DarkOwl Analysis Links Darknet Content Spike to Daniel’s Hosting Service Disruption
Summary
DarkOwl’s analysis found a March 2020 spike in highly criminally relevant darknet posts, which it attributed mainly to users migrating after Daniel’s hosting service was hacked. The company said the pandemic was unlikely to be the main cause.
Key points
- DarkOwl reported a sharp decline in new highly hackish darknet content in late February and early March 2020, followed by a spike from March 13–19.
- The company counted 10,832 new darknet posts across the categories it analyzed from January 7 to March 19.
- Hosting accounted for 5,010 posts; DarkOwl theorized that users moved to other providers after Daniel’s hosting service was hacked on March 9.
- Directory posts added 836 entries; DarkOwl suggested hosting and directory activity together may explain 54% of the darknet changes it observed.
- Markets accounted for 1,969 posts, while Fraud, Counterfeit, and Scams made up 8.3% of new highly hackish content.
- DarkOwl said its data did not establish that COVID-19 drove the overall increase and presented the hosting-service migration as its leading explanation.
Article Details
- Publisher
- DarkOwl
- Report Period
- 2020-01-07 to 2020-03-19
- Scope
- Trends in newly observed, highly hackish darknet content in DarkOwl’s database.
- Sample Size
- 10,832 new darknet posts; the eight categories shown were estimated to account for 92% of them.
- Key Statistics
- From 2020-01-17 to 2020-02-27, the mean volume of new weekly highly hackish data was 13,688 pages, with a reported standard deviation of 10.2.
- Weekly darknet data tallies fell by 13%, then 27%, then 30% across the reported weeks beginning 2020-02-21 and ending 2020-03-12.
- The number of new highly hackish data posts reached its year-to-date high during 2020-03-13 to 2020-03-19.
- Hosting accounted for 5,010 new posts; Directory for 836; and Markets for 1,969.
- Fraud, Counterfeit, and Scams together represented 8.3% of new hackish content; Forum accounted for 368 documents, or roughly 3%.
Vendors
Products
DarkOwl VisionBelow is a graph representing the new, 95%-10% hackish posts found weekly in the DarkOwl Vision database from Mid-January to March 19, 2020.Map the DarkTo see if we could provide an explanation for this sharp spike, we turned to what we call “Map the Dark” – which – among many other things – categorizes every piece of current and historical darknet content we find into