Inside Dark Web - Users, Markets, Lifecycle and Onion Links: Down The Rabbit Hole Part 6

In the fifth part of this series we covered how to access TOR with Tails OS, an access matrix to figure out the right setup, and some real world examples of the pros and cons of Tails OS. If you haven’t read the last part I would recommend starting there before diving into this one. Now that the initial setup is out of the way, it’s time to start exploring the dark web. Keep In Mind Before we go any further it’s worth clarifying what this part actually covers. The goal here is to give you the foundational knowledge to explore the dark web safely. Everything in this part stays within the bounds of passive exploration with no active engagement of any kind. Most of what follows is based on my own personal experiences and recommendations, alongside those of others I came across while researching for this series. Everything stated below is for educational purposes only. Follow along at your own risk. At the end of the day, this is not your regular internet. Most of these sites are hidden for a reason, and you are going to come across a lot of content that either falls in a legally grey area or sits completely outside the legal zone. The dark web is made up of hidden websites and services, and that is exactly what makes it the hidden part of the internet. The Ecosystem With the technology behind the dark web covered in the previous parts, it’s time to understand what we are actually walking into. In other words, it’s time to understand the dark web from the inside out. Let’s start from the very basics.What is an ecosystem?An ecosystem is defined by biologists as the interacting biotic community and its environment.In the context of the dark web, the biotic community refers to the users and the environment refers to the components they interact with. So let’s start with the users. A critical question to ask before you begin this journey is “Why?” Why do I need to access the dark web? Why do you need to access the dark web? Why does anyone need to access the dark web? Having an objective before you start is necessary. Without one you are going to end up wandering the dark web, and wandering is something you should never do here as it often ends with you at the wrong place at the wrong time, which can be genuinely dangerous. So have a goal before you go in. If you don’t have one or can’t think of one, don’t worry, I will cover that too. The answer to the why brings us to the different kinds of users that access the dark web and their reasons for doing so. Historically the dark web was a place for hackers, hobbyists and cyberphreaks to share knowledge and stay hidden. But with time this changed, especially with the emergence of bitcoin and cryptocurrencies, which eventually turned the dark web into an opportunity for cybercriminals and illegal vendors to stay hidden and scale their services. That is where the dark web started becoming what is called a “criminal convergence setting,” or in simpler words a place that facilitates crime. But beyond criminals there are a diverse range of users who access the dark web, which brings us to a few key groups: 1. ResearchersResearchers from all kinds of domains, ranging from criminology to cybersecurity, access the dark web to study criminal patterns, behaviours, incidents and events. 2. Threat Intel Analysts and Threat HuntersThe dark web is a den for cybercriminals who frequently appear in chats and forums. It is also where breached data, malware and illegal substances are widely sold and shared, making it a crucial space for threat intelligence and threat hunting. 3. Investigators (Law Enforcement and Private)There are often signals before a crime occurs and the dark web is a good place to look for them. Monitoring dark web forums and chatrooms not only helps in investigating cybercrimes but can also help prevent them by uncovering plots before they happen. And then there are the less crime oriented users like journalists, activists and whistleblowers who use the dark web to share their thoughts without censorship or surveillance. Alongside them are the criminals themselves, dark web vendors, cybergangs, scammers and hackers who leverage TOR and hidden services to their advantage.With the users covered, let’s move to the components they interact with. Dark Web Components Underground MarketsA major part of the dark web ecosystem is the underground market. From Silk Road to AlphaBay there have been an ever growing number of markets. A lot of people don’t expect the dark web to be structured, but one of the first things you will notice during your exploration is how well organised it actually is. The markets are a close replica of a real world corporate environment. So rather than thinking of them as a crime syndicate, think of them as a supply chain with interdependent components. The Dark Web Supply ChainThis supply chain has three main components 1. CommoditiesalphabayThe commodity market involves the storefronts or retailers, the ones who actually sell things or provide a platform for selling and exchanging commodities like drugs, fake government documents, weapons and all kinds of illegal substances. The variety of things being sold is genuinely unbelievable. The best example is AlphaBay, widely known as the Amazon of the dark web. These services can be B2B, like a multi vendor marketplace that provides a platform for vendors to sell on, or B2C where the vendor directly engages with customers. 