Finding Underground Sources

Learning Objectives

• After this, students can explain why dark web sources are found mainly by pivoting rather than searching.
• After this, students can describe how analysts discover and verify onion sites, and why unverified link lists are dangerous.
• After this, students can use security news, threat reports, and law enforcement takedowns as leads to underground forums and markets.
• After this, students can describe safe, passive ways to discover Telegram channels and ransomware leak sites.
• After this, students can explain how community lists and automated platforms fit into professional dark web research.

Class boundary: This file teaches methods. It deliberately contains no real criminal onion addresses, marketplace URLs, or criminal Telegram channel names. In class, demos use only legitimate onion sites and intelligence platforms (see labs.md and 6.5-safe-research-practices.md).

1. The Big Picture

There’s no Google for the dark web. Discovery works differently from normal OSINT:

• Pivoting beats searching. Most underground sources are found because something else mentioned them: a news article, a court document, a ransom note, a forwarded Telegram message, a threat report.
• Everything moves. Addresses change because of law enforcement seizures, exit scams (operators vanishing with users’ money), DDoS attacks from rivals, and rebrands (a gang shutting down and relaunching under a new name).
• Fakes are everywhere. Phishing clones of popular sites are common because onion addresses are impossible to recognize by eye.
• The underground isn’t only on Tor. Many forums are on normal domains, and a huge amount of activity happens on Telegram.

So the analyst’s job is really three jobs: find leads, verify they’re real, and track them as they move.

2. Onion Sites (Tor)

2.1 Know what you’re looking at

• Current (v3) addresses are 56 characters + .onion and contain the site’s public key (see 6.1-dark-web-fundamentals.md).
• Old 16-character (v2) addresses stopped working in 2021. If a list is full of 16-character addresses, it’s badly out of date.
• Addresses only open in Tor Browser (or other Tor-enabled software).

2.2 Onion search engines

Limits: onion search engines only find sites that are linked from somewhere they crawl. Vetted forums, invite-only markets, and anything behind a login won’t show up.

2.3 Link directories and “hidden wiki” lists

These are pages that list onion links by category. They’re the classic starting point in movies and YouTube videos — and the reason this class doesn’t browse them:

• Dead links — most entries go nowhere.
• Scams — fake markets, fake “hacker for hire” services, fake escrow.
• Phishing clones — lookalike versions of real sites that steal logins and cryptocurrency.
• Malware — downloads and exploit pages.
• Illegal content — some lists link to child sexual abuse material (CSAM). Viewing it is a serious crime and causes real harm to victims. See 6.5-safe-research-practices.md for what to do if you ever encounter it.

2.4 PGP-signed mirror lists (how verification works)

Because clones are so common, many site operators (legitimate and criminal) publish a list of their real addresses and sign it with a PGP key. The idea:

1. The operator has a PGP key pair. Their public key is published and becomes well known over time.
2. They publish a text file of their official addresses (called mirrors) with a digital signature.
3. Anyone can check the signature. If it’s valid and made with the known key, the list really came from the operator.

Conceptually, verification looks like this (file names are placeholders):

# Import the operator's public key (obtained from a trusted, independent source)
gpg --import operator-public-key.asc

# Verify the signed mirror list
gpg --verify mirrors.txt.asc

The catch: verification is only as good as the public key. If you got the key from the same untrusted page as the list, a scammer could have swapped both. Analysts confirm the key fingerprint through multiple independent sources and note how long it’s been in use.

2.5 The Onion-Location header (legitimate sites)

Legitimate organizations often advertise their onion address so visitors can find the real one:

• A site sends an Onion-Location HTTP response header pointing to its onion address.
• Tor Browser (since version 9.5) shows a purple “.onion available” button in the address bar for HTTPS sites that send it. Clicking it takes you to the same page on the onion site. Brave also supports the header.
• You can check for the header from a normal terminal (replace with a real organization’s domain during an instructor demo):

curl -sI https://example.org | grep -i onion-location

This is the safest way to get an onion address: straight from the organization’s own clear-web site.

3. Marketplaces & Forums

3.1 Much of the underground is on the clear web

Many of the most important cybercrime forums run on normal domains (often Russian-language) and protect themselves with:
- Registration and vetting (proving you’re a real criminal, sometimes with references)
- Reputation systems (ratings, post counts, deposits)
- Paid entry or invite-only sections
- Escrow services to reduce scams between members

Analysts track forum names, what’s being sold, and which actors are active — but getting inside vetted forums is professional work that requires sock puppets, built-up reputation, and legal and organizational approval.

3.2 Security news and vendor threat reports

The easiest (and safest) way to learn which forums and markets matter is to read people who already watch them:

Treat everything as a lead, then verify it.

3.3 Law enforcement takedowns

When police seize a site, they usually replace it with a seizure banner and publish press releases and court documents. For analysts, takedowns are a goldmine: they confirm which sites were real, and indictments and affidavits explain in detail how the operation worked.

