Doppelgängers on the Dark Web: A Large-scale Assessment on Phishing Hidden Web Services

Seungwon Shin, Changhoon Yoon, Kwanwoo Kim, Yongdae Kim, Sooel Son

Abstract:

Anonymous network services on the World Wide Web have emerged
as a new web architecture, called the Dark Web. The Dark Web has
been notorious for harboring cybercriminals abusing anonymity.
At the same time, the Dark Web has been a last resort for people
who seek freedom of the press as well as avoid censorship. This
anonymous nature allows website operators to conceal their identity and thereby leads users to have difficulties in determining the
authenticity of websites. Phishers abuse this perplexing authenticity to lure victims; however, only a little is known about the
prevalence of phishing attacks on the Dark Web.
We conducted an in-depth measurement study to demystify the
prevalent phishing websites on the Dark Web. We analyzed the text
content of 28,928 HTTP Tor hidden services hosting 21 million dark
webpages and confirmed 901 phishing domains. We also discovered
a trend on the Dark Web in which service providers perceive dark
web domains as their service brands. This trend exacerbates the
risk of phishing for their service users who remember only a partial
Tor hidden service address.
Our work facilitates a better understanding of the phishing risks
on the Dark Web and encourages further research on establishing
an authentic and reliable service on the Dark Web.