2. Operationslockbit These are mostly B2B markets that provide ready to use services similar to SaaS or PaaS, like ransomware as a service, hacker for hire, DDoS as a service and so on. The best example is LockBit, a major ransomware as a service operation. They sell end products or services to threat actors and do not directly engage with the targets. 3. Enablers genesisThese are the entities and markets that provide the key components, infrastructure and basic necessities for a threat actor to carry out an attack. This includes crypto mixers, initial access brokers, malware developers and bulletproof hosting. These are B2B and never directly engage with the targets. A popular example is Genesis Market, an invite only market that sold stolen credentials.Most of the markets you come across will fall into one of the above categories.It’s also important to know that these markets are extremely volatile. A market that exists today can vanish tomorrow.Which brings me to another pattern you will start to notice. Underground Markets Lifecycle The majority of major dark web markets end up in one of four ways. 1. Getting Seized The most common way for a market to wind up is getting seized by law enforcement. Silk Road and AlphaBay are the classic examples. Most major markets get seized just a few years into their operation, which is a good reminder that getting popular on the dark web attracts a lot of attention from law enforcement agencies. Example 1: Operation Onymous In a rough translation, onymous means bearing a name while anonymous means someone with no name. The objective of this operation was to do exactly that put a name to the markets.Operation Onymous was a joint law enforcement operation between the FBI and Europol with police forces from 17 countries involved. It led to the seizure of multiple major markets including Silk Road 2.0, Cloud 9 and Hydra, with the founder of Silk Road 2.0 arrested along with 17 others. It also involved a lot of controversy surrounding a suspected zero day exploit for TOR, something we covered in a previous part of this series.An important thing to note is that most of the time the feds won’t disclose that a market has been seized and will instead keep it running as a honeypot to lure more targets. Breaking TOR is not a practical option for them, so this is the play.Example 2: PlaypenOperation Pacifier led to the seizure of one of the largest onion sites hosting CSAM and became the largest hacking operation in US law enforcement history. It started with a tip from a foreign law enforcement agency about an onion site called Playpen hosting CSAM. The tip also mentioned that the site had a misconfiguration exposing its real server location in the US. The FBI raided the location, seized the site and stayed silent. They also injected what is known as a NIT or Network Investigative Technique, a malware tool used to uncover a device’s identity by exposing variables and registries that reveal the real IP address, directly into the site. This is a classic example of a watering hole attack, where an attacker compromises a target website with the intention of infecting all the users who visit it.What made this one of the most ethically controversial cases in dark web history was the fact that the FBI kept serving content on the site for nearly two weeks before shutting down operations.By the end of the operation, nearly 900 people were arrested worldwide. A few cases were later dropped due to the legal controversy surrounding the tactics the FBI employed. 2. Shutting Down Operations Another way a market ends is by voluntarily shutting down. The reasons are usually unclear, mostly tied to the operators’ own risk tolerance. Perhaps they got spooked after a competitor was seized. Markets that close voluntarily usually do it fairly, returning funds for undelivered products or services to users, though this is very uncommon. Example 3: White House Market https://flare.io/learn/resources/blog/white-house-market-is-officially-retiring White House Market was one of the biggest markets of its time, filling the gap left by Dream Market. What made WHM stand out was its strict adherence to opsec, using PGP for all communications and Monero exclusively for all transactions. Just as it was rising in popularity, after two years of operation, WHM announced its retirement through a post explaining that it had reached its goal. Users were given time to withdraw their funds, which was a rare and genuinely graceful way for a market to close without running off with the money. 