Deep Web and Cybercrime: It’s Not All About TOR

View research paper: Deep Web and Cybercrime: It’s Not All About TOR

The term "Deep Web" is used to denote a class of content on the Internet which, for different technical reasons, is not indexed by search engines. Among the different strategies in place to bypass search engine crawlers, the most efficient for malicious actors are so-called “darknets.” Darknets refer to a class of networks that aim to guarantee anonymous and untraceable access to Web content and anonymity for a site.

Darknets and TLDs                                                                  

While the Deep Web has often been associated with The Onion Router (TOR), in this paper, we introduce several other networks that guarantee anonymous and untraceable access—the most renowned darknets (i.e., TOR, I2P, and Freenet) and alternative top-level domains (TLDs), also called “rogue TLDs.” We analyzed how malicious actors use these networks to exchange goods and examined the marketplaces available in the deepweb, along with the goods offered. Due to a large variety of goods available in these marketplaces, we focused on those that sparked the most interest from cybercriminals and compared their prices with the same class of merchandise found in searchable Internet underground forums, mostly Russian.

The Silk Road

The Silk Road was the most notorious example of an online marketplace found in the TOR network. Before it was taken down by the FBI in 2013, the website was used as a platform for selling illegal drugs, where users were able to browse anonymously. That wasn't the end of it though, as a new site soon took its place on November 6th, 2013. Called "Silk Road 2.0", the relaunched site promised improved security to avoid another shutdown. On November 6, 2014, exactly one year after the launch of Silk Road 2.0, the new site was shut down and its operator was arrested through the efforts of Operation Onymous—an international law enforcement operation that targets illegal online marketplaces operating in the TOR network.

Despite the focused efforts to shut down illegal activities made possible by the anonymity offered by darknets, Trend Micro predicts that more cybercriminals will use darknets to trade tools and tactics in the future.