<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: conducting-dark-web-reconnaissance
description: >-
  Perform dark web reconnaissance to monitor .onion services, paste sites,
  underground forums, and marketplaces for threat intelligence, leaked data,
  and organizational exposure indicators.
domain: cybersecurity
subdomain: osint-recon
tags:
  - dark-web
  - tor
  - onion-services
  - threat-intel
  - paste-monitoring
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: >-
  Tor Browser, torsocks, OnionScan, Ahmia, DarkSearch API,
  IntelligenceX API, stem (Tor control library).
metadata:
  mitre-attack:
    - "T1597"      # Search Closed Sources
    - "T1597.001"  # Search Closed Sources: Threat Intel Vendors
    - "T1589.001"  # Gather Victim Identity Information: Credentials
---

# Conducting Dark Web Reconnaissance

## Overview

Dark web reconnaissance monitors Tor hidden services (.onion), underground
forums, paste sites, and marketplaces for organizational threat intelligence.
Objectives include detecting leaked credentials, stolen data for sale,
targeted threat actor discussions, and exposed infrastructure. This work
requires careful OPSEC and legal awareness.

## Prerequisites

- Tor service running locally (`tor` daemon)
- torsocks for proxying CLI tools through Tor
- Python 3.10+ with `requests`, `stem`, `beautifulsoup4`
- Ahmia.fi for .onion search indexing
- IntelligenceX API key (optional, for historical data)
- Dedicated VM or Tails OS for isolation

```bash
sudo apt install tor torsocks
pip install requests[socks] stem beautifulsoup4 PySocks
```

## Quick Reference

| Task | Command |
|------|---------|
| Start Tor | `sudo systemctl start tor` |
| Verify Tor | `torsocks curl -s https://check.torproject.org/api/ip` |
| Ahmia search | `curl -s "https://ahmia.fi/search/?q=example.com"` |
| Curl via Tor | `torsocks curl -s http://example.onion/` |
| DarkSearch API | `curl -s "https://darksearch.io/api/search?query=example.com"` |
| OnionScan | `onionscan --verbose http://example.onion` |

## Workflow

### Step 1: Environment Setup

```bash
# Start Tor service
sudo systemctl start tor

# Verify Tor connectivity
torsocks curl -s https://check.torproject.org/api/ip
# Should return {"IsTor": true, ...}

# Configure SOCKS proxy for Python
# Tor default SOCKS: 127.0.0.1:9050
```

### Step 2: Dark Web Search Engines

```bash
# Ahmia — clearnet search of .onion sites
curl -s "https://ahmia.fi/search/?q=example.com" | grep -oP 'https?://[a-z2-7]{56}\.onion[^"]*'

# DarkSearch API
curl -s "https://darksearch.io/api/search?query=example.com&page=1"

# IntelligenceX — historical and dark web data
curl -s -H "x-key: $INTELX_KEY" \
  "https://2.intelx.io/intelligent/search" \
  -d '{"term": "example.com", "maxresults": 100}'
```

### Step 3: Paste Site Monitoring

```bash
# Monitor paste sites for organizational mentions
# Pastebin (via Google dorking)
# site:pastebin.com "example.com"

# IntelligenceX paste search
curl -s -H "x-key: $INTELX_KEY" \
  "https://2.intelx.io/intelligent/search" \
  -d '{"term": "@example.com", "media": 1}'
```

### Step 4: .onion Service Analysis

```bash
# Crawl specific .onion site via Tor
torsocks curl -s "http://exampleonion.onion/" -o page.html

# OnionScan — analyze .onion service security
onionscan --verbose --jsonreport report.json http://exampleonion.onion

# Extract linked .onion addresses
torsocks curl -s "http://exampleonion.onion/" | grep -oP '[a-z2-7]{56}\.onion'
```

### Step 5: Automated Monitoring

```python
import requests

def dark_web_search(query: str, proxy: str = "socks5h://127.0.0.1:9050") -> dict:
    """Search dark web indexes for mentions."""
    results = {}

    # Ahmia search (clearnet)
    try:
        resp = requests.get(
            "https://ahmia.fi/search/",
            params={"q": query},
            timeout=30,
        )
        results["ahmia"] = {"status": resp.status_code, "found": query.lower() in resp.text.lower()}
    except Exception as e:
        results["ahmia"] = {"error": str(e)}

    return results
```

## OPSEC Considerations

- **Never use personal identity** — dedicated sock puppet required
- **Use Tails OS or Whonix** — prevents data leakage
- **Never run JavaScript** in Tor Browser on untrusted .onion sites
- **Don't download files** from dark web without sandboxing
- **Time your activity** — avoid creating identifiable patterns
- **VPN before Tor** — adds a layer but may indicate Tor usage
- **Document everything** — timestamps, URLs, screenshots for evidence

## Detection Opportunities

- Tor exit node traffic detected by network monitoring
- Corporate mentions on dark web detected by threat intel vendors
- Paste site monitoring services alert on keyword matches

## Verification

- [ ] Tor connectivity verified and OPSEC measures in place
- [ ] Dark web search engines queried for organizational mentions
- [ ] Paste sites monitored for credential dumps and data leaks
- [ ] .onion services relevant to the target catalogued
- [ ] Findings documented with timestamps and source URLs
- [ ] Legal and ethical guidelines followed throughout

## References

- [Ahmia](https://ahmia.fi/)
- [IntelligenceX](https://intelx.io/)
- [OnionScan](https://github.com/s-rah/onionscan)
- [Tor Project](https://www.torproject.org/)
- [DarkSearch](https://darksearch.io/)

---
v1.0 | Validated: 2026-03-17
