Dark Web & Threat Intel — Labs & Discussion

Rules for every lab: passive techniques only unless the lab says otherwise; only approved targets (yourself, consenting classmates, instructor-provided or instructor-owned targets, purpose-built practice sites); don’t share findings about real people outside class.

Module-specific rules: Students do not browse the dark web in this course. No visiting onion link lists, forums, markets, leak sites, or criminal Telegram channels. If a tool displays an onion link, don’t follow it. See 6.5-safe-research-practices.md.

---

Lab 1: Flare Academy Darkroom (Simulated Dark Web Investigation)

• Objective: Experience a realistic dark web investigation — forums, stealer logs, breach triage, crypto tracing, and threat actor interaction — in a safe simulated environment, and earn a Flare Academy certification.
• Time: About 4 hours, self-paced (homework or multi-session) / Difficulty: Beginner–Intermediate
• Setup / what the instructor prepares:
• Confirm Darkroom is still free and available at flare.io/darkroom (launched August 2026).
• Check your school’s policy on students creating third-party accounts, and Discord’s terms (including age requirements). Offer an alternative assignment (e.g., Lab 4 plus a written report) for students who can’t or don’t want to join Discord.
• Remind students to apply OPSEC: use a school email or a handle that doesn’t expose unnecessary personal information.
• Steps:
  1. Register at flare.io/darkroom, join the Flare Discord, and complete verification.
  2. Open the Darkroom lab and work through it at your own pace.
  3. Keep an investigation log as you go: what you looked at, what you found, how you pivoted, and your confidence in each conclusion.
  4. Complete the assessment.
• Deliverable:
• Proof of completion (certificate or badge screenshot).
• A one-page reflection that maps what you investigated to the cybercrime supply chain from 6.1-dark-web-fundamentals.md (malware → stealer logs → initial access brokers → ransomware affiliates → leak sites).
• Debrief questions:
• Which pivot was the most useful in your investigation, and why?
• What surprised you about how criminal forums work (reputation, escrow, vetting)?
• How did interacting with the AI-simulated threat actors feel? What would make that dangerous in real life?
• Which parts of the lab would a platform like Flare automate for a real analyst?

---

Lab 2: Legitimate Onion Sites (Instructor-Led Demo)

• Objective: Show students what Tor and onion services actually look like — safely — and connect the demo to how addresses are verified.
• Time: 20–25 minutes / Difficulty: Beginner
• Setup / what the instructor prepares:
• Tor Browser installed on the instructor’s machine, ideally inside a VM, connected to the projector. Students watch; they don’t follow along on their own devices.
• A short list of legitimate organizations that run onion sites (e.g., BBC, The New York Times, ProPublica, DuckDuckGo, Facebook, CIA). Get their addresses only from each organization’s own clear-web site or from Tor Browser’s “.onion available” button — never from a link list.
• A normal terminal ready for the curl step.
• Steps:
  1. Open Tor Browser and connect. Show the circuit view for a site (the three relays) and discuss what each relay knows.
  2. Visit a legitimate organization’s normal HTTPS site in Tor Browser. If it sends an Onion-Location header, point out the purple “.onion available” button and click it.
  3. Compare the address length (56 characters) with a normal domain. Ask: “How would you know this is the real site and not a clone?”
  4. In a normal terminal, check the header directly:
  

  curl -sI https://<organization-domain> | grep -i onion-location
  

  
  5. Switch the Security Level to Safest, restart Tor Browser, and reload. Show what breaks when JavaScript is disabled.
  6. Close Tor Browser and (if using a VM) revert the snapshot.
• Deliverable: None required; optionally, students write three sentences explaining how onion services hide both the visitor and the server.
• Debrief questions:
• Why would the BBC or the CIA want an onion site?
• Why is the Onion-Location header a safer way to find an onion address than searching for one?
• What’s the trade-off of the Safest security level?
• Why doesn’t this class browse beyond legitimate sites?

