Cybercrime in The Deep Web
summary
A prototype crawler called DeWA automatically collects and analyzes DeepWeb content via a universal gateway, Splash headless browser, Scrapy middlewares and ElasticSearch/Kibana; it records about 40.5 million events from ~610,000 URLs across ~20,500 domains (roughly 9,000 still online). Findings include gun listings (Glock for ~1.4 BTC), fake passports (€600), PayPal batches and cashout services, Tor-hosted ransomware payment pages that scramble Bitcoin addresses, and malware using Tor for C2 such as Skynet and banking Trojans.
AI-written summary · about
chapters (21)
- 0:00Start
- 2:39Roadmap
- 11:48System Overview
- 13:34Data Sources
- 16:27Deep Web Gateway
- 18:16Headless Browser
- 19:19Data Enrichment
- 21:41Example: Russian Forum
- 29:00Counterfeit Money
- 31:46Crowdfunding evil
- 34:12French forum: Weapon sale
- 34:29Pages Embedding Suspicious Links
- 34:49Email Identification
- 35:48Exilio forum 2/2
- 36:09Automated Bitcoin Identification
- 36:40Bitcoin Tumblers
- 37:03Bitcoin Multiplier 12
- 41:23Dyre Banking Trojan
- 43:00Dyre's Infection Evolution
- 45:31Ransomware in the Deep Web
- 53:47Black Hat Sound Bytes
related talks
36mCyber Crime and Attacks on the Dark Side of the Web
50mCyber-crime and attacks in the dark side of the web
10mQuick Look: Cybercrime and Attacks in the Dark Side of the Web
40mNavigating the Shadows: A Comprehensive Exploration of Popular and Malicious Tools on the Dark Web
48mDawn Of The Dead: The Tale Of The Resurrected Domains
36mBehind Enemy Lines:Engaging and Disrupting Ransomware Web Panels
42mAnatomy of a Crime: Secure DevOps or Darknet Early Breach Detection
35mBreach Data and the Dark Web