The dark side of I2P, a forensic analysis case study

Bazli, Behnam; Wilson, Maxim; Hurst, William

doi:10.1080/21642583.2017.1331770

Cited by 9 publications

(4 citation statements)

References 13 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The increase in Tor DNM shutdowns by law enforcement, competitors, and cyberattackers has led to the multi-homing of certain DNMs (e.g., AlphaBay, Kingdom, and Tor2Door) on I2P and multihoming of vendors on various DNM sites. Existing DNM research has almost exclusively focused on Tor DNMs, except for a few technical studies on I2P [82,83]. We examine a multi-homed DNM site on Tor and I2P -namely, AlphaBay.…”

Section: The Evolution Of Dnms: Policy Practices and Current Shift Fr...mentioning

confidence: 99%

Decoding hidden darknet networks: What we learned about the illicit fentanyl trade on AlphaBay

Maras

Logie

Arsovska

et al. 2023

Journal of Forensic Sciences

View full text Add to dashboard Cite

The opioid epidemic, impacted from the proliferation of fentanyl, has added impetus to the need to detect fentanyl, sources of fentanyl, and places where fentanyl and drugs adulterated with fentanyl are available. Many darknet marketplaces (DNMs) have rules that ban fentanyl. However, it is unclear how these affect the fentanyl market. Using the AlphaBay DNM as a case study, we conducted mixed methods qualitative research. We scraped and analyzed data from the AlphaBay I2P website using, among other methods, content and social network analysis, to uncover hidden fentanyl networks. Our research highlights the next evolution of darknet marketplaces – the migration of DNMs from Tor to I2P and the methods that can be used identify fentanyl networks, irrespective of where sites are: I2P, Tor, or multihomed on I2P and Tor. Despite its ban in the Global AlphaBay Rules, our research revealed the sale of fentanyl on the AlphaBay DNM. Unlike previous studies, our findings predominantly revealed the covert sale of fentanyl on AlphaBay and predatory vendors selling illicit drugs, which unbeknownst to buyers, contained fentanyl. To a lesser extent, our findings identified the overt sale of fentanyl patches on AlphaBay. Although we examined only one DNM, the prevalence of the covert sale of fentanyl and the presence of predatory vendors underscores the importance of research that decodes the language of vendors who surreptitiously sell fentanyl or drugs adulterated with fentanyl or other illicit substances. The results of our research can inform strategies aimed at disrupting and dismantling DNM fentanyl networks.

show abstract

Section: The Evolution Of Dnms: Policy Practices and Current Shift Fr...mentioning

confidence: 99%

Decoding hidden darknet networks: What we learned about the illicit fentanyl trade on AlphaBay

Maras

Logie

Arsovska

et al. 2023

Journal of Forensic Sciences

View full text Add to dashboard Cite

show abstract

“…The implementation of classification of I2P network data traffic is performed on the basis of algorithms such as Baysnet, naivebays, Support Vector Machine (SVM) and random forest traffic [15]. The obtained results shows that for segmentation of data set, RandomForest is greatest having accuracy of 100%.…”

Section: Literature Reviewmentioning

confidence: 99%

Windows 10's Browser Forensic Analysis for Tracing P2P Networks’ Anonymous Attacks

Kauser¹,

Malik²,

Hasan³

et al. 2022

Computers, Materials &Amp; Continua

View full text Add to dashboard Cite

A web browser is the most basic tool for accessing the internet from any of the machines/equipment. Recently, data breaches have been reported frequently from users who are concerned about their personal information, as well as threats from criminal actors. Giving loss of data and information to an innocent user comes under the jurisdiction of cyber-attack. These kinds of cyber-attacks are far more dangerous when it comes to the many types of devices employed in an internet of things (IoT) environment. Continuous surveillance of IoT devices and forensic tools are required to overcome the issues pertaining to secure data and assets. Peer to peer (P2P) applications have been utilized for criminal operations on the web. Therefore, it is a challenge for a forensic investigator to perform forensic analysis of the evolving hardware and software platforms for IoT. For identity concealment and privacy protection, the Onion Router (Tor) and Chrome with the Invisible Internet Project (I2P) as the foundation browser are often used. Confirmation is required to determine whether Tor is truly anonymous and private as they claim. Some people, on the other hand, utilize the Tor browser for evil reasons. Tools and techniques are available for the collection of artifacts, identifying problem areas, further processing and analysis of data on the computer and IoT. Present research tried to explore a few tools for the tracing of I2P activities over computer on windows 10 that reflects IoT devices. According to the results of this research, it leaves an excessive amount of important digital evidence on the operating system that can be exploited to attack the information of users. This research is based on windows operating system and does not support other operating systems.

show abstract

“…There are no public stats about daily users and services, but i2p is frequently maintained and developed. Also, like Tor hidden services, eepsitees became a place for illegal activities [7] [8].…”

Section: Introductionmentioning

confidence: 99%

Interconnection Between Darknets

Cilleruelo

de‐Marcos

Junquera-Sánchez

et al. 2021

IEEE Internet Comput.

View full text Add to dashboard Cite

Tor and i2p networks are two of the most popular darknets. Both darknets have become an area of illegal activities highlighting the necessity to study and analyze them to identify and report illegal content to Law Enforcement Agencies (LEAs). This paper analyzes the connections between the Tor network and the i2p network. We created the first dataset that combines information from Tor and i2p networks. The dataset contains more than 49k darknet services. The process of building and analyzing the dataset shows that it is not possible to explore one of the networks without considering the other. Both networks work as an ecosystem and there are clear paths between them. Using graph analysis, we also identified the most relevant domains, the prominent types of services in each network, and their relations. Findings are relevant to LEAs and researchers aiming to crawl and investigate i2p and Tor networks.

show abstract

The dark side of I2P, a forensic analysis case study

Cited by 9 publications

References 13 publications

Decoding hidden darknet networks: What we learned about the illicit fentanyl trade on AlphaBay

Decoding hidden darknet networks: What we learned about the illicit fentanyl trade on AlphaBay

Windows 10's Browser Forensic Analysis for Tracing P2P Networks’ Anonymous Attacks

Interconnection Between Darknets

Contact Info

Product

Resources

About