3. Exit Scams Another common way a market disappears is through an exit scam. These can occur in two ways: A market was intentionally built as a scam from the start. It may make a few legitimate deliveries to build trust and goodwill, then once enough money has been pooled in, the operators disappear, leaving customers waiting for products or services that will never arrive. A market that started with genuine intentions may get spooked by a competitor being raided or getting hacked. Rather than returning the money for undelivered orders, they just vanish with it. Example 4: Empire Market https://www.bleepingcomputer.com/news/cryptocurrency/dark-web-market-empire-down-for-days-from-ddos-attack/The textbook exit scam example is Empire Market. It operated for over two and a half years following the model of AlphaBay and generated over $430 million in transactions. When it faced an intense DDoS attack from someone trying to extort the market, the operators saw it as the perfect opportunity to disappear. They shut the market down without letting users withdraw their money and vanished with close to $30 million. Both founders were later arrested and charged, and it was confirmed by law enforcement that they were the people behind Empire Market. 4. Cyberattacks Another reason markets shut down is as a direct consequence of cyberattacks, whether a DDoS disrupting operations or a rival leaking or exploiting a vulnerability. The motivations can vary , it could be a competitor trying to shut the market down or a straight up extortion attempt. Example 5: Versushttps://www.bleepingcomputer.com/news/security/darknet-market-versus-shuts-down-after-hacker-leaks-security-flaw/Versus was a popular multi vendor market offering drugs, hacking services and stolen credit cards, and it promoted itself as a security driven platform. That reputation took a hit in 2022 when an anonymous hacker posted a proof of concept exploit on Dread demonstrating how a vulnerability could expose the IP addresses of the servers. Versus went quiet for a while and later confirmed the vulnerability was real after conducting an internal assessment. Deciding the risk of continuing was too high, they announced their retirement and shut down gracefully. We saw how a market dies but what about: How it is born?Every time a market shuts down a wave of new markets pops up or existing ones gain popularity. When a market closes its user base panics and scatters, and new markets rise to meet that desperate need. The best example isSilk Road 2.0 which launched just a month after Silk Road’s closure. This same void also creates a golden opportunity for exit scams. The best example is Sheep Marketplace, which grew significantly in the wake of Silk Road’s collapse. It claimed the money had been stolen by a vendor before closing, but it was later revealed to have been an exit scam all along and remains an excellent case study in cryptocurrency forensics and tracing digital currencies. This is a cycle that never stops. When markets shut down new ones emerge, and the dark web economy never really slows down. Social Platforms and Communication ChannelsSocial platforms like forums are the entry point into the deeper ecosystem of the dark web. They are the gateway for many people and we will soon look at why. But first let’s understand what these social platforms actually consist of. Forums cover a large chunk of dark web social platforms and serve a wide and diverse range of users and topics. Some bring technical expertise like the XSS forum, a forum dedicated to hackers. Some are dedicated to the exchange of illicit services and goods like BreachForums, known for selling breached data. Others are for general discussions like Dread, the dark web equivalent of Reddit. Forums can mostly be seen as a multi tiered structure. At the lowest level you have forums like Dread which are free and openly accessible, mostly for general discussion. Then you have the mid tier which requires a vouch or a small fee for entry, like the infamous hacker forum Exploit.in. Then comes the high tier which is mostly invite based and completely inaccessible without a formal invitation, like the notorious Mazafaka Network, a Russian cybercrime forum. IRC chats are more of a thing of the past, but you will still find web chat rooms active on the dark web. There is a lot more to the social platform landscape but this is just an overview. Most of these channels are multi tiered as mentioned, some exclusive, some open, and some are just copies of the originals. Either way this is most likely going to be your entry point. Everything Else: Micro Blogging and Popular sites The next component covers everything else, from micro blogging and personal blogs to popular onion sites. One of the best examples in this category is the Darknet Bible, a guide for darknet vendors and for anyone who wants to