From 03a9a23ac00ccd6192a8380bcd29a2a59ee80496 Mon Sep 17 00:00:00 2001 From: uahincibe Date: Thu, 26 Feb 2026 14:08:24 +0100 Subject: [PATCH] Extend dark web forum taxonomy with seven new topic values (Ada Byron INCIBE-UAH) --- dark-web/machinetag.json | 1284 ++++++++++++++++++++------------------ 1 file changed, 666 insertions(+), 618 deletions(-) diff --git a/dark-web/machinetag.json b/dark-web/machinetag.json index f28fdb4..11f3f9f 100644 --- a/dark-web/machinetag.json +++ b/dark-web/machinetag.json @@ -1,618 +1,666 @@ -{ - "namespace": "dark-web", - "expanded": "Dark Web", - "description": "Criminal motivation and content detection the dark web: A categorisation model for law enforcement. ref: Janis Dalins, Campbell Wilson, Mark Carman. Taxonomy updated by MISP Project and extended by the JRC (Joint Research Centre) of the European Commission.", - "version": 10, - "predicates": [ - { - "value": "topic", - "description": "Topic associated with the materials tagged", - "expanded": "Topic", - "uuid": "99c3043d-75c9-5033-bd26-c28da3790599" - }, - { - "value": "motivation", - "description": "Motivation with the materials tagged", - "expanded": "Motivation", - "uuid": "0cf412bf-5d22-5777-a3f3-e8997b26adf4" - }, - { - "value": "structure", - "description": "Structure of the materials tagged", - "expanded": "Structure", - "uuid": "b35ff672-d3af-532b-bd4f-c540297a0a92" - }, - { - "value": "service", - "description": "Information related to an Dark-Web service", - "expanded": "Service", - "uuid": "177a84c2-adbf-5d9c-9ddb-5b3da021b80a" - }, - { - "value": "content", - "description": "Identifiable entities and information contained in a Dark-Web service", - "expanded": "Content", - "uuid": "0dda2a15-f88c-5cb4-9eea-4ab98ae78586" - } - ], - "values": [ - { - "predicate": "topic", - "entry": [ - { - "value": "drugs-narcotics", - "expanded": "drugsNarcotics", - "description": "Illegal drugs/chemical compounds for consumption/ingestion - either via blanket unlawfulness (e.g. proscribed drugs) or via unlawful access (e.g. prescription-only/restricted medications sold without lawful accessibility).", - "uuid": "c0bef0db-be23-54f0-8e0f-2d53bd5ace87" - }, - { - "value": "electronics", - "expanded": "electronics", - "description": "Electronics and high tech materials, described or to sell for example.", - "uuid": "0e992b11-d9ff-5207-b3be-255b8854d198" - }, - { - "value": "finance", - "expanded": "finance", - "description": "Any monetary/currency/exchangeable materials. Includes carding, Paypal etc.", - "uuid": "b1f66aec-a0fe-5a5f-8be3-e30965e82d82" - }, - { - "value": "finance-crypto", - "expanded": "cryptoFinance", - "description": "Any monetary/currency/exchangeable materials based on cryptocurrencies. Includes Bitcoin, Litecoin etc.", - "uuid": "e41b1c45-22a3-5556-ba83-76e733bb70a1" - }, - { - "value": "credit-card", - "expanded": "creditCard", - "description": "Credit cards and payments materials", - "uuid": "7974c6ce-6657-5a3c-b6d4-5b39d52daff9" - }, - { - "value": "cash-in", - "expanded": "cashIn", - "description": "Buying parts of assets, conversion from liquid assets, currency, etc.", - "uuid": "5eb42283-05a0-55f4-930b-97020f04eddc" - }, - { - "value": "cash-out", - "expanded": "cashOut", - "description": "Selling parts of assets, conversion to liquid assets, currency, etc.", - "uuid": "686950f3-af41-5725-8639-5447915b4cef" - }, - { - "value": "escrow", - "expanded": "escrow", - "description": "Third party keeping assets in behalf