Orientation: The Dark Web as an Intelligence Source

The dark web intelligence map

The six elements are the periodic table of this course, and the map lays them out in the one arrangement that shows how they act on one another — so read it as a mechanism, not as a poster. Start on the left with the terrain. Its three layers are defined by how a page can be reached, not by what is on it. The surface web is whatever a search engine indexes and any browser can open — and it matters to this course more than people expect, because a lookalike of your domain, a fake job advert under your brand or a paste of stolen data on a public site all live there. The deep web is everything not indexed: webmail, online banking, intranets, anything behind a log-in. It is most of the web and almost entirely mundane; the popular claim that "the deep web is huge and sinister" confuses the two meanings. The dark web is the small, deliberately hidden part reachable only through overlay networks, where onion services — sites whose own location is hidden by the same relaying — can run without revealing their servers. Module 3 explains onion routing as a concept (A2), onion services (A3), and the legitimate uses that are the reason these networks exist at all (A4): the networks grew out of research at the US Naval Research Laboratory in the 1990s, Tor was released publicly in the early 2000s and is maintained by the Tor Project, major news organisations such as the BBC and The New York Times run onion versions of their sites so readers under censorship can reach them, and SecureDrop, maintained by the Freedom of the Press Foundation, uses onion services so whistleblowers can reach journalists. The venue boxes on the map have no names and no addresses, and they never will in this course; what matters to a defender is the category. Forums are where criminals advertise, discuss and build reputation; markets are where goods and services are listed for sale; extortion leak sites are where ransomware groups name victims and publish stolen files to pressure them into paying; messaging channels and paste sites carry the same trade on ordinary platforms; and stealer-log collections are the bulk output of information-stealing malware — passwords, cookies and session tokens copied from infected computers — sold in markets and channels. What is traded there falls into a handful of classes — credentials, access to organisations, stolen data, tools and services — and Modules 7 to 9 read them as an economy (T1–T6), on leak sites (X1–X6) and in markets (P1–P6). Now the most important line on the drawing: . It is glass because the defender can through it — through the provider's reporting — and it is a wall because nothing Kestrel does passes the other way. No arrow on the map ever crosses it from right to left: no browsing, no account, no message, no purchase, no download. That is not timidity. Participating in a criminal venue, even to "check", can break computer-misuse law, can mean handling stolen personal data with no lawful basis, can fund the people who stole it, can expose the analyst and the organisation to the very groups being watched, and can contaminate the evidence a later investigation needs. Module 2's six commitments (B1–B6) are the wall's specification, and Module 4 builds it (C1–C6). Move right to . Two channels feed it, and both cross the wall only as . The collects from the terrain under its own contract, legal terms and safety controls, matches what it sees against Kestrel's watchlist, and delivers — descriptions of what was found, with the stolen material itself withheld or reduced to what Kestrel needs to act. The watches for Kestrel's email domains in breached datasets as they circulate; the best-known public example of the idea is , run by Troy Hunt, whose domain search lets an organisation learn which of its addresses appear in known breaches, and whose design lets a password be checked against breach data through a range query that never reveals the password itself. Both channels pass through the : the written (C3), signed by the CFO and reviewed by counsel, and the provider's contract. The funnel narrows what arrives — duplicates removed, matches to the watchlist kept, personal data minimised — and the reads its output. The are where the third question is answered. Every card carries two things a raw alert does not. The records how far the source can be trusted and how far the information is corroborated — course 011's reliability and credibility scale, applied in Module 10 (V1) — because a criminal's advertisement is marketing, and criminals exaggerate, recycle old data and scam one another. The records whether the signal has been shown, by evidence, to concern Kestrel: a check, a cross for a false match, a third-party mark when the victim is a supplier whose exposure becomes Kestrel's, and an open circle for strategic signals that concern a whole sector. The answers the fourth question, and its rule is simple: an alert that does not end in an owned action is noise that cost money. Each move has an owner chip — and for credentials and sessions, for evidence that an advertised access is real, for the people and organisations affected, for the teams a fraud will target, for the threat model, detection rules and awareness. And underneath everything runs , because monitoring is never finished: requirements drive collection, collection is processed, analysed and disseminated to an owner, and the feedback from what happened rewrites the requirements and the watchlist. Each later module lights one part of the map: Module 3 the terrain, Module 4 the wall, the legal gate and the funnel, Module 5 the requirements at the start of the cycle, Module 6 the credential cards, Module 7 the venue boxes as an economy, Module 8 the leak site, Module 9 the market box and the "is it us?" tick, Module 10 the grade chips, Module 11 the action board, Module 12 the cycle with its measures, and Module 13 the whole map.

