How Darknet Data Can Expand OSINT Investigations
Summary
A DarkOwl webinar explains how analysts can combine darknet and surface-web sources for OSINT, with examples involving threat actors, leaked data, cryptocurrency, and conflict-related activity.
Key points
- The presenter recommends corroborating darknet findings with surface-web and other sources, and recording timestamps because sites and content can change or disappear.
- Darknet collection can be difficult: sites may be unindexed, require logins, and use bot traps or other access challenges.
- The webinar advises investigators to use separate personas and secure equipment, such as virtual machines and VPNs or proxies, to protect operational security.
- Examples show how usernames, email addresses, and phone numbers found in forum activity or leaked data can be used to investigate possible links to other accounts and services.
- The presenter describes examining cryptocurrency transactions and public posts as potential investigative leads, while cautioning that observed transaction flows do not prove the purpose of funds.
- Telegram and Discord are described as useful sources for monitoring threat-actor activity, but information shared there may be inaccurate and should be validated.
Article Details
- Topic
- Using darknet and adjacent online sources in OSINT investigations and threat intelligence
MITRE ATT&CK
People
Threat Actors
Vendors
Products
Tools
breadcrumbsThis is called breadcrumbs; you can get a basic free account and it allows you to do some kind of network analysis.Chain abuseBitcoin abuse, which I believe its name has changed now to Chain abuse, but it’s another really good source for looking at any cryptocurrency addresses you come across and seeing if they’ve previously been reported asQlueI think one I heard of that I’m not familiar with but was recommended to me recently was Qlue – that is supposed to be quite good for cryptocurrency, monitoring but it really depends if you want to do a paid service orWhat’s My Name appThis is What’s My Name app, where you can put in usernames, and it will search across social media sites and identify if an account exists.