Welcome to the DarkWeb wiki!

This page lists the dark web-related links I have used in my research into stealer logs and other ransomware-related information.

This is for research purposes only, to arm the defenders with the necessary information on what is available on the publicly-accessible dark-web, so they can make an informed decision.

I do not recommend visiting these sites unless you have taken the necessary security and anonymity precautions. Visit these links at your own risk.

Now, let's dive in.

---

SURFACE WEB LINKS

Telegram channel search

• https://tgstat.com/

Infostealers on Telegram Channels (Links Index)

• https://github.com/fastfire/deepdarkCTI/blob/main/telegram_infostealer.md

Telegram Anonymity Related

Alternative Way to Get an SMS/SIM card (for Anonymous Telegram access)

• https://sms-activate.guru/en

Search Engines for Cybersecurity Professionals

• https://medium.com/@cyberhansu/hacker-search-engine-50a3b91dff65

OSINT, Forensics and Privacy-focused Virtual Machines

• https://medium.com/@cyberhansu/osint-virtual-machines-and-distributions-for-practice-65dbd19928fc
• https://www.whonix.org/
• https://parrotsec.org/

Ransomware and Related News

• https://www.ransomware.live/

---

Dark Web - Search engines

Ahmia

• https://ahmia.fi/

Dark Hunt Search Engine

• http://darkhuntxyxutk3cda4eogyvbcdcmsijv4i2dwtkfoeb6ggwzz7ke3qd.onion
• https://bit.ly/3Wlj6DV

Torch Search Engine

• http://xmh57jrknzkhv6y3ls3ubitzfqnkrwxhopf5aygthi7d6rplyvk3noyd.onion

---

Dark Web - Others

Breach Forums

• https://breachforums.st/
• http://breached26tezcofqla4adzyn22notfqwcac7gpbrleg4usehljwkgqd.onion

Cl0p Leaks [Ransomware Threat Actor Group]

• http://santat7kpllt6iyvqbr7q4amdv6dzrh6paatvyrzl7ry3zm72zigf4ad.onion

R Hysida

• http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion
• http://rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion

Akira

• http://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion

Altenens

• https://altenens.is/

Leakbase

• https://leakbase.io/

Russian Market (English language) [Dark Web]

• http://rumarkstror5mvgzzodqizofkji3fna7lndfylmzeisj5tamqnwnr4ad.onion

Russian Market (English language) [Surface Web]

• http://russianmarket.io/
• https://rm1.to/
• https://rm1.vc/
• https://russianmarket.io/ (redirect to tor)
• https://russianmarket.vc/

XSS Forums (Russian) [Dark Web]

• http://xssforumv3isucukbxhdhwz67hoa5e2voakcfkuieq4ch257vsburuid.onion

XSS Forums (Russian) [Deep Web]

• https://xss.is

Exploit.in Dark Web Market/Forum (Russian) [Dark Web]

• https://exploitivzcm5dawzhe6c32bbylyggbjvh5dyvsvb5lkuz5ptmunkmqd.onion

Exploit.in Dark Web Market/Forum (Russian) [Deep Web]

• https://exploit.in/

BHF Forums (Russian) [Deep Web]

• https://bhf.pro/

Omega Lock

• http://omegalock5zxwbhswbisc42o2q2i54vdulyvtqqbudqousisjgc7j7yd.onion

Rent a Hacker

• http://hackerfuiogkjafl7ome7etnizvduzvlviyo7tupnjo5uvr2by25m3yd.onion

PGP Shop

• http://pgpshopyoohxel4jen5trjfnenou7sodhabd37v2a46hmjhfdxwntjad.onion/pgp/

Exodus Market [Deep Web]

• https://exodusmarket.io/

Cash Cow Marketplace

• http://hssza6r6fbui4x452ayv3dkeynvjlkzllezxf3aizxppmcfmz2mg7uad.onion

Black Market Guns [Dark Web]

• http://bmgunsyop5qa34nzrayd6shsovsukwbbscyo2hbu3ri7b2ghw6sjgrad.onion

Peoples Drug Store

• http://4p6i33oqj6wgvzgzczyqlueav3tz456rdu632xzyxbnhq4gpsriirtqd.onion

The Hidden Wiki

• http://zqktlwiuavvvqqt4ybvgvi7tyo4hjl5xgfuvpdf6otjiycgwqbym2qad.onion/wiki/index.php/Main_Page
• https://bit.ly/3E1u9Mg

Acc Market - credit cards

• http://z7s2w5vruxbp2wzts3snxs24yggbtdcdj5kp2f6z5gimouyh3wiaf7id.onion

Secrets Box

• http://5odv4qjwkhpv3obbtqlgjsk3xfcr6llfvu6dfn6u4e5umhjd3flikgid.onion

Email database - LinkedIn passwords

• http://5odv4qjwkhpv3obbtqlgjsk3xfcr6llfvu6dfn6u4e5umhjd3flikgid.onion

Links Index 1 - CL0P, Haystack, etc...

• http://5yaraas5cva6veaa7vxak73rtm7cnnq4afvtwpf6oz32hjps6ageveyd.onion/media/text/omen.html

Links Index 2 - Torch, etc...

• http://22tojepqmpah32fkeuurutki7o5bmb45uhmgzdg4l2tk34fkdafgt7id.onion/

Other #1

• http://startpagel6srwcjlue4zgq3zevrujfaow726kjytqbbjyrswwmjzcqd.onion/

RG Leaks

• http://rgleaktxuey67yrgspmhvtnrqtgogur35lwdrup4d3igtbm3pupc4lyd.onion/
• bit.ly/3CcadWo

The New York Times

• http://nytimesn7cgmftshazwhfgzm37qxb44r64ytbb2dj3x62d2lljsciiyd.onion/

SecureDrop

• http://sdolvtfhatvsysc6l34d65ymdwxcujausv7k5jk4cy5ttzhjoi6fzvyd.onion/

Massimo Giaimo | @FastFire | Cyber Security Team Leader @ Würth

• http://github.com/fastfire/deepdarkCTI/tree/main

---

OTHER SOURCES MENTIONED IN MY PRESENTATIONS

Verizon 2024 Data Breach Investigation Report

• https://www.verizon.com/business/resources/reports/2024-dbir-data-breach-investigations-report.pdf

Gartner: How to Prepare for Ransomware Attacks

• https://www.gartner.com/doc/reprints?id=1-2IJZ050J&ct=240816&st=sb

Information Is Beautiful: World’s Biggest Data Breaches & Hacks

• https://informationisbeautiful.net/visualizations/worlds-biggest-data-breaches-hacks/

SnowFlake Case Study

• www.hackersimulations.com

Links to Come Soon

• Gothamfx
• CIA
• SecureDrop

Washington Post- SecureDrop

• https://www.washingtonpost.com/securedrop/

Taken down dark web service:

• rgleaktxuey67yrgspmhvtnrqtgogur35lwdrup4d3igtbm3pupc4lyd.onion

DLS Explanation

• https://www.paloaltonetworks.com/cyberpedia/what-is-a-dark-web-leak-site

Oceans + Titanic

• https://www.zmescience.com/science/physics/mariana-trench-james-cameron-13122012/
• https://link.springer.com/article/10.1134/S0965544122020244

How Infostealers have evolved

• https://cybelangel.com/how-have-infostealers-evolved-in-2024/

LummaC2 Infostealer's Evasion Techniques

• https://www.scworld.com/news/lummac2-4-0-infostealer-uses-trigonometry-to-avoid-sandboxes-and-execute-privacy-breaches-and-data-leaks

XDR Example

• https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Documentation/Coverage-of-MITRE-Attack-tactics

ITDR Example

• https://blog.quest.com/understanding-detection-in-itdr-through-tactics-techniques-and-procedures/

NDR Example

• https://www.extrahop.com/blog/extrahop-contributes-expertise-to-mitre-attack

---

OSINT / FREE SEARCH FORENSICS TOOLS

DNPedia - Recently Issued SSL/TLS Certificates

• https://dnpedia.com/tlscerts/recent.php

Shodan

• https://www.shodan.io/

ZoomEye

• http://zoomeye.ai/

BinaryEdge

• https://binaryedge.io/

CenSys

• https://censys.com/

SOCRadar Free Tools

• https://socradar.io/labs
• https://socradar.io/labs/soc-tools
• https://socradar.io/labs/dark-web-report/

MISP CIRCL

• https://misppriv.circl.lu/

AlienVault

• https://otx.alienvault.com/

LeakCheck

• https://leakcheck.io/

Have I Been Pwned?

• https://haveibeenpwned.com/

PhishTank

• https://phishtank.org/

OpenPhish

• https://openphish.com/

DNSTwist

• https://dnstwist.it/

Ensar Seker (top voice)

• https://github.com/ensarseker1

SANS 2024 OSINT Summit YouTube Playlist

• https://www.youtube.com/watch?v=zgIteU4jEZs&list=PLs4eo9Tja8bi1RZyKT_HlN48QLIRW6HhG

Free Online Network Tools

• https://centralops.net/co/

---

RANSOMWARE FOCUS

SOCRadar's Top Ransomware Voice - Ensar Seker

• https://ensarseker1.medium.com/

Free Ransomware Simulator (similar to ChatGPT AI engine)

• https://chatgpt.com/g/g-679a6253574c8191a998145044b9c651-ransomsim-ransomware-negotiation-trainer

Useful Ransomware Trackers

• https://ransomwhe.re/
• https://www.nomoreransom.org/en/index.html
• https://www.ransomware.live/
• https://ransomch.at/
• https://github.com/ensarseker1/NoMoreRansom
• https://github.com/ensarseker1/ransomware.live
• https://github.com/ensarseker1/Ransomchats
• https://github.com/ensarseker1/deepdarkCTI