Traced instance: Kestrel's first six months of watching. The programme starts the week after course 017's Week 30 review, at Monitoring Week 0 — Month 14 of the security programme that courses 014, 016 and 017 followed. In Weeks 0–2 four decisions are made and written down. The collection model (Module 4's C1): a licensed threat-intelligence provider, Northlight Intelligence, monitors dark-web forums, markets, extortion leak sites, messaging channels and infostealer-log collections against Kestrel's watchlist and delivers sanitised alerts through its portal; a breach-notification service monitors Kestrel's email domains; Kestrel's analyst triages; and there is no in-house direct access to criminal venues, a decision recorded with counsel. The cost is about €40–70k a year for the subscription plus about 0.2 of the analyst's time (illustrative). The mandate (C3), written, signed by the CFO and reviewed by counsel: observe only; no purchases; no contact with criminals; no accounts or personas on criminal venues; never download, open or test leaked data; the provider's own collection governed by its contract and legal terms; findings handled under data-protection rules. Six intelligence requirements (Module 5's Q1): IR1 are Kestrel or portal credentials exposed? IR2 is access to Kestrel or Brenholt offered for sale? IR3 are Kestrel or its key suppliers listed on extortion leak sites? IR4 are Kestrel design files, ERP or customer data being offered? IR5 are Kestrel's executives' personal details exposed in ways that enable fraud — watched only with each executive's consent (course 017's B2)? And IR6, the strategic one: what are ransomware and access-broker groups doing towards mid-sized European manufacturers? And a watchlist (Q3): Kestrel's and Brenholt's domains, the portal's domain, brand and product names, Kestrel's public address ranges, the names of the top 20 suppliers, and — with consent — the CEO's and CFO's names and work addresses, and nothing more personal than that. Then the signals arrive, and the map shows what each one became. about Kestrel staff email addresses appear in combined lists from old breaches of unrelated third-party sites (fact). The identity team runs the directory's own — a hashed check; nobody tries a leaked password — and finds accounts still using a password from a known breach (fact). The 9 are reset; every account already had MFA (course 014's ); there is no sign of misuse. a log from , infected with information-stealing malware, contains (fact, from the provider's sanitised extract). Within the account's sessions are revoked and its password reset, the distributor is told through its known contact, and the portal's log-in history is checked: . MFA alone does not protect a stolen session token, because the token is what a browser holds MFA has been passed; course 017's Week 20 fix, shorter sessions, had already limited the window. a forum listing offers "remote access to a European metal foundry, about 200 staff" — a possible match for Brenholt, with about 210. Over the analyst finds that the listing names a different country and a type of remote access Brenholt does not run, and Brenholt's internet exposure is re-checked by authorised means: nothing found. Assessment: ; the provider keeps watching the seller. a ransomware group lists , one of Kestrel's top-20 suppliers, on its extortion leak site, and the provider's description of the "sample" files includes (fact, from the provider's description — ). Lunde is contacted through known contacts and confirms an incident; counsel is consulted on Kestrel's position; accounts payable and the buyers are warned to expect fraud using real order details; and the payment-change rule (course 014's ) is re-briefed. In an email to accounts payable quotes a real Lunde purchase-order number and asks for payment to "new bank details"; it is refused under K8 and reported (fact). the appear in a large leaked dataset from a breached consumer service (fact); the CFO's personal controls from course 017 — hardware security keys () and a carrier lock () — are already in place, the CFO is informed, and the only further step is a reminder to family (course 017's ). the provider's quarterly reports describe continued listing of mid-sized manufacturers on leak sites and access brokers advertising remote-access footholds (assessment, moderate confidence); they feed course 017's threat-model update and the awareness programme. At the the numbers are plain (illustrative): about provider alerts; about closed as not relevant after triage; actionable — AL1, AL2, AL4, AL5 and two minor brand-misuse items handed to marketing; false match investigated (AL3); a median of about from alert to first action, and 4 hours for AL2. The value is an assessment, not a fact, and the review says so: AL2 and AL4 each closed an access or fraud path before it was used. The review renews the provider for a year, extends the supplier watchlist to the , drops low-value keyword watches that produced only noise, adds Brenholt's new domains after integration, and keeps "no in-house direct access". Notice what the map does show: no arrow back through the wall, no "sample" opened on a Kestrel computer, and no verified tick on AL3 — because the evidence said it was not Kestrel, and an honest map records a false match as carefully as a true one.

