Data Points

🕶 Onion / Hidden Service

A Tor hidden service address on the dark web.

Cyber

Sources

0 no-auth

Disciplines

that use it

Mission domains

reach

Workbench

open →

native tool

🔧 Native workbench

Open Onion / Hidden Service workbench →Advanced search →Link analysis →

🔎 Live indicators (IoC view)

ONION indicators →IoC dashboard →Search onion →

🔗 Analyst pivots

Search platform →OSINT pivot →Source catalog →

🔍 Lookup

📜 Playbook — Onion / Hidden Service exploitation

Direction — frame the requirement for Onion / Hidden Service: what decision does this support, by when?
Collection — pull the 0 mapped sources (0 free) and the native workbench (open); capture provenance and observe OPSEC.
Processing — normalize, de-duplicate and enrich the collected data.
Analysis — correlate against local holdings; apply ACH; assign confidence.
Dissemination — open a case, draft a report, share via STIX/MISP.
Feedback — set an alert rule / watchlist to monitor for change.

⚡ AI Skills & Automation

🤖 Copilot brief ⚡ AI Skills Resolve Enrich Auto-Collect Hunt Report Export

Automate unattended via the cron pipeline (collect → ingest → resolve → enrich → score → alert).

🗃 Data Management

+ Case + Campaign Watchlist Tag Save search Whitelist Export STIX/MISP Report

🧩 Advanced Capabilities

Link Analysis Pivot Explorer Timeline Threat Hunting Analytics Detection Rules Blockchain OSINT Pivot Passive DNS TAXII 2.1 MISP Feed Create Alert Rule NetFlow Coverage & Gaps

✨ Enrichment pathways

Enrichment Runner →Resolve locally →Enrichment → local →Integrations →

🎫 Onion / Hidden Service

An onion address is a Tor hidden-service identifier derived from the service's public key, hosting sites reachable only inside the Tor network. It matters because darknet markets, leak sites, and C2 panels operate here, and onion-to-clearnet operational mistakes are prime deanonymization pivots.

Format: v3 onion: 56-char base32 + '.onion' (ed25519 pubkey); legacy v2: 16-char base32 (deprecated); reachable only via Tor/SOCKS.

📡 How it is collected

Darknet crawling via Tor gateways
Ransomware leak-site monitoring
Onion indexes and pastes scraping
Threat-intel and forum sharing
Malware config extraction (onion C2)
Ahmia / search-engine harvesting

📚 Enrichment & validation sources

Ahmia →Tor Metrics →OnionScan →Dark.fail →Ransomwatch / ransomlook →DarkOwl (public listings) →Recorded Future onion feeds →Intelligence X →

🔗 Pivot to

dp_certificate (SSL on onion) →dp_crypto_address (market wallets) →dp_ip (clearnet leak) →actor-profile / market operator →dp_breach (leak-site data) →dp_email (contact/PGP) →

🧩 Analysis & hunting techniques

OnionScan operational-security fingerprinting
SSH/SSL key correlation to clearnet hosts
EXIF / favicon leakage analysis
Onion-to-clearnet Apache mod_status leaks
Bitcoin address & PGP-key linkage
Uptime / availability tracking
Mirror / clone detection
Content-similarity clustering across services

🔧 Tools

Tor Browser / torsocks
OnionScan
Ahmia crawler
torify + curl
OnionSearch
Fresh Onions
eyeballer / screenshotting

⚡ Workbench actions

Fetch via Tor proxy
Run OnionScan opsec audit
Correlate SSL/SSH keys to clearnet
Extract crypto & PGP artifacts
Track uptime & mirrors
Screenshot & content-hash
Pivot to leak dataset
Cluster related services

📊 Dashboard KPIs

Uptime / availability %Opsec leak countLinked crypto addressesMirror countClearnet correlation confidence

📂 Open

Data point →Blockchain →Actor profile →OSINT →Link analysis →

Workstation · Copilot · AI Skills · Automation · Playbooks · Lookups · Docs · Reports

🤖 AI Copilot

Cron: 0 * * * * php /home/zaptf0zdggll/public_html/threats/cron.php

📜 Playbook

Open Response Playbook