OSINT 101: Dark Web Investigations: Window Shopping in the World’s Dodgiest Market

By Tech Corsair

The dark web occupies a peculiar space in the collective imagination -- part digital bogeyman, part techno-thriller set piece, and part genuinely useful intelligence source that security researchers would be foolish to ignore. It is, in many ways, the internet's dodgy car boot sale: mostly junk, occasionally something genuinely valuable, and you should probably wash your hands afterwards regardless.

This article is a guided tour. Look, take notes, understand the landscape -- but for the love of all that is holy, do not touch anything. Think of it as visiting a crime scene gift shop: fascinating merchandise, questionable provenance, and someone is definitely watching the CCTV.

The Dark Web Landscape: A Field Guide to Digital Underworlds

Before diving in, some terminology housekeeping. The surface web is everything indexed by Google and friends. The deep web is everything behind a login or paywall -- your email inbox, your banking portal, that recipe site that makes you disable your ad blocker. The dark web is a subset of the deep web accessible only through overlay networks like Tor, I2P, or Freenet. Not everything on the dark web is illegal. Plenty of it is just privacy-conscious communication. But the bits that make the news tend to involve someone selling something they really shouldn't be.

Centralised Marketplaces: The Department Stores of Crime

Centralised dark web markets operate much like any e-commerce platform, complete with vendor ratings, escrow services, dispute resolution, and customer reviews. The irony of criminals building trust-based commerce systems is not lost on anyone.

These markets -- the successors to the original Silk Road -- typically deal in drugs, counterfeit documents, malware, and stolen data. They rise, attract law enforcement attention, and fall with remarkable regularity. AlphaBay, Hansa, and Hydra all followed this trajectory. Law enforcement has become rather good at the "let one market absorb fleeing users from a seized competitor" play -- Operation Bayonet in 2017 being the textbook example, where the Dutch police secretly ran Hansa for a month while the FBI took down AlphaBay, hoovering up intelligence on every migrating vendor.

Auto-Carding Shops: Swipe and Go

Auto-carding shops are the vending machines of the criminal ecosystem. No negotiation, no human interaction -- just a search interface where buyers filter stolen card data by issuing bank, country, card type, and balance. Select, pay in cryptocurrency, receive data. The automation is, from a purely technical standpoint, impressively streamlined. From an ethical standpoint, it is deeply grim.

These shops source their inventory from point-of-sale malware, web skimmers (Magecart-style attacks), and phishing campaigns. Card data is typically sold as "dumps" (magnetic stripe data for cloning) or "fullz" (complete identity packages including name, address, date of birth, and Social Security or National Insurance numbers).

Credential Markets: Identity as a Service

Credential markets represent perhaps the most concerning evolution in dark web commerce. Genesis Market, before its takedown in Operation Cookie Monster in April 2023, did not merely sell usernames and passwords. It sold complete digital fingerprints -- browser cookies, session tokens, device configurations -- allowing buyers to impersonate victims so convincingly that multi-factor authentication often failed to flag the intrusion.

Genesis Market operated on an invitation-only basis and offered a dedicated browser plugin that loaded the victim's digital identity wholesale. The buyer did not need to crack passwords or bypass MFA; they simply became the victim's browser. It was identity theft elevated to an art form, and its takedown required coordination across 17 countries.

Other credential markets trade in bulk database dumps, combo lists (email:password pairs harvested from breaches), and stealer logs -- output from info-stealing malware like RedLine, Raccoon, and Vidar that hoovers up saved passwords, autofill data, and cryptocurrency wallet files from infected machines.

Forums and Paste Sites: The Watercooler of Cybercrime

Dark web forums serve as the social infrastructure of the criminal ecosystem. They are where threat actors build reputations, recruit collaborators, share tools and techniques, and occasionally engage in remarkably petty disputes. Reading through forum drama between ransomware operators arguing about revenue splits is like watching a soap opera scripted by people who really should have chosen different careers.

Forums like the now-defunct RaidForums (seized in 2022) and its successor BreachForums serve as clearing houses for stolen data. Initial access brokers advertise compromised networks. Malware developers hawk their wares. And every so often, someone posts a tutorial that reads like a SANS course written by someone with fewer ethical guardrails.

Paste sites -- both on the surface web and the dark web -- serve as dead drops for leaked data, configuration files, and communication. They are ephemeral by design, making monitoring them a game of speed and persistence.