From dark web tourist to intelligence analyst

The gap between the two is the whole value of the course, and it is worth being fair to the tourist first. The tourist is usually conscientious: someone in security hears that the company's name has "appeared on the dark web", feels responsible, and wants to see for themselves. Executives make it worse by asking for screenshots. Vendors make it worse by selling fear: a dashboard counting "dark web mentions" in red is easy to sell and hard to act on. The trouble is structural, and each of the tourist's habits fails in a specific way. The first is browsing out of curiosity, which answers no question anyone wrote down; without requirements there is no way to decide what matters, so everything does. The second is using a work laptop and a work identity. A criminal venue is hostile ground: its operators and users watch who visits, and a visit traced to a company network tells them that company is watching — or offers them a target. Module 4 (C4) sets the policy that replaces this: no corporate identity, no personal devices, approved environments only, and for most organisations no direct access at all. The third is downloading "samples" and buying "proof". A sample from an extortion listing is stolen data, often including other people's personal data; holding it can create legal duties and liabilities under data-protection law such as the EU's GDPR, and it can carry malware. Buying proof funds the people who stole it and can itself be unlawful; it also teaches the seller that the victim is listening. Module 2's B3 — exposed data is evidence, not loot — and B1 — observe, never participate — exist for exactly this. The fourth is panic at every mention. Most mentions are noise: Kestrel's own review closed about 30 of about 45 alerts as not relevant, and the discipline is to triage rather than to escalate everything. The fifth is not telling recycled data from new. Criminals repackage old breaches as fresh ones, inflate the size of what they hold, and scam each other; AL1's 140 addresses came from old third-party breaches, and treating them as a new Kestrel breach would have sent the wrong message to the board and to staff. The sixth is answering "is it us?" by hunch. AL3 shows both halves of the discipline: a listing that looked like Brenholt was checked for three days, and the evidence — a different country, a type of access Brenholt does not run, a clean exposure check — said no, at moderate confidence. A tourist would either have declared a Brenholt breach or dismissed the listing unread. The seventh is having no playbook, so that an alert produces anxiety but no owned step; the eighth is exposing the organisation legally — through the visits, the downloads and the purchases above, or by mishandling the personal data of the staff whose details leaked. The public record shows why "observe only" is also the safer bet: the venues the tourist would visit are themselves under watch. was shut down by the FBI in ; and were taken down in in a coordinated international operation; German authorities seized the servers of in ; , which sold stolen browser credentials and session data of exactly the kind AL2 found, was taken down in an international operation in ; and in an international operation led by the UK's , Operation Cronos, disrupted the ransomware group. Anonymity on these networks has limits, and a defender who has stepped inside a venue may be among what investigators find. The replaces each habit with a discipline. It starts from — IR1 to IR6 — so that every watch exists to answer a question. It , so that collection is lawful, contracted and someone else's specialist job. It : AL4 was handled entirely from the provider's of the sample, which was enough to warn accounts payable. It . It , as AL3 did. It : AL2's sessions were revoked within 4 hours because the playbook named who revokes. It (B6): the 9 AL1 staff and the AL2 distributor were victims of other people's breaches and malware, and treating them as culprits would have taught everyone to hide the next one. And it — time to first action, how many alerts were actionable, which watches produced only noise — and retires what does not earn its place. None of these disciplines is exotic. What the course adds is how to do each one, in the right order, on a real programme — and what the contrast in the figure makes concrete: the tourist's version of AL4 ends with a stolen file on a Kestrel laptop and an accounts-payable team that was never warned, so the Week 16 email meets luck rather than a rule; the analyst's version ends with the same email refused under K8, and no money lost.

