Disciplines

🕶 Dark Web Intelligence (DARKINT)

🔍 Lookup

📊 Pre-built Queries · Dark Web Intelligence

📜 Playbook — Dark Web Intelligence collection

1. Direction — frame the requirement for Dark Web Intelligence: what decision does this support, by when?
2. Collection — collect from the 0 mapped sources (0 free) — filter the catalog by DARKINT; capture provenance and observe OPSEC.
3. Processing — normalize, de-duplicate and enrich the collected data.
4. Analysis — correlate against local holdings; apply ACH; assign confidence.
5. Dissemination — open a case, draft a report, share via STIX/MISP.
6. Feedback — set an alert rule / watchlist to monitor for change.

⚡ AI Skills & Automation

Automate unattended via the cron pipeline (collect → ingest → resolve → enrich → score → alert).

🗃 Data Management

🧩 Advanced Capabilities

✨ Enrichment pathways

🎯 Mission

Dark Web Intelligence collects and analyzes activity from Tor and I2P hidden services, criminal markets, ransomware leak sites, and closed forums. It answers whether an organization's data is being sold or leaked, whether it is named as a ransomware victim, and what adversary personas and chatter reference the organization or its sector.

📡 Collection methods

• Crawling and indexing Tor/I2P hidden services and onion directories
• Monitoring ransomware data-leak sites for new victim disclosures and countdown timers
• Scraping criminal markets and forums for listings referencing the organization, brand, or credentials
• Tracking adversary personas across forums, escrow, and Telegram channels
• Extracting cryptocurrency addresses and contact handles from listings for downstream correlation
• Fingerprinting onion services (SSH keys, analytics IDs, mail servers) to deanonymize infrastructure

📚 Key sources & datasets

🎫 Data points produced

🔧 Tools & frameworks

• TorBot
• OnionScan
• Tor Browser
• Photon
• Katana
• Fresh Onions
• Maltego
• Telethon

📜 Dark Web Intelligence Tradecraft

1. Crawl onion directories, leak sites, and monitored forums/channels against a watchlist of brand and sector keywords
2. Extract and normalize listings, victim posts, handles, and crypto addresses, capturing screenshots and timestamps as evidence
3. Analyze context to judge whether a mention is a genuine compromise, resale, or noise, and gauge data sensitivity
4. Attribute posts to a persona or ransomware affiliate by correlating handles, PGP keys, wallet reuse, and writing style
5. Disseminate early-warning briefs to incident response and legal with the source, freshness, and confidence of each finding
6. Trigger IR engagement, law-enforcement referral, and monitoring for follow-on publication or price changes on the listing

📊 Dashboard KPIs

🔍 Pre-built queries

🔗 Cross-discipline pivots

🗃 Data Management

🧩 Advanced Capabilities