of two other parties making a transactions.", - "uuid": "931f7351-3dd6-5fc8-b852-4c36e8c48747" - }, - { - "value": "hacking", - "expanded": "hacking", - "description": "Materials relating to the illegal access to or alteration of data and/or electronic services.", - "uuid": "0f2b0736-5539-57f2-a851-79946edadc96" - }, - { - "value": "identification-credentials", - "expanded": "identificationCredentials", - "description": "Materials used for providing/establishing identification with third parties. Examples include passports, driver licenses and login credentials.", - "uuid": "699a8290-82bd-520a-8c8c-55c2933fc5d0" - }, - { - "value": "intellectual-property-copyright-materials", - "expanded": "intellectualPropertyCopyrightMaterials", - "description": "Otherwise lawful materials stored, transferred or made available without consent of their legal rights holders.", - "uuid": "a2231160-c16c-5b96-a6fb-f80678b08e31" - }, - { - "value": "pornography-adult", - "expanded": "pornographyAdult", - "description": "Lawful, ethical pornography (i.e. involving only consenting adults).", - "uuid": "01a8e7dc-ab88-55c1-8fba-6cc748aec64d" - }, - { - "value": "child-sexual-abuse-material", - "expanded": "ChildSexualAbuseMaterial", - "description": "Child abuse materials, including 'fantasy' fiction materials, CGI. Also includes the provision/offering of child abuse materials and/or activities", - "uuid": "0f3bce10-2ce0-5d82-8adf-2d63eefa0ba7" - }, - { - "value": "pornography-illicit-or-illegal", - "expanded": "pornographyIllicitOrIllegal", - "description": "Illegal pornography NOT including children/child abuse materials. Includes bestiality, stolen/revenge porn, hidden cameras etc.", - "uuid": "54cd953b-e51b-5748-9dff-07340492114a" - }, - { - "value": "search-engine-index", - "expanded": "searchEngineIndex", - "description": "Site providing links/references to other sites/services. Referred to as a ‘nexus’ by (Moore and Rid, 2016)", - "uuid": "a6204e13-14a6-5738-ac34-f6fdf4d1e842" - }, - { - "value": "unclear", - "expanded": "unclear", - "description": "Unable to completely establish topic of material.", - "uuid": "43ab130f-e57b-518d-bf1f-7a771c614da8" - }, - { - "value": "extremism", - "expanded": "extremism", - "description": "Illegal or ‘of concern’ levels of extremist ideology. Note this does not provide blanket coverage of fundamentalist ideologies and dogma - only those associated with illegal acts. Socialist/anarchist/religious materials (for example) will not be included unless inclusive or indicative of associated illegal conduct, such as hate crimes.", - "uuid": "564a07fc-b2a6-5102-a94d-f97b20dc1d99" - }, - { - "value": "violence", - "expanded": "violence", - "description": "Materials relating to violence against persons or property.", - "uuid": "4e6c319d-3e08-5bb5-9731-3562751b2673" - }, - { - "value": "weapons", - "expanded": "weapons", - "description": "Materials specifically associated with materials and/or items for use in violent acts against persons or property. Examples include firearms and bomb-making ingredients.", - "uuid": "37a1b75a-3d95-5048-97bd-9332aa11e36e" - }, - { - "value": "softwares", - "expanded": "softwares", - "description": "Illegal or armful software distribution", - "uuid": "43c70d70-8370-522b-ad07-cd244e8e01c6" - }, - { - "value": "counterfeit-materials", - "expanded": "counterFeitMaterials", - "description": "Fake identification papers.", - "uuid": "2456cae3-087b-514a-b7aa-0da55b6ee64d" - }, - { - "value": "gambling", - "expanded": "gambling", - "description": "Games