The method — thirteen rungs

The course is thirteen modules, and their order follows the four questions — with one deliberate twist. The channel comes before the questions, because the first thing an organisation must settle is not what it wants to know but what it is allowed to do; requirements written before the boundary tend to ask for things no lawful channel can deliver. After this orientation, Module 2, The Dark Web Analyst's Discipline & Boundary, installs six commitments that govern everything else, tagged B1–B6 and cited by those tags throughout. B1, observe, never participate: no buying, selling, engaging, personas, "verification buys" or contact with criminals. B2, lawful and authorised collection: a written mandate, counsel's review and provider contracts, and no collection without them. B3, exposed data is evidence, not loot: never download, open, test or use it; minimise and protect what you hold. B4, graded and verified: criminals exaggerate, recycle and scam, so every claim is sourced, graded and checked before action. B5, analyst safety and wellbeing: separation by policy, no personal or corporate identity exposed, and exposure to harmful content managed. B6, act to protect, without blame: notify, reset, warn and learn, with no shaming of the people whose data leaked. Module 2 is a gate: the rest of the course assumes it. Modules 3 and 4 answer how may we lawfully learn it? How the Dark Web Works — the Terrain covers surface, deep and dark web and their myths (A1), overlay networks and onion routing as a concept (A2), onion services and why they exist (A3), legitimate uses — journalism, whistleblowing, censorship circumvention and privacy (A4), where criminal trade actually happens, by category (A5), and the limits of anonymity as public takedowns show them (A6). Safe & Lawful Collection covers building, buying or combining a capability (C1), the legal frame — computer-misuse law, handling stolen personal data, never purchasing, and counsel deciding (C2), the mandate and rules of engagement (C3), separation and attribution risk at policy level (C4), analyst wellbeing and harmful content (C5), and records and audit of every collection activity (C6). Module 5, Intelligence Requirements & the Monitoring Plan, answers what do we need to know?: from fear to priority requirements (Q1), what to watch (Q2), watchlists and their own privacy — a watchlist of executives' names is itself sensitive (Q3), what sources and providers can and cannot see (Q4), thresholds and triage routing (Q5), and reviewing the plan (Q6). read what surfaces. covers where credentials leak (L1), matching without misuse — hashed comparison, never logging in with a leaked password (L2), infostealer logs as a special risk (L3), verifying a claimed data theft without downloading it (L4), breach-notification services and domain monitoring (L5), and the exposed-credential playbook (L6). reads the criminal economy as a service economy (T1): , who sell footholds into organisations (T2); , its affiliates and — encrypting systems threatening to publish stolen data (T3); and credential markets (T4); fraud ecosystems such as business email compromise, at awareness level (T5) — the FBI's annual reports have consistently listed business email compromise among the costliest reported cybercrime types — and trust and reputation among criminals, which decide how far a claim can be believed (T6). covers what leak sites are and how they pressure victims (X1), watching them for yourself and your suppliers (X2), verifying a listing as new, recycled, exaggerated or false (X3), the third-party case (X4), the legal and ethical lines (X5), and what law-enforcement disruption, LockBit in 2024 above all, teaches (X6). covers what is traded, by category (P1), reading a listing as a signal without engaging (P2), "is it us?" and false matches (P3), trends as hedged strategic intelligence (P4), market life cycles, exit scams and takedowns (P5), and the things an analyst never does (P6). answer the last two questions. covers grading dark-web sources on the A–F / 1–6 scale (V1), claims as marketing (V2), corroboration with your own telemetry (V3), confidence and probability language (V4), the tactical alert, operational brief and strategic report (V5), and sharing with CERTs, sector groups and law enforcement under the , whose version 2.0 FIRST published in 2022 (V6). covers alert-to-action playbooks (R1), credential exposure (R2), access offered for sale (R3), data on a leak site (R4), executive and personal exposure, with course 017's personal controls (R5), and feeding detection, threat models and awareness, with tactics named in terms (R6). run and prove the capability. covers the operating model and roles (O1), choosing and managing a provider (O2), measures that matter — time to action, true-positive rate, coverage (O3), cost and value stated honestly (O4), legal and privacy reviews (O5), and improving and retiring watch items (O6). runs the whole method on Kestrel's programme, from the first requirement to the Week 26 review, and compresses it into a master equation and a self-assessment. Every module from 2 to 12 is built the same way: six , the sub-techniques of its rung, each with a tag (Module 3's A1–A6, Module 6's L1–L6, and so on) and each dissected through six fixed fields — it is, its (drawn on the intelligence map), the as a numbered procedure, its and failure modes, to use it and when not, and it connects to the rest. Kestrel is traced through every atom with labels that never collide with the atom tags: intelligence requirements and alerts . Earlier courses' work is cited by course: course 014's controls such as (MFA), (the MDR service) and (payment-change verification), and course 017's labels such as and (the portal events), (consent) and the CFO's personal controls , and . The world is fictional so that a whole monitoring programme — false matches and noise included — can be shown without exposing anyone's real organisation or real people; Kestrel's people are named by role only, and Northlight Intelligence and Lunde Packaging are fictional. Where the course uses real-world material — Tor and its origins, the legitimate onion services of news organisations and SecureDrop, the public takedowns named above, Have I Been Pwned, the Traffic Light Protocol, the intelligence cycle, ATT&CK tactic names, the industry's terms for access brokers, ransomware-as-a-service, double extortion and infostealers, data-protection law in general terms and the IC3's reporting — it stays at the level the public record supports, and it invents no statistics.

