The Dark Web – a network of ‘hidden’ sites within a decentralised environment known as the Tor network – is notoriously difficult to monitor and enforce, but is particularly popular with bad actors by virtue of the high levels of privacy and anonymity available.
An awareness of the appearance of relevant content on the Dark Web can, however, be of key importance to brand owners and managers, offering the possibility of taking remedial action in cases where sensitive information is found to have been posted, and in some cases providing intelligence regarding networks of connected infringements and links to ‘real-world’ entities.
“In my ‘Brand Protection Notebook’ blog series, I’ll be aiming to provide an overview of projects, tasks, events and insights associated with my role in leading the Brand Protection team here at SnapDragon” David Barnett
As part of the set of searches relating to the proof-of-concept demo for a gambling company (as discussed in Part 3 of my Brand Protection Notebook blog – “Domain Searches” read it here), it was also necessary to scope out whether any brand-related content of concern was present on the Dark Web.
The Dark Web most correctly refers to a subset of Internet content which is only accessible via the Tor network, a decentralised environment in which all traffic is encrypted and re-routed via a series of proxies. Tor-enabled browsers can be used to access regular websites, but also allow access to ‘hidden’ sites within the network, hosted at addresses which generally appear as a long random series of characters ending in ‘.onion’. The Tor network is particularly attractive to users seeking privacy and anonymity but, for this reason, is also popular for use with infringing and even illegal content.
Monitoring to Gather Valuable Insights
From a brand protection point of view, the Dark Web is notoriously complex to monitor – not least because the ‘onion’ addresses for any given website may change relatively frequently – and constitutes an environment where enforcement against infringing content can be extremely difficult. Nevertheless, an understanding of the types of content present can still provide valuable insights to brand owners, and can allow early mediating action in cases of (say) security issues or data leaks.
For the proof-of-concept study, the searches aimed to identify instances of unauthorised brand use or impersonation, or any leaks of personal information relating to company directors.
The search strategy for the landscaping analysis made use of a manual approach, whereby the first step was a series of searches on the regular (‘open’) Internet, attempting to find one or more directories of URLs for key Dark Web sites. Such lists are often posted on document-sharing sites such as Pastebin and are periodically updated. Of particular use in these archives are the .onion addresses of Tor search engines, which can be used to search the network using a keyword-based approach, as for an ‘open’ Internet search engine.
An example of a Tor / ‘onion’-site search engine (address as of June 2026: http://3bbad7fauom4d6sgppalyqddsqbf5u5p56b5k5uk2zxsy3d6ey2jobad.onion/)
The remainder of the research involved the use of a range of brand-specific and keyword–based searches using the various search engines identified, in addition to the review of other relevant .onion websites referenced in a selection of Dark Web directories. In this particular case study, no relevant content relating explicitly to the brands or individuals in question were identified (apart from ‘false positives’ in which the same names were used, but in unrelated contexts) – though the searches will need to be repeated on a regular basis as new content emerges over time. However, a range of industry-relevant sites were found, highlighting the importance of ongoing monitoring to assess evolutions in the threat landscape.
The key takeaway is that for brand owners and managers, regular Dark Web monitoring provides an important layer of intelligence. It helps to identify potential threats earlier, understanding wider networks in which infringements may operate, and taking action before sensitive information of brand abuse develops into a more significant problem.
An example of an active Dark Web casino website (address as of June 2026: http://omiz35ogxn55z5sxivse7nbpssjvdc2td7cs74xheimrntfpv2fqrmid.onion/)
David Barnett
SnapDragon | Director of Brand Protection
Want to see how SnapDragon’s AI-powered Tech can protect your brand?
If you would like to explore how SnapDragon can accelerate your online brand protection, get in touch to schedule a demo.
We would love to hear from you, and show you what’s possible.
Get in touch today.
