Ricerc@Sapienza

Dark Web platforms like the infamous Silk Road market, or other cyber-criminal or terrorism related forums, are only accessible by using anonymity mechanisms like Tor. In this paper we are concerned with geolocating the crowds accessing Dark Web forums. We do not focus on single users. We aim at uncovering the geographical distribution of groups of visitors into time-zones as a whole. Our approach, to the best of our knowledge, is the first of its kind applied to the Dark Web. The idea is to exploit the time of all posts in the Dark Web forums to build profiles of the visiting crowds. Then, to uncover the geographical origin of the Dark Web crowd by matching the crowd profile to that of users from known regions on regular web platforms. We assess the effectiveness of our methodology on standard web and Dark Web platforms with users of known origin, and apply it to three controversial anonymous Dark Web forums. We believe that this work helps the community better understand the Dark Web from a sociological point of view and support the investigation of authorities when the security of citizens is at stake.