How to read this course

This is a dissection course, not a tour: every technique is broken down to its mechanism and its procedure, so you finish not with a collection of frightening screenshots but with a repeatable way to turn the criminal economy's advertising into early warning — and to explain your decisions to the people who must approve, fund and act on them. Three things to hold onto as you go. First, ask before you watch: write down what you need to know before anyone subscribes to a feed or searches for a name. Kestrel's six requirements decided its watchlist, its provider and its triage, and they are why about 30 of the review's 45 or so alerts could be closed at triage — each was measured against a question and found not to answer it. Second, never cross the wall: everything the course teaches happens on the analyst's side of it. You learn what the terrain is so that you can judge what a provider tells you, not so that you can go there; you read descriptions of stolen data, never the data; and when a question can be answered only by entering a venue, the right answer is that the provider, under its contract, or law enforcement, under its powers, answers it — or that it goes unanswered (B1, B2, B3). Third, verify before you react, then act fast: a claim on the dark web is an advertisement until it is graded and checked, as AL3 was over three days — but once a signal is shown to be about you, speed is the value, as AL2's revocation in 4 hours was. Say not known when it is: whether the distributor's stolen session token in AL2 was ever offered to anyone beyond the log's collection is not known, and the response did not depend on knowing. One note on scope: the course teaches method, not any jurisdiction's law; wherever a question turns on computer-misuse law, data protection, notification duties or law-enforcement contact, the course's answer is to take it to counsel. Hold those three and the rest is detailed machinery. Module 2 makes the discipline explicit first, because a subject this close to crime is only useful to a defender who can be trusted to stay on the right side of the wall.