Exposing the IP Address of a Dark Web Link Collection

Our team has conducted threat intelligence in the dark web space and identified a technique used to expose the real IP addresses, behind Cloudflare protected sites using authenticated origin pulls.

⛓️‍ One of the first targets is "darknetlinks[.]info" - a link collection for dark web forums, marketplaces, exchanges and others.

Our investigation showed that the site is using Cloudflare services to protect on a DNS-level, and on a server-level using authenticated origin pulls (AOP), to restrict server traffic only to Cloudflare servers.

🗝️ Conducting certificate intelligence using Censys, our team identified their origin certificate with the fingerprint "02a43b2d77464a269fc32fccf79699dea82569215c37134331f7aaba54d63052" and one host "146[.]19[.]143[.]203" server, which serves their dark web link collection.

🛡️ The technique and exposed target are part of Covert Security's upcoming CS-ADWI (Advanced Dark Web Intelligence) course, featuring topics such as...

• Monero transaction deanonymization through honeypot nodes.
• Hidden service deanonymization on the dark web.
• Deanonymization of Cloudflare protected services on the clear web.

🎉 𝘚𝘵𝘢𝘺 𝘵𝘶𝘯𝘦𝘥 𝘧𝘰𝘳 𝘮𝘰𝘳𝘦 𝘶𝘱𝘥𝘢𝘵𝘦𝘴 𝘢𝘯𝘥 𝘦𝘹𝘱𝘰𝘴𝘦𝘴, 𝘢𝘴 𝘰𝘶𝘳 𝘥𝘢𝘳𝘬 𝘸𝘦𝘣 𝘳𝘦𝘴𝘦𝘢𝘳𝘤𝘩 𝘦𝘹𝘱𝘢𝘯𝘥𝘴.