<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: analyzing-dark-web-threat-intelligence
description: >-
  Collect and analyze threat intelligence from dark web forums, marketplaces, and
  paste sites. Covers Tor-based collection, credential leak monitoring, ransomware
  negotiation tracking, and underground economy analysis.
domain: cybersecurity
subdomain: threat-intelligence
tags:
  - dark-web
  - tor
  - underground-forums
  - credential-leaks
  - ransomware
  - osint
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1593"]
---
# Analyzing Dark Web Threat Intelligence

## Overview

Dark web threat intelligence involves monitoring underground forums, marketplaces,
paste sites, and Tor hidden services for threat data including credential leaks,
zero-day sales, ransomware victim listings, and threat actor communications. This
skill covers safe collection methodology, credential leak analysis, ransomware
group monitoring, and structuring underground intelligence into actionable reports.

## Prerequisites

- Python 3.10+ with `requests`, `beautifulsoup4`, `stem` libraries
- Tor SOCKS proxy (tor service or Tor Browser) for .onion access
- Isolated VM for dark web collection (never on corporate network directly)
- Understanding of operational security for dark web research
- API access to credential monitoring services (HaveIBeenPwned, DeHashed)

```bash
pip install requests beautifulsoup4 stem PySocks
```

## Key Concepts

### Intelligence Sources

| Source Type | Examples | Intelligence Value |
|-------------|----------|-------------------|
| Forums | XSS, Exploit.in, BreachForums | Actor communication, zero-day sales |
| Marketplaces | Various rotating .onion sites | Credential sales, access brokers |
| Paste sites | Pastebin, Ghostbin, PrivateBin | Data leaks, IOC dumps, manifestos |
| Ransomware sites | LockBit, BlackCat leak sites | Victim listings, negotiation data |
| Telegram channels | Various threat actor channels | Real-time comms, IOC sharing |

### Collection OPSEC

- **Dedicated VM**: isolated analysis environment, no personal accounts
- **Tor routing**: all .onion access through Tor SOCKS proxy (127.0.0.1:9050)
- **No interaction**: passive collection only — never register, post, or transact
- **Attribution avoidance**: no browser fingerprinting, disable JavaScript where possible
- **Data handling**: collected data stays on isolated system, TLP:RED by default

### Credential Leak Taxonomy

```
Combo list   → email:password pairs (bulk, low context)
Database dump → structured records with PII (high value)
Stealer logs → browser-harvested credentials with URLs (high confidence)
Access logs  → VPN/RDP credentials with target context (critical)
```

## Workflow

### Step 1: Safe Tor-Based Collection

```python
import requests

def fetch_onion_page(onion_url: str) -> dict:
    """Fetch .onion page content via Tor SOCKS proxy."""
    proxies = {
        "http": "socks5h://127.0.0.1:9050",
        "https": "socks5h://127.0.0.1:9050",
    }
    try:
        resp = requests.get(onion_url, proxies=proxies, timeout=30)
        return {
            "url": onion_url,
            "status": resp.status_code,
            "content_length": len(resp.text),
            "title": extract_title(resp.text),
        }
    except requests.exceptions.RequestException as e:
        return {"url": onion_url, "error": str(e)}

def extract_title(html: str) -> str:
    """Extract page title from HTML."""
    from bs4 import BeautifulSoup
    soup = BeautifulSoup(html, "html.parser")
    return soup.title.string.strip() if soup.title and soup.title.string else ""
```

### Step 2: Credential Leak Monitoring

```python
def check_hibp(email: str, api_key: str) -> dict:
    """Check HaveIBeenPwned for email in breaches."""
    resp = requests.get(
        f"https://haveibeenpwned.com/api/v3/breachedaccount/{email}",
        headers={"hibp-api-key": api_key, "user-agent": "TI-Platform"},
        timeout=15,
    )
    if resp.status_code == 200:
        breaches = resp.json()
        return {
            "email": email,
            "breach_count": len(breaches),
            "breaches": [
                {"name": b["Name"], "date": b["BreachDate"], "data_classes": b["DataClasses"]}
                for b in breaches
            ],
        }
    elif resp.status_code == 404:
        return {"email": email, "breach_count": 0, "breaches": []}
    return {"email": email, "error": f"HTTP {resp.status_code}"}
```

### Step 3: Ransomware Victim Monitoring

```python
def parse_ransomware_leak_site(html_content: str) -> list[dict]:
    """Parse ransomware leak site for victim listings."""
    from bs4 import BeautifulSoup
    soup = BeautifulSoup(html_content, "html.parser")
    victims = []
    for post in soup.find_all("div", class_="post"):
        victims.append({
            "victim_name": post.find("h2").text.strip() if post.find("h2") else "",
            "posted_date": post.find("time").text.strip() if post.find("time") else "",
            "description": post.find("p").text.strip()[:300] if post.find("p") else "",
            "data_size": post.find("span", class_="size").text if post.find("span", class_="size") else "",
        })
    return victims
```

## Detection

```yaml
title: Dark Web Threat Intelligence Detection
id: 09c5778a-1763-4044-b913-59c4d5c60c19
status: experimental
description: Detects suspicious activity related to analyzing dark web threat intelligence techniques in threat intelligence context
logsource:
  category: network_connection
  product: firewall
detection:
  selection:
    DestinationPort: 443
    Initiated: "true"
  condition: selection
level: medium
tags:
  - attack.t1593
  - attack.reconnaissance
falsepositives:
  - Threat intelligence platform aggregating feeds from approved sources
```

## Verification

- [ ] Tor-based collection retrieves .onion content through SOCKS proxy
- [ ] Credential leak monitoring checks multiple breach databases
- [ ] Ransomware leak site monitoring captures victim listings
- [ ] Collection follows OPSEC guidelines (isolated VM, passive only)
- [ ] Intelligence structured with TLP markings and confidence levels
- [ ] Findings integrated into MISP/OpenCTI with appropriate access controls

## References

- [HaveIBeenPwned API](https://haveibeenpwned.com/API/v3)
- [Tor Project](https://www.torproject.org/)
- [CISA Ransomware Guide](https://www.cisa.gov/stopransomware)
- [DarkOwl Vision](https://www.darkowl.com/)
- [Flare Systems](https://flare.io/)