involving money", - "uuid": "64719351-5b69-5539-8359-0196b82741ee" - }, - { - "value": "library", - "expanded": "library", - "description": "Library or list of books", - "uuid": "00d6a94a-7f65-52cc-a19e-5258f5c34cce" - }, - { - "value": "other-not-illegal", - "expanded": "otherNotIllegal", - "description": "Material not of interest to law enforcement - e.g. personal sites, Facebook mirrors.", - "uuid": "cfc5c1e0-be6b-564f-967e-4d743cc778e7" - }, - { - "value": "legitimate", - "expanded": "legitimate", - "description": "Legitimate websites", - "uuid": "387c9069-d6c4-5f43-9eb7-32162941f399" - }, - { - "value": "chat", - "expanded": "chatsPlatforms", - "description": "Chats space or equivalent, which are not forums", - "uuid": "fb4c9c08-533c-5249-8c6b-5168ca323603" - }, - { - "value": "mixer", - "expanded": "mixer", - "description": "Anonymization tools for crypto-currencies transactions", - "uuid": "fb9642a9-19f6-5d91-957c-ea5e8bc0cffe" - }, - { - "value": "mystery-box", - "expanded": "mysteryBox", - "description": "Mystery Box seller", - "uuid": "ef7e8781-88de-57b0-828a-984f3cee421c" - }, - { - "value": "anonymizer", - "expanded": "anonymizer", - "description": "Anonymization tools", - "uuid": "b0c90be6-7222-5136-aaf1-d31611609075" - }, - { - "value": "vpn-provider", - "expanded": "vpnProvider", - "description": "Provides VPN services and related", - "uuid": "1d80b14f-b58f-56fd-8876-ce3d0beaea35" - }, - { - "value": "email-provider", - "expanded": "emailProvider", - "description": "Provides e-mail services and related", - "uuid": "6f16c756-1c15-5547-9ec5-b474f39729d5" - }, - { - "value": "ponies", - "expanded": "ponies", - "description": "self-explanatory. It's ponies", - "uuid": "f4b7373b-752a-5eb1-93b3-41d358352931" - }, - { - "value": "games", - "expanded": "games", - "description": "Flash or online games", - "uuid": "6bbb9ad9-e062-5c11-a7c0-70a3cc8fb40f" - }, - { - "value": "parody", - "expanded": "parodyOrJoke", - "description": "Meme, Parody, Jokes, Trolling, ...", - "uuid": "9b174b05-f0ec-5a64-b6ad-b23061e7d60b" - }, - { - "value": "whistleblower", - "expanded": "whistleblower", - "description": "Exposition and sharing of confidential information with protection of the witness in mind", - "uuid": "da304f47-3a05-51b0-84e2-2e99b7ec665f" - }, - { - "value": "ransomware-group", - "expanded": "ransomwareGroup", - "description": "Ransomware group PR or leak website", - "uuid": "d17ecc1e-def0-5b50-9fb9-e15575f120c1" - }, - { - "value": "hitman", - "expanded": "Hit Man Services", - "description": "Hit man or similar services", - "uuid": "dd97317a-ed28-53f4-be71-2ba06fabe2aa" - }, - { - "value": "directory-provider", - "expanded": "DirectoryProvider", - "description": "Provides list of addresses or references to other services", - "uuid": "39d73b81-6fb1-5497-af33-b1f45c2b8444" - } - ] - }, - { - "predicate": "motivation", - "entry": [ - { - "value": "education-training", - "expanded": "educationTraining", - "description": "Materials providing instruction - e.g. ‘how to’ guides", - "uuid": "d8147c03-b4bf-5067-afc5-a64718ba2ed2" - }, - { - "value": "wiki", - "expanded": "wiki", - "description": "Wiki pages, documentation and information display", - "uuid": "e0bd35b8-64ef-59c4-be25-76a6935d5056" - }, - { - "value": "forum", - "expanded": "forum", - "description": "Sites specifically designed for multiple users to communicate as