Investigation Techniques: Looking Without Touching

Dark web investigation is a discipline that rewards patience, caution, and a healthy appreciation for operational security. It is emphatically not the time to click links with the same carefree abandon one might apply to a Wikipedia rabbit hole at 2 AM.

Breach Database Searches

One of the most immediately useful investigative techniques is searching breach databases for compromised credentials associated with a target domain or email address. This is relevant for both offensive security assessments (with authorisation) and defensive intelligence.

Have I Been Pwned (HIBP) remains the gold standard for legitimate breach checking. For deeper investigation, commercial platforms aggregate and index dark web breach data, allowing security researchers to:

• Identify which employees of an organisation have had credentials exposed
• Determine whether exposed passwords follow predictable patterns (spoiler: they usually do)
• Track whether credentials are being actively traded or are from older, stale breaches
• Correlate email addresses across multiple breaches to build a picture of an individual's online footprint

Google Dorking for Dark Web Surface Exposure

Here is a delightful irony: dark web content regularly leaks onto the surface web. Cached versions of .onion sites, forum posts mirrored by archival services, and screenshots shared on social media all create surface web exposure of ostensibly hidden content.

Useful Google dork patterns for dark web research include:

site:reddit.com "onion" "market"
inurl:paste "breach" "database"
filetype:txt "combo" "email" "password"
site:web.archive.org ".onion"
"leaked database" filetype:sql

These searches will not find active dark web content directly, but they frequently uncover discussions about, references to, and fragments of dark web activity that are indexed on the surface web.

Forum Monitoring and Account Tracking

Sustained intelligence gathering from dark web forums requires a methodical approach. Security researchers engaged in this work typically:

• Create and maintain personas with plausible backstories and consistent behaviour patterns. Rushing in and immediately asking about specific threat actors is roughly as subtle as an undercover officer asking "where might one purchase the illegal drugs?"
• Track usernames across platforms using the same OSINT correlation techniques applied to surface web investigations. Threat actors, being human, frequently reuse handles, writing styles, and operational patterns across multiple forums
• Monitor specific threads and vendors relevant to their organisation or clients, watching for mentions of corporate names, domain names, IP ranges, or industry-specific targeting
• Archive everything because dark web content has a tendency to vanish without warning -- markets go offline, forums get seized, posts get deleted by paranoid moderators

IOC Enhancement from Dark Web Sources

For threat intelligence analysts, the dark web is a rich source of context that can transform a bare indicator of compromise (IOC) into actionable intelligence. A suspicious IP address found in firewall logs becomes considerably more interesting when dark web research reveals it being advertised as a bulletproof hosting node on a Russian-language forum.

Dark web IOC enhancement activities include:

• Malware sample sourcing: finding samples of malware families observed in the wild, along with documentation and configuration details shared by their authors
• Infrastructure mapping: identifying command-and-control servers, bulletproof hosting providers, and proxy networks discussed in criminal forums
• Attribution support: correlating technical indicators with threat actor personas active on dark web platforms
• Early warning: monitoring forums and markets for mentions of specific industries, technologies, or organisations being targeted

The Toolbox: Equipped for the Expedition

Tor Browser: The Front Door

Tor Browser is the primary means of accessing .onion services. Security researchers using Tor for investigations should observe some basic hygiene:

• Use a dedicated machine or virtual machine -- never the same system used for corporate email or accessing sensitive internal resources
• Do not log into personal accounts while using Tor. The entire point is anonymity; logging into Gmail rather defeats the purpose
• Disable JavaScript where possible (Tor Browser's security slider set to "Safest" does this) -- malicious JavaScript on dark web sites has been used to de-anonymise visitors
• Do not download files and open them outside the Tor environment. Documents can phone home, and suddenly that operational security is looking rather threadbare
• Use bridges if operating from a network where Tor usage itself might attract attention

Tails OS: The Amnesiac Investigator

Tails (The Amnesic Incognito Live System) is a live operating system that boots from a USB drive, routes all traffic through Tor, and leaves no trace on the host machine when shut down. It is the gold standard for investigative operational security and is about as close to "disposable computing" as one can get without literally setting the laptop on fire afterwards.

Tails is particularly valuable because it eliminates the risk of accidentally contaminating a host system or leaving forensic artefacts of an investigation on a work machine.

