bolster cybersecurity when used as a source of enrichment. This allows them to:

  • confront fraud by tracking mentions of their brand and products across different forums.
  • react to insider threats by tracking paste sites and chatter regarding password or data leaks.
  • enhance physical security by monitoring underground chatter.
  • gain insight into how their current policies and processes may be enabling criminal activities, such as human trafficking, to take place.

Where to Gather Intelligence for Deep and Dark Web Investigations 🔗︎

IMPORTANT!

Before discussing where to gather this type of intelligence, it is necessary to note that investigating deep and dark web forums means that law enforcement agencies (LEAs) don’t just passively monitor these forums from a distance but actively engage in them to gather intelligence and evidence. This requires LEA officers to use undercover or sock puppet accounts to infiltrate these forums.

To ensure appropriate rules are followed and protective measures are taken, each country must have legislation related to undercover agents, so it is important for investigators to operate within the established legal framework.

For example, to verify if someone is selling illegal goods, LEA officers must engage in one-on-one conversations through private messages with sellers and provide proof of illegal activity. This engagement must comply with relevant laws, as not all countries permit such investigative methods.


Regarding where to gather the intelligence, there are several options to explore, starting with forums and communities where dark web users interact, monitor dark web marketplaces to observe transactions of illegal or stolen goods, and access data breach sites to enrich their findings.

Some deep web forums also have social media components or are discussed on surface web platforms, where users may share information about dark web activities. This is another valuable option for investigators, especially in the early stages of an investigation when no concrete starting point has yet been identified.

However, it is important to point out that manually searching for and collecting such intelligence is time-consuming and requires maintaining high operational security to avoid leaving digital footprints that could expose the investigator’s identity and intentions.

For these reasons, investigators may use tools like Maltego, which facilitates the process of collecting and analyzing data from the deep and dark web while keeping the searches within the tool anonymous. Using Maltego, investigators can leverage data from a number of providers of breached data and information on dark web users, their activities on forums, and more.

How can your team leverage deep and dark web intelligence in Maltego?

Download Full Version 🔗︎

Access the full version of this whitepaper now to see an extensive list of recommended sources for deep and dark web intelligence to help conduct and enrich your team’s work!

Inside, you will also find real-life examples showing how to use these sources as data integrations within Maltego, along with ready-to-replicate workflows to maximize your team’s success.