---

Lab 3: Check Your Own Exposure

• Objective: Use free breach and stealer log tools on your own email addresses, interpret the results, and build a personal action plan.
• Time: 30 minutes / Difficulty: Beginner
• Setup / what the instructor prepares:
• Confirm the tools are available: Have I Been Pwned (haveibeenpwned.com) and Hudson Rock’s free lookup (hudsonrock.com / infostealers.com).
• Prepare a worksheet (below). Students keep their worksheet private.
• For students who don’t want to check their own data, the instructor demos with the instructor’s own email address.
• Domain searches (HIBP domain search, SOCRadar Dark Web Report) are instructor demos only, for a domain the instructor controls or is authorized to represent.
• Steps:
  1. Search your own email address(es) in Have I Been Pwned. Record each breach: name, date, and types of data exposed (never write down passwords).
  2. Search your own email address in Hudson Rock’s free infostealer lookup.
  3. Interpret the results:
  • A breach result means one website leaked your data.
  • An infostealer result means a device you used was infected — every password saved in that browser should be considered exposed.
    4. Write your action plan:
  • Change reused passwords (from a clean device) and switch to a password manager.
  • Turn on MFA everywhere, preferably phishing-resistant.
  • If there’s an infostealer hit: scan or reinstall the infected device, change every saved password, and log out of all sessions on important accounts.
    5. (Optional) Create a free Hudson Rock account to monitor your own email.
• Deliverable: Private worksheet with breach names/dates/data types and your action plan. Share only categories with the class (e.g., “found in two breaches, one included phone numbers”).
• Debrief questions:
• Which type of result is more urgent — a 2019 breach or a stealer log hit? Why?
• Why doesn’t a password reset alone fix a stealer log exposure?
• Why does HIBP require you to prove you own a domain before searching it?
• What would an organization do with this same information for all its employees?

---

Lab 4: Ransomware Tracker Trend Analysis

• Objective: Use public ransomware trackers and government advisories to produce a short threat intelligence brief — without visiting any leak site.
• Time: 45–60 minutes, small groups / Difficulty: Intermediate
• Setup / what the instructor prepares:
• Confirm ransomware.live and ransomlook.io are available.
• Remind students: these trackers may display onion links or screenshots — don’t follow any onion links, and don’t search for leaked data.
• Victims listed are real organizations: no public posts or speculation about them.
• Steps:
  1. Pick a time window (e.g., the last 90 days).
  2. Using the trackers, identify the five most active groups by number of victim posts.
  3. Summarize which sectors and countries appear most often.
  4. Choose one group. Find whether CISA has published a #StopRansomware advisory about it (cisa.gov). If so, summarize its initial access methods and key tactics. If not, use reputable security news or vendor research.
  5. Look for connections to this module: Does the advisory mention initial access brokers, stolen credentials, or infostealers?
  6. Write down the limitations of your data: groups exaggerate, re-post old breaches, and some victims are never listed.
  7. Make one simple chart (e.g., victim posts per group).
• Deliverable: A one-page brief with:
• Key findings (3–5 bullets)
• One chart
• A group profile (initial access, tactics, advisory reference)
• Confidence statements (e.g., “likely,” “possible”) and data limitations
• Two defensive recommendations
• Debrief questions:
• Why can’t you treat a leak site listing as proof of a breach?
• How could a company use trackers for third-party risk (vendors and suppliers)?
• What did the advisory say about how the group gets in? What does that tell defenders to prioritize?
• What would a platform like Flare add beyond these free trackers?

---

Discussion Questions

1. Classify it: Is each of these surface web, deep web, or dark web? Your Gmail inbox; a news organization’s SecureDrop; a public Reddit post; a paywalled article; a public Telegram channel.
2. Silk Road: Tor hid the server, but the operator was still identified. What OSINT principles made that possible, and what does it teach investigators about their own OPSEC?
3. Operation Cronos: Law enforcement took over LockBit’s leak site and used it to mock and expose the gang. Was that effective? Are there any ethical concerns with law enforcement using psychological tactics?
4. Whose problem is it? An employee’s work credentials appear in a stealer log from their personal gaming PC. What should the company do? What privacy lines shouldn’t it cross?
5. Buying back data: Some vendors collect data from criminal sources to warn victims. Where is the ethical line between collecting and paying criminals?
6. Snowflake 2024: No vulnerability was exploited, yet about 165 organizations were exposed. Who was responsible — Snowflake, its customers, or the individuals whose devices were infected? What should each have done?
7. You stumble onto a link list while researching a legitimate topic. What do you do, and why?
8. Automation trade-offs: Flare can automatically reset passwords and revoke sessions when it finds exposed credentials. What are the benefits? What could go wrong (false positives, business disruption)?
9. Platform shifts: After Telegram’s September 2024 privacy policy change, how might criminals change where they operate, and how should analysts adapt?
10. Wellbeing: Dark web analysts can be exposed to disturbing content. What should a team put in place to support them?