Commercial Intelligence Platforms

For organisations with budget, commercial dark web intelligence platforms provide curated, searchable access to dark web data without requiring analysts to spend their days personally trawling through criminal forums.

• DarkOwl provides a vast archive of dark web content, indexed and searchable, with APIs for integration into threat intelligence workflows
• Recorded Future aggregates dark web intelligence alongside surface web and technical sources, providing contextualised threat intelligence with a focus on actionable output
• Flashpoint specialises in threat actor intelligence from illicit communities, covering both dark web and encrypted messaging platforms

These platforms are not cheap, but they significantly reduce the operational risk and time investment of dark web intelligence gathering. They also tend to have rather better search functionality than the markets themselves, which is saying something.

OSINT Frameworks

• Maltego excels at relationship mapping and visualisation. Feed in an email address, domain, or username, and Maltego will spider out through transforms to map connections across data sources -- including dark web indices. The resulting graphs frequently resemble the conspiracy theory boards beloved of television detectives, but with rather more evidentiary basis
• SpiderFoot automates OSINT collection across over 200 data sources, including dark web search engines, paste sites, and breach databases. It is particularly useful for reconnaissance automation and can be self-hosted for those who prefer their OSINT tools to stay firmly on-premises

Ransomware Intelligence: Monitoring the Extortion Economy

The ransomware ecosystem has become one of the most significant dark web intelligence targets, not least because ransomware groups have developed an unfortunate habit of publicly naming their victims on dedicated leak sites (also known as "shame sites" or "name-and-shame blogs").

Monitoring Leak Sites

Most major ransomware groups operate Tor-hosted leak sites where they post evidence of compromises, countdown timers, and eventually the stolen data itself if the ransom goes unpaid. Groups like LockBit, BlackCat/ALPHV, Cl0p, and their various successors maintain these sites as part of their double-extortion business model.

Security researchers monitor these sites to:

• Identify compromised organisations before the breach becomes public knowledge, enabling faster incident response
• Track threat actor activity patterns -- posting frequency, victim selection, and claimed capabilities
• Collect technical intelligence from leaked data that reveals TTPs, such as ransomware configuration files, initial access vectors discussed in victim negotiations, and infrastructure details

Ransomware-as-a-Service: The Franchise Model

The Ransomware-as-a-Service (RaaS) model means that the developers and the operators are frequently different groups. Developers build the malware, maintain the infrastructure, and handle negotiations. Affiliates -- recruited through dark web forums -- conduct the actual intrusions, deploy the ransomware, and receive a percentage of any ransom paid (typically 70-80%).

Monitoring the recruitment and operational discussions of RaaS programmes provides invaluable intelligence about emerging threats, new capabilities, and shifts in targeting strategy. When a major RaaS operation advertises for affiliates with experience targeting specific industries or technologies, that is a signal worth paying attention to.

Tracking Threat Actor TTPs

Dark web forums provide a window into the operational tradecraft of ransomware operators. Threat actors discuss:

• Initial access methods they have found successful (exploiting specific CVEs, purchasing access from initial access brokers, phishing campaigns)
• Defence evasion techniques that have worked against specific EDR products
• Negotiation strategies and victim interaction approaches
• Infrastructure preferences including hosting providers, VPN services, and cryptocurrency mixing services

This intelligence feeds directly into defensive strategy. If a ransomware group known to target a specific sector is discussing a new exploitation technique on a forum, that is the cue for defenders to check their exposure.

Conclusion: Look, Learn, but Mind the Gap

Dark web investigation is a legitimate and increasingly essential component of the threat intelligence lifecycle. It provides context that no amount of firewall logs and SIEM alerts can replicate -- the attacker's perspective, their tools, their infrastructure, and occasionally their remarkably poor operational security.

But it demands respect. Operational security is not optional. Legal boundaries are not suggestions. And the line between "researching threats" and "participating in criminal marketplaces" is one that security researchers must navigate with the precision of a bomb disposal technician -- methodically, carefully, and with full awareness that one wrong move can make the whole thing go rather badly.

The dark web is not going away. Neither are the threat actors who inhabit it. Understanding their ecosystem is not morbid curiosity -- it is professional necessity. Just remember the golden rule of dark web investigation: take notes, take screenshots, and for heaven's sake, do not take the merchandise.

All techniques described in this article should be conducted within legal boundaries and in accordance with applicable laws and organisational policies. Dark web investigation without proper authorisation and operational security is inadvisable at best and criminal at worst.