navigate the dark web with good opsec. Accessing the Ecosystem Now, that we are familiar with the ecosystem, a question that remains is..How do we access it ?First of all you need an onion link or URL. Without one you cannot access anything at all. There are multiple ways to find onion URLs, ranging from CLI tools to search engines, but the goal here is to keep it simple and safe. I have categorized the main ways you can find onion links right from your TOR Browser. Most of the methods below are accessible from the surface web and also offer an onion version. If the onion version is available, always choose it, and be cautious regardless of which route you go. 1. Search EnginesHow do you find webpages on the surface web?You use a search engine. When it comes to the dark web it works a little differently.These are not your typical surface web search engines like Google, Brave or Bing. Remember hidden services never leave TOR, you cannot access them from the surface web. They live entirely in the onion space, so you need a search engine that can actually crawl it. While there are various options out there, the one I personally use and recommend is Ahmia. Why Ahmia? ahmia.fiIt was developed with support from the TOR Project through Google Summer of Code, it filters out CSAM, and by 2023 they expanded the filter to include all sexually explicit material, which unfortunately makes up about one fifth of hidden services on the dark web. When hunting for onion links you will encounter a lot of noise, and the majority of that noise falls into the category we just discussed. Ahmia cuts through it, narrowing down the results to what you are actually looking for.Ahmia works in two ways: first like a true search engine it scrapes the dark web for onion links and indexes them second it allows hidden service owners to register their URL directly with Ahmia to make their service discoverable. That said, most dark web search engines barely scratch the surface and a centralised search engine like this is only a temporary solution. Ahmia is accessible from both the surface web and the dark web as an onion service.ahmia.fi search resultsTry it yourself, visit ahmia.fi and search for dread, if you are in surface web none of the onion links in the results would work2. Social PlatformsThe dark web runs mostly on word of mouth. Trust is the most valuable currency here and word of mouth is one of the main ways it gets built. Most forums and markets need users, so they often promote and publicize their hidden service URLs across different platforms. Most surface web platforms do block and censor the sharing of hidden service links like the 2018 ban on the subreddit r/DarknetMarketsis a good example of this, and it was part of the reason why Dread was eventually built. You might still find links on Reddit or other surface web social media, but I mostly recommend using Dread as your starting point since you can maintain your opsec while hunting for links. /r/DarknetMarkets 2013 WaybackMachine Try it yourself, if you are curious what the subreddit had, you can rewind in time and find out, visit wayback machine and search for “reddit.com/r/DarknetMarkets” 3. Directories Before sophisticated crawlers and search engines existed, manually indexed directories were the most popular way into the dark web. The most well known example, which you may have already come across, is the Hidden Wiki. In fact this was my own entry point. These are essentially just directories of links to hidden services that are manually updated. While this was more common in the past it is still widely used today. Another example is daunt.link, a directory developed and maintained by the same people behind Dread. daunt.link Try it yourself, visit daunt.link and see what you find Word of caution the modern versions of Hidden Wiki and similar directories are filled with phishing scams and compromised links, making this one of the least secure ways to find hidden services 4. Link DumpsThese are pastebins of various kinds that store links to hidden services. Again these are manually updated, and onion links are not the only thing you will find in them, so expect to do some digging. site:pastebin.com “.onion” Try it yourself, use google dorks to find pastebins with onion links: site:pastebin.com “.onion” One important thing to keep in mind as we move from search engines down to social platforms is that the trust level drops significantly at each step. Most of these sources are either compromised or straight up phishing. Apply your common sense when clicking links and remember nothing in the dark web can be trusted. Whats Next ? You now have a solid picture of the ecosystem you are about to enter and the ways to navigate it. But there is still one critical piece left before we go in, and that is opsec. In the seventh and final part we will talk about why it matters and what it actually looks like in practice. Hang tight for part seven.. Until next time, stay safe..