Large-scale analysis of malicious activities on the dark web: phishing on the dark web and leader disclosure in underground forum

Abstract

Anonymous network services on the World Wide Web have emerged as new web architecture, called the Dark Web. At the same time, the Dark Web has been the last resort for people who seek freedom of the press as well as avoid censorship. This anonymous nature allows website operators to conceal their identity and thereby leads users to have difficulties in determining the authenticity of websites. We analyzed the text content of 28,928 HTTP Tor hidden services hosting 21 million dark webpages and discovered a trend on the Dark Web in which service providers perceive dark web domains as their service brands. We also conducted a model-based learning method by the Bayesian network, and we run an experiment on real-world specific underground forums to reveal the opinion leaders. Our work facilitates a better understanding of the phishing risks on the Dark Web and encourages further research on establishing an authentic and reliable service on the Dark Web.