Operation Cronos — LockBit (February 2024)
- Announced February 20, 2024, by the UK’s National Crime Agency (NCA) and the FBI, with international partners.
- LockBit was one of the most prolific ransomware groups, claiming more than 2,000 victims and extorting more than $120 million.
- Authorities took down 34 servers in the Netherlands, Germany, Finland, France, Switzerland, Australia, the US, and the UK.
- Instead of just posting a banner, they took over LockBit’s own leak site, kept its look, and used it — complete with LockBit-style countdown timers — to publish press releases, decryption keys, and news of arrests and indictments. It was as much a psychological operation as a technical one.
- In May 2024, authorities identified the leader, “LockBitSupp,” as Dmitry Yuryevich Khoroshev, a Russian national, charged in a 26-count indictment. The US State Department offered up to $10 million for information leading to his arrest.

Operation Cookie Monster — Genesis Market (April 2023)
- Genesis Market sold “bots”: packages of data stolen from infected computers, including cookies, saved logins, autofill data, and browser fingerprints that let buyers impersonate victims.
- Shut down April 4, 2023, in an operation led by the FBI and Dutch National Police, with agencies from 17 countries. More than 100 suspects were arrested.
- The market is estimated to have offered over 1.5 million compromised computers and 80 million+ account credentials.

Operation Magnus — RedLine and META infostealers (October 2024)
- On October 28, 2024, the Dutch National Police, the FBI, and partners (coordinated by Eurojust) disrupted the infrastructure behind the RedLine and META infostealers.
- Authorities obtained source code, license servers, REST-API services, and Telegram bots, plus customer data. Charges were filed in the US and two people were taken into custody in Belgium.

Lumma Stealer disruption (May 2025)
- Microsoft’s Digital Crimes Unit obtained a court order and seized about 2,300 domains behind the Lumma infostealer, while the DOJ seized Lumma’s control panel and Europol and Japan’s JC3 helped with infrastructure in their regions.

What analysts learn from takedowns
- Which sites and handles were real and important.
- How the operation worked (from court filings).
- Where the community goes next. After a takedown, users migrate to competing forums and markets or new Telegram channels. Watching that migration is a core threat intel task.

3.4 Persona pivoting

Criminals reuse identifiers across platforms, just like everyone else. Useful pivots:

Cautions: handles get impersonated, some actors plant false flags, and scammers pretend to be famous actors. Attribution needs multiple independent signals and stated confidence levels (see Module 7 Verification & Reporting). The Silk Road case in 6.1-dark-web-fundamentals.md shows persona pivoting at its best.

4. Telegram Channels & Groups

Telegram is a major hub for cybercrime: public channels broadcast leaks and stealer logs, groups host discussions, and bots automate sales. It’s also easy to research passively.

Context: In September 2024, a month after CEO Pavel Durov’s arrest in France, Telegram updated its privacy policy to say it may disclose the IP address and phone number of users confirmed as criminal suspects in response to valid legal orders. Some criminals moved to other platforms, and channels continue to get banned and reappear under new names.

Discovery methods

1. Search engine dorks
   

   site:t.me "companyx"
   site:t.me "companyx" leak
   site:t.me combolist
   

   
   Search engines index many public channel pages.
2. Telegram’s built-in global search finds public channels and groups by name or keyword.
3. Web preview (no account needed)
   

   https://t.me/s/<channelname>
   

   
   Shows a public channel’s recent posts in a normal browser — very OPSEC-friendly.
4. Pivot through forwards — forwarded messages show “Forwarded from ,” which leads to the original source.
5. Channel descriptions and pinned posts often list backup channels, “partner” channels, and contact bots.
6. Links posted in forums and other channels.
7. Analytics and directories — TGStat lets you search channels by keyword, language, country, and category, and shows subscriber counts, growth, mentions, and related channels. It’s listed in Bellingcat’s Online Investigations Toolkit and has especially strong coverage of Russian-language channels.

Tracking tips

• Track channels by content, admins, and linked bots, not just names — names change after bans.
• Record the channel’s numeric ID when available, since it survives renames.

OPSEC reminders

• Prefer the t.me/s/ web preview over joining.
• Never join with your personal phone number or account; group members can often see each other.
• Don’t click links or download files posted in these channels.

5. Ransomware Leak Sites

Discovery methods

• Ransom notes — the note left on victims’ machines includes the group’s onion addresses for its negotiation portal and leak site, often with a victim ID. Sample notes appear in malware sandbox reports and security research. Negotiation portals are strictly for victims and their authorized incident response teams — never interact with them.
• Ransomware trackers (safe, clear-web)
• ransomware.live — monitors ransomware leak sites and tracks the victims that groups publish (hundreds of groups), with statistics over time.
• RansomLook — open-source platform tracking hundreds of ransomware groups, markets, and threat actors, including their posts, ransom notes, cryptocurrency addresses, and the mirror URLs groups use. It has an API.
• Government advisories — CISA’s #StopRansomware advisories (joint with the FBI and partners) profile groups’ tactics and indicators of compromise. For example, the Medusa advisory describes the group’s onion leak site with victim countdown timers and ransom demands linked to crypto wallets. Other advisories cover groups such as Akira, Play, and Interlock.
• Security news — new victims and new groups are often reported within hours of a leak site post.

