I've always been interested in the darkest and most enigmatic layer of the Internet: The Dark Web. Also called deep web, these names are often used interchangeably without causing any problems in forum and chats.
I recently decided to venture out of curiosity into this environment that many consider to be made up of malicious people, hackers, hitmen or perverts of all kinds. This beginner's experience allowed me to better understand the conventions of this part of the web.
This article will be about the 5 most used types of CAPTCHAs on the Dark Web.
DISCLAIMER: For security reasons, I will not mention some forums names, nor the URLs of the sites on which I found this interesting list of CAPTCHAs. |
CAPTCHA: Definition
A CAPTCHA (acronym for "Completely Automated Public Turing test to tell Computers and Humans Apart") is a type of test used in computing to determine whether the user is human of not.
For many reasons, there are a lot of people intending to damage a website by using bots to generate useless malicious content, to attempt to perform database-related operations resulting in DDoS attacks or for scrapping.
The most common one on the clear web is reCAPTCHA owned by Google.
Automated monitoring of dark web onion sites is the first step towards developing the resources needed in the fight against cybercrime, for investigations or even for Cyber Threat Intelligence. While there are effective techniques for collecting data from the Surface Web, large-scale data collection on the Dark Web is often hampered by anti-crawling and anti-scraping measures. On the Dark Web, many websites discourage automated scraping attempts by employing CAPTCHAs.
#1. CAPTCHAs similar to those on the clear web
Ranging from questions about simple mathematical calculations to general knowledge questions, these CAPTCHAs are common on forums that only use them to protect themselves from unsophisticated attempts at DDOS attacks.
Present on a famous English-speaking market offering Bitcoin mixing services, here is an example:
Then there are CAPTCHAs containing simple alphanumeric characters with little distortion or effects. Here are two examples bellow.
The first one comes from AnonGTS, a very popular and controversial forum that focuses on topics related to art, graphic design and 3D rendering, but also topics related to macrophilia and vorarephilia (there's no kink shaming here).
The second one is coming from a trading community forum on the Dark web, dedicated solely to the exchange of illegal insider information about public companies.
There are also CAPTCHAs mixing the two styles mentioned above like the two following. I found these captchas while browsing .onion sites dedicated to discussions around drugs sales, cybercrime (hacking, phishing, carding) and everyday life topics.
Even though these captchas seem relatively simple, some users have trouble with some of them. An example of testimonial found on the clear web:
Posted by Anonymous somewhere: You cant even fucking register because the captcha doesnt fucking work what a bunch of fucking idiots who made this.
#2. CAPTCHAs on chan imageboards
Known as chans, imageboards are more and more used by the community of free-speech enthusiasts. A rise of imageboard hosting sites on the darknet have been observed since the rise of QAnon, including copies of the controversial chan board, 8chan.
Several chans on the darknet across numerous languages are currently online and active.
The four most famous chans on the dark web use the same type of captchas to authenticate users, so they can easily delete old posts. These captchas templates feature alphanumeric characters and slightly more visible distortion effects than the templates seen previously.
#3. CAPTCHAs used on forums
When we talk about forums on the Dark Web, we immediately think of the famous Dread forum. Dread is a popular Reddit-style community hub for discussion about frauds around markets, cryptos and other forums. It came to prominence in 2018 after Reddit banned several darknet market discussion communities, rapidly reaching 12,000 registered users within three months of being launched.
This forum is known for its use of playful, complex, and creative CAPTCHAs. Here are some examples:
#4. CAPTCHAs used on chats
After the chans, the forums, and the weird onion sites, I ventured on the chats present on the dark web. And who says dark web chat, says Daniel's Chat.
This chat is linked to a site managed by a man named Daniel, which is a great resource to explore various dark web links. This site lists thousands of .onion links classified into different categories. Also, it has an inbuilt feature that lets you know whether a given site is online or not.
The chat linked to this site is now protected by a simple CAPTCHA. But a short time ago, it was still protected by this kind of CAPTCHA:
Even though the site and the chat are relevant resources, the Daniel's Chat is occasionally spammed by people posting illegal content.
The nugget that I also discovered is the Dark Forest forum-chat. I was pleasantly surprised by the quality of content, management and features of this .onion site.
With content focused mainly on cyber security (addressing OSINT, networks, hardware, etc.), this site guarantees the security of its members by implementing several security measures such as the deletion of messages after 24 hours, enhanced moderation and complex CAPTCHAs such as the following one:
The site has four categories: forum, chat, resources and the VIP corner.
#5. Weird CAPTCHAs
CAUTION: NSFW content is present in this category.
Finally, I'm going to put in this category the weirdest CAPTCHAs I've found. The first is a CAPTCHA found on the .onion site of a community of Russian-speaking hackers. The site is still active, but the interface has changed a lot and now only displays a PGP key of the site owners.
I've also found the following NSFW CATCHA on a small dark web market that is easy to navigate, unstructured, and where anyone can find a hodgepodge of stuffs among the usual drug, cyber criminality and fraud related listings.
The site has a discussion forum and is divided into several categories: Drugs, Fraud, Hacking, Forgeries/Counterfeit, and Tutorials. Each of these are divided into several smaller categories.
Conclusion
This OSINT investigation, the research work and the writing of this article were tedious, but very formative and pleasantly interesting.
My research was made easier thanks to a valuable tool that I had the chance to evaluate for a few months. I would like to thank the French company Aleph Networks, known for its dark web search engine ALEPH DARK SEARCH which allowed me to conduct faster some of my research work.
This human-sized company has been able to develop a tool allowing the search for traces and illicit data on the Deep web, the mapping of these areas of the web, the identification of influence clusters and the search for certain remarkable elements.