Download the resource

DE +49
Albania +355
Algeria +213
Andorra +376
Angola +244
Anguilla +1264
Antigua And Barbuda +1268
Argentina +54
Armenia +374
Aruba +297
Australia +61
Austria +43
Azerbaijan +994
Bahamas +1242
Bahrain +973
Bangladesh +880
Barbados +1246
Belarus +375
Belgium +32
Belize +501
Benin +229
Bermuda +1441
Bhutan +975
Bolivia +591
Bosnia and Herzegovina +387
Botswana +267
Brazil +55
Brunei Darussalam +673
Bulgaria +359
Burkina Faso +226
Burundi +257
Cambodia +855
Cameroon +237
Canada +1
Cape Verde +238
Cayman Islands +1345
Central African Republic +236
Chile +56
China +86
Cote d'Ivoire +225
Colombia +57
Comoros +269
Congo +242
Cook Islands +682
Costa Rica +506
Croatia +385
Cuba +53
Cyprus +90392
Czech Republic +42
Denmark +45
Djibouti +253
Dominica +1809
Dominican Republic +1809
Ecuador +593
Egypt +20
El Salvador +503
Equatorial Guinea +240
Eritrea +291
Estonia +372
Ethiopia +251
Falkland Islands (Malvinas) +500
Faroe Islands +298
Fiji +679
Finland +358
France +33
French Guiana +594
French Polynesia +689
Gabon +241
Gambia +220
Georgia +7880
Germany +49
Ghana +233
Gibraltar +350
Greece +30
Greenland +299
Grenada +1473
Guadeloupe +590
Guam +671
Guatemala +502
Guinea +224
Guinea-Bissau +245
Guyana +592
Haiti +509
Honduras +504
Hong Kong +852
Hungary +36
Iceland +354
India +91
Indonesia +62
Iran, Islamic Republic of +98
Iraq +964
Ireland +353
Israel +972
Italy +39
Jamaica +1876
Japan +81
Jordan +962
Kazakhstan +7
Kenya +254
Kiribati +686
Korea, Democratic People's Republic of +850
Korea, Republic of +82
Kuwait +965
Kyrgyzstan +996
Lao People's Democratic Republic +856
Latvia +371
Lebanon +961
Lesotho +266
Liberia +231
Libyan Arab Jamahiriya +218
Liechtenstein +417
Lithuania +370
Luxembourg +352
Macao +853
Macedonia, the former Yugoslav Republic of +389
Madagascar +261
Malawi +265
Malaysia +60
Maldives +960
Mali +223
Malta +356
Marshall Islands +692
Martinique +596
Mauritania +222
Mauritius +230
Mayotte +269
Mexico +52
Micronesia, Federated States of +691
Moldova, Republic of +373
Monaco +377
Mongolia +976
Montserrat +1664
Morocco +212
Mozambique +258
Myanmar +95
Namibia +264
Nauru +674
Nepal +977
Netherlands +31
New Caledonia +687
New Zealand +64
Nicaragua +505
Niger +227
Nigeria +234
Niue +683
Norfolk Island +672
Northern Mariana Islands +670
Norway +47
Oman +968
Pakistan +92
Palau +680
Panama +507
Papua New Guinea +675
Paraguay +595
Peru +51
Philippines +63
Poland +48
Portugal +351
Puerto Rico +1787
Qatar +974
Reunion +262
Romania +40
Russian Federation +7
Rwanda +250
San Marino +378
Sao Tome and Principe +239
Saudi Arabia +966
Senegal +221
Serbia +381
Seychelles +248
Sierra Leone +232
Singapore +65
Slovakia +421
Slovenia +386
Solomon Islands +677
Somalia +252
South Africa +27
Spain +34
Sri Lanka +94
Saint Helena +290
Saint Kitts and Nevis +1869
Saint Lucia +1758
Sudan +249
Suriname +597
Swaziland +268
Sweden +46
Switzerland +41
Syrian Arab Republic +963
Taiwan +886
Tajikistan +7
Thailand +66
Togo +228
Tonga +676
Trinidad and Tobago +1868
Tunisia +216
Turkey +90
Turkmenistan +993
Turks and Caicos Islands +1649
Tuvalu +688
Uganda +256
United Kingdom +44
Ukraine +380
United Arab Emirates +971
Uruguay +598
United States +1
Uzbekistan +7
Vanuatu +678
Holy See (Vatican City State) +379
Venezuela +58
Viet Nam +84
Virgin Islands, British +84
Virgin Islands, U.S. +84
Wallis and Futuna +681
Yemen +967
Zambia +260
Zimbabwe +263

By clicking on "Access", you agree to the processing of the data you entered and you allow us to contact you for the purpose selected in the form. For further information, see our Data Privacy Policy.

Don’t forget to follow us on Twitter, LinkedIn, Mastodon, and sign up to our email newsletter, so you don’t miss out on updates and news!

Happy investigating!

About the Author 🔗︎

Sergio Leal Rodriguez

Sergio Leal Rodriguez 🔗︎

Sergio is an experienced and dedicated professional with more than 20 years of invaluable experience in coordinating, investigating, modeling data, and researching cybercrimes with a focus on the critical field of Child Sexual Abuse at Europol’s AP TWINS. His expertise lies in coordinating multi-agency efforts as well as conducting thorough investigations, and he has actively contributed to the development of innovative methodologies for data analysis and modeling in the context of child sexual abuse.

By clicking on "Subscribe", you agree to the processing of the data you entered and you allow us to contact you for the purpose selected in the form. For further information, see our Data Privacy Policy.