peers", - "uuid": "b973983f-135c-522d-bfa8-49e1db6087b2" - }, - { - "value": "file-sharing", - "expanded": "fileSharing", - "description": "General file sharing, typically (but not limited to) movie/image sharing", - "uuid": "702a2777-de00-5db2-8fd5-fc6526be76a6" - }, - { - "value": "hosting", - "expanded": "hosting", - "description": "Hosting providers, e-mails, websites, file-storage etc.", - "uuid": "f1e6d068-532a-5562-b5a2-34b8e445c4da" - }, - { - "value": "ddos-services", - "expanded": "ddosServices", - "description": "Stresser, Booter, DDoSer, DDoS as a Service provider, DDoS tools, etc.", - "uuid": "1c67e426-988e-58a1-9be5-799c0e00ce6f" - }, - { - "value": "general", - "expanded": "general", - "description": "Materials not covered by the other motivations. Typically, materials of a nature not of interest to law enforcement. For example, personal biography sites.", - "uuid": "a05cfb9e-cf25-59f3-bde4-a86dfc5c74b3" - }, - { - "value": "information-sharing-reportage", - "expanded": "InformationSharingReportage", - "description": "Journalism/reporting on topics. Can include biased coverage, but obvious propaganda materials are covered by Recruitment/Advocacy.", - "uuid": "67160e7a-b00c-5e35-8bc4-62919bacc8c0" - }, - { - "value": "scam", - "expanded": "scam", - "description": "Intentional confidence trick to fraud people or group of people", - "uuid": "61e67c0c-38e9-528c-a29a-f7a23451a7d1" - }, - { - "value": "political-speech", - "expanded": "politicalSpeech", - "description": "Political, activism, without extremism.", - "uuid": "cc41bd8f-8e32-56db-9453-077dec7a2882" - }, - { - "value": "conspirationist", - "expanded": "conspirationist", - "description": "Conspirationist content, fake news, etc.", - "uuid": "7d482ac9-17d3-5357-9a9e-d6af5acbdc4b" - }, - { - "value": "hate-speech", - "expanded": "hateSpeech", - "description": "Racism, violent, hate... speech.", - "uuid": "397c30d0-cc5a-5945-ae16-8ce75d35fcfc" - }, - { - "value": "religious", - "expanded": "religious", - "description": "Religious, faith, doctrinal related content.", - "uuid": "6db14a02-536d-5138-bc38-5ecad840b468" - }, - { - "value": "marketplace-for-sale", - "expanded": "marketplaceForSale", - "description": "Services/goods for sale, regardless of means of payment.", - "uuid": "9368f7f6-e932-5339-9b23-2f843339a128" - }, - { - "value": "smuggling", - "expanded": "smuggling", - "description": "Information or trading of wild animals, prohibited goods, ... ", - "uuid": "81b9160b-89d8-501b-9799-a65c56742564" - }, - { - "value": "recruitment-advocacy", - "expanded": "recruitmentAdvocacy", - "description": "Propaganda", - "uuid": "630ba296-6f1f-53b1-9a29-f7b3ba93a83f" - }, - { - "value": "system-placeholder", - "expanded": "systemPlaceholder", - "description": "Automatically generated content, not designed for any identifiable purpose other than diagnostics - e.g. “It Works” message provided by default by Apache2", - "uuid": "dc940230-d400-5476-9abe-65cd2f616f70" - }, - { - "value": "unclear", - "expanded": "unclear", - "description": "Unable to completely establish motivation of material.", - "uuid": "f82f4748-1756-52c0-bb83-f7e2f72736a3" - } - ] - }, - { - "predicate": "structure", - "entry": [ - { - "value": "incomplete", - "expanded": "incomplete", - "description": "Websites and pages that are unable to load completely properly", - "uuid": "163fc4a7-6dc9-5e76-8858-15ee8dc3bec9" - }, - { - "value": "captcha", - "expanded": "captcha", - "description": "Captchas and solvers elements", - "uuid": "1a335beