Dark Web Chronicles, Volume 3: Duck Duck Go - Legitimacy of Dark Web Aggregators

Given the quick and sometimes chaotic nature of the Dark Web, and the desire to beat out competitors to make more money, there has been an increase in fraudulent sites mimicking legitimate dark web sites. Given the popularity of site aggregators, where identifying legitimate and active sites can be tricky, some malicious actors are trying to get in on the game and potentially steal donations destined for the legitimate site. We examine how a popular dark web site aggregator has struggled for months to get to the top of Google and Duck Duck Go, and why they have that challenge to begin with.

Recommendations

• Ensure that you have enabled the Domain Security rules for your domains to ensure that visitors to your site are browsing your legitimate domain
• Use trusted, verified and well-known sites when browsing. This isn’t an issue specific to dark web sites, as there are countless other phishing sites that capitalize on variations of domain names
• Along with ensuring you’re browsing to the proper pages, always verify the intended recipient of online payments
• Continue monitoring the Alpha Team Tab for reports related to dark web activity, such as this one
• If you are interested in further insight, reach out to [email protected] for assistance

Details

Dark.fail, a dark web site aggregator which has a list of various sites and if they are currently online or not, recently tweeted that they were finally the number 1 search result in DuckDuckGo when searching for dark.fail. For months, other sites, such as darkfail.us, darkfail.com, dark-fail.com took presedence over the legitimate site in the result listing, and were identified as phishing sites masquerading as the popular dark web site aggregator.

This trend has spread to other dark web sites and aggregators, including DarknetLive which experienced the same problem, having a few legitimate results, and then a number of phishing sites. In the tweet by DarknetLive, they claim that many of the phishing sites for DarknetLive are being operated by the same entities behind the Dark.fail phishing sites as well.

Using dark.fail first, we notice that the 3 main sites impersonating dark.fail are for the most part, a decent replica of the original site. These sites are:

• darkfail.us
• darkfail.com
• dark-fail.com

There are some minor differences at first, with two of the three sites displaying different title bar messages. For instance, dark.fail uses "Which darknet site are online?" versus "Is a darknet site online?". The next difference is that the timestamps do not match up with actual UTC time, with most of the sites being correct, however, dark-fail.com is 2 hours and 12 minutes ahead of the others. The other major difference that is immediately apparent is that there is currently a warning to users about the NordVPN breach that just occurred, advising users to be careful, rotate passwords and adjusting their OPSEC. On the legitimate site this warning is present, and the only phishing site that includes this warning is darkfail.com, the others don't include a warning at all, and look like the typical page, pre-NordVPN breach.

Link Analysis

There are some major differences between the sites directories, and the links that they are pointing users to. For instance, all but one of the sites point Dread (a popular Reddit like site on the Dark web) to the legitimate Dread url, however, one points users to an unknown .onion address that doesn't resolve.

We examined various conflicting domains referenced by each of the site, and for the most part they all list the same .onion pages for the site, however, darkfail.com has the most differences, with the majority of the sites listed as random .onion sites, with almost all of them being unable to load the site. Given that the referenced sites aren't routing to other phishing type pages, it's assumed that the main reason would be for users trying to donate to the legitimate site, and inadvertently donating to the fraudulent site.

Interesting to note, that one of the domains, darkfail.us was registered to speedsteppers@protonmail[.]com, who was the owner of Dream Market from 2013. It is unknown at this time if they are the same individual, however, it is more probable that this is just a cover email address for the registrant. The other sites have Whois protection enabled, or are using illegitimate contact information. Last thing to note is that the three fraudulent sites referenced in this article have all been registered in the last 160 days, with one as early as 60 days ago, whereas dark.fail has been around for almost 2 years.

Donations

One of the most probable reasons for these phishing sites is for collecting donations through Bitcoin or Monero. At the bottom of each site there is a section for donations if users of the site were inclined to support the site and help keep it running.

The legitimate dark.fail site has the following addresses associated with it:

dark.fail Bitcoin: 1MeGeJXcTCMW6CLjQQiZcbaZ2FLYSKUMZS Monero: 83yNBMMhBK5fyosQ3g4qD1LS1RUXMUVuATVGAZ1assQwDfVDHDNDWEx9wnC1PqpK8SFTV5F4R8kPjc6Pt8hm7DhYJD8stNJ Total Received: 0.00976053 (11 Transactions)

darkfail.us Bitcoin: 17xSoTmmmzZABnw2d3FWi1PDPNoUgXS4Vz Monero: 8854wXhegtfdWHorhTqb1g8V94biewtqQ1DHUCMzx2rKcF2PtPg94BEQVVWaDvSFA9b2LtMzijxD3ETKpL2Atkr7VXpJn42 Total Received: 0.01171358 (14 Transactions)

darkfail.com Bitcoin: 3QEekAQM1ofqRoVGbSx6ur7b2JcAJ8MKYp Monero: 8APYKnAEsEuFmkuNmDKW7zUE1Y7cY1nXfMWA8ZzB3qZc9Dz93b3n5nMgKetjWkRQaTU8HH2zs916W6c3avi4ks8aPBrvbo7 Total Received: 0.04206767 (4 Transactions)

dark-fail.com Bitcoin: 1MeGeJXcTCMW6CLjQQiZcbaZ2FLYSKUMZS Monero: 83yNBMMhBK5fyosQ3g4qD1LS1RUXMUVuATVGAZ1assQwDfVDHDNDWEx9wnC1PqpK8SFTV5F4R8kPjc6Pt8hm7DhYJD8stNJ Total Received: Reuses the addresses from dark.fail

There is also a PGP public key at the bottom of the site, with dark.fail, darkfail.com and dark-fail.com all reusing the same key, while darkfail.us using their own PGP key. It's interesting to note that each of the phishing sites attempt to mimic the original site, but all are missing one area or another. For instance, darkfail.us has the same title bar message, but is missing the NordVPN alert, while darkfail.com includes the NordVPN alert, but has a different title bar message. dark-fail.com is the most obvious fake, with a completely different title bar message, and includes text from Empire Marketplace at the bottom, possibly for SEO purposes, but, for some reason doesn't try to monetize visitors since they are reusing the Bitcoin and Monero addresses from the legitimate site.

Takeaways

While there were no identified phishing pages that were active linked in the fraudulent sites, it is highly possible that malicious actors could use better Search-Engine Optimization (SEO) to get their sites ahead of the real dark web aggregators and get more users visiting their sites. The immediate gain for malicious attackers would be using their own bitcoin addresses to receive donations, with other motivations being routing users to other illegitimate pages to gain credentials or other sensitive information from users.