How analysts use leak site data

• Early warning — your organization (or a vendor, partner, or customer) appears on a leak site.
• Third-party risk — a supplier gets listed, so you check what data of yours they held.
• Trend analysis — which groups are most active, which sectors and countries they hit (see the tracker lab in labs.md).
• Verification — groups sometimes exaggerate or re-post old breaches, so listings need confirmation.

6. Community-Maintained Source Lists

deepdarkCTI (GitHub, maintained by fastfire) collects dark web and Telegram sources for threat intelligence work, organized into files such as:
- Ransomware gang sites
- Telegram threat actor channels and groups
- Forums
- Markets
- Plus Discord channels, exploit databases, Twitter accounts, and RaaS sites

It’s widely used by professional analysts, and contributors discuss new sources in a Telegram group. For this class, it’s reference/awareness only: it links to live criminal sites, so students should not click through.

7. Automation (Professional Use)

• Crawlers such as OWASP TorBot (a Python crawler for onion sites) can index onion content.
• Tracker APIs (RansomLook, ransomware.live) and breach APIs (Have I Been Pwned) let analysts pull data into their own tools.
• Commercial platforms — Flare and the others in 6.4-dark-web-intelligence-platforms.md — crawl forums, markets, Telegram, and leak sites at scale and archive them, so analysts search a safe copy instead of visiting criminal sites. For most organizations, this is the right answer.

8. Putting It Together (Fictional Workflow)

No step requires visiting a criminal site.

Verification Checklist

• Is the address v3 (56 characters)?
• Did it come from at least two independent trustworthy sources?
• If a signed mirror list exists, does the PGP signature verify with a key fingerprint confirmed elsewhere?
• Is the lead recent? (Check dates — sites die fast.)
• Could this be a clone, impersonator, or re-posted old leak?
• Is the finding recorded with date, time (UTC), source, and confidence?

Key Terms

• Pivoting: Using one finding (a handle, key, wallet, link) to discover related sources.
• Exit scam: Operators shutting down a market and stealing users’ funds.
• Mirror: An alternate address for the same site.
• PGP signature: A cryptographic signature proving a message came from the holder of a specific key.
• Key fingerprint: A short, unique identifier for a PGP public key.
• Onion-Location header: An HTTP header a site uses to advertise its onion address; triggers Tor Browser’s “.onion available” button.
• Vetting: A forum’s process for checking new members before granting access.
• Seizure banner: The notice law enforcement places on a seized website.
• Negotiation portal: A ransomware group’s site where victims negotiate payment.
• Ransomware tracker: A clear-web service that monitors leak sites and lists victims.
• deepdarkCTI: A community-maintained GitHub list of dark web and Telegram sources for threat intel.

Key Takeaways

• Dark web sources are found mostly by pivoting, not searching — news, court documents, ransom notes, and forwards are the leads.
• Link lists and “hidden wikis” are full of scams, clones, malware, and illegal content — don’t browse them.
• Verify onion addresses with multiple independent sources and PGP-signed mirror lists.
• Legitimate sites advertise their onion address with the Onion-Location header (“.onion available” in Tor Browser).
• Law enforcement takedowns (Operation Cronos, Cookie Monster, Magnus, Lumma) reveal how criminal operations work and where users migrate.
• Telegram can be researched passively with site:t.me dorks, t.me/s/ previews, forwards, and TGStat.
• Ransomware trackers and CISA advisories let you monitor leak sites without visiting them.
• For most organizations, dark web intelligence platforms like Flare are the safe, scalable way to do this.

References

• Wikipedia — Ahmia
• Ahmia — Search Tor Hidden Services
• Tor Project Support — What “.onion available” means in my browser
• Ctrl blog — Promote your Onion site with the Onion-Location HTTP header
• Tor Project — V2 Onion Services Deprecation
• National Crime Agency — The NCA announces the disruption of LockBit with Operation Cronos
• Arctic Wolf — Operation Cronos
• Trend Micro — Operation Cronos aftermath
• BleepingComputer — FBI seizes stolen credentials market Genesis in Operation Cookie Monster
• Eurojust — Takedown of online market that sold stolen account credentials
• CyberScoop — Operation Magnus targets Redline, Meta infostealers
• Infosecurity Magazine — Law Enforcement Operation Takes Down Redline and Meta Infostealers
• Microsoft On the Issues — Disrupting Lumma Stealer
• BleepingComputer — Lumma infostealer malware operation disrupted, 2,300 domains seized
• Help Net Security — Telegram will share IP addresses, phone numbers of criminal suspects
• TGStat — Telegram channels search
• Bellingcat’s Online Investigation Toolkit — TGStat
• ransomware.live
• RansomLook
• CISA — #StopRansomware: Medusa Ransomware (AA25-071A)
• CISA — #StopRansomware: Akira Ransomware (AA24-109A)
• CISA — #StopRansomware: Play Ransomware (AA23-352A)
• CISA — #StopRansomware: Interlock (AA25-203A)
• GitHub — fastfire/deepdarkCTI
• DeepStrike — Top Dark Web Monitoring Tools (mentions OWASP TorBot)