Executive Summary 🔗︎
Maltego is an unparalleled tool when it comes to data mining and visualization, and our biggest sources of data—be it threat intel, social media, company data, or other OSINT data—are the different layers of the internet: the surface web, the deep web, and the dark web.
While the deep and the dark web is composed of far more data than the surface web, and used by people from all walks of life, it is often thought to be the source of a sizeable chunk of illegal activities taking place in both the real and the digital worlds.
The wealth and type of information contained in the deep and dark web, combined with the higher security access and the degree of anonymity they provide, is what has turned them into prime real-estate for threat actors.
By the same token, this flurry of threat actor activity has also led investigators and analysts from across industries to consider the deep and dark web as prime sources of information. However, while gaining access to the data in the surface web is quite simple and performed daily, accessing data in the deep and dark web can be considerably trickier and needs more considerations and resources.
So, what are the differences between the deep and the dark web? Why is the data they contain so useful not only to threat actors but to investigators and analysts alike?
Before we delve into the deep and dark web, and why accessing data from these layers is relevant to investigations, let’s quickly touch upon the surface web.
Also known as visible, open, or public web, the surface web is the most superficial layer of the internet and encompasses everything that is accessible via search engines that use page indexing, such as Google or Bing.
As endless as the search results on Google may oftentimes appear, the surface web amounts to less than 5% of what is contained on the internet. It is precisely that remaining 95% that constitutes the deep and the dark web and our topic at hand.
Deep Web vs. Dark Web 🔗︎
Unlike the surface web, these two layers represent the non-indexed content available on the internet. This means it can’t be found with your common Google search, however, there are substantial differences between the deep and the dark web.
For instance, unlike the dark web, the deep web doesn’t require a particular browser to be accessed. Still, its contents can’t be identified, tracked, or crawled by standard search engines because they’re either password-protected or kept behind specific internet services. The data contained within our email inboxes, online banking services, and even job intranets are examples of the deep web. And, as you can imagine, this data is usually only available to the user and the service providers, unless specific allowances for investigators are made in the terms of assist services, for example, criminal investigations.
The dark web, on the other hand, is comprised of websites that are only accessible via internet services such as The Onion Router (TOR). One of the main differences between Google and TOR is the composition of the URLs they take in, where the ones used to access dark web content use obfuscating techniques, making them almost impossible to guess, remember, or understand. Additionally, the content in the dark web is primarily hosted anonymously and heavily encrypted, providing extra layers of protection against tracing and identification.
Oftentimes, whatever information is stolen from the deep web (passwords, privileged data) ends up being sold on the dark web. However, not everything that transpires there is of a criminal nature. Journalists, activists, and politicians working and reporting under corrupt or totalitarian regimes use it to gather, collaborate, and exchange information without fear of being harassed or prosecuted.
Scopes of Deep & Dark Web Investigations 🔗︎
As mentioned before, some threat actors lurk within the deep web, where they use techniques such as phishing and social engineering to steal personal data, defraud individuals, or get a foothold into a specific organization. They might then turn towards the dark web to profit from their schemes by selling the stolen data or the kits they developed for their schemes.
Others may prefer the enhanced anonymity and security protocols of the deep and dark web forums and messaging services, for it allows them to conduct their illegal activities anonymously, be it dissemination of propaganda and disinformation, hacktivism, exchange of CSAM material, or trading illegal goods (drugs, weapons, etc.).
Because of that, analysts and investigators use data from the deep and dark web for different types of investigation. For one, the data in the deep web allows the analysis of the behavior of and interactions between extremist groups, criminal organizations, and threat actors on social media, forums, and other online communication channels.
For others, the deep and dark web can help bolster cybersecurity when used as a source of enrichment, allowing them to confront fraud by tracking mentions of their brand and products on the different forums, helping them react to insider threats by tracking paste sites and chatter regarding password or data leaks, enhancing physical security by monitoring the underground chatter, and even providing them with insights into how their current policies and processes may be enabling criminal activities such as human trafficking to take place.
Where to Gather Intelligence for Deep & Dark Web Investigations 🔗︎
Deep and dark web investigations entail the following three aspects:
- Tapping into the Criminal Underground
- Follow the Money on Cryptocurrency Blockchains
- Social Media Footprinting
Each of these types of investigations rely on different and specific data sources.
We now provide you with a list of deep & dark web intelligence options covering various investigative scenarios in Maltego. These data sources have proven to be amongst our Subject Matter Experts and end-users’ favorites alike and are suitable for all budget sizes. The list is sorted in alphabetical order and doesn’t indicate any ranking or preference.
Download this PDF now to access the full list of our deep & dark web intelligence source recommendations and learn more about their advantages and offerings!
Don’t forget to follow us on Twitter and LinkedIn and sign up to our email newsletter, so you don’t miss out on updates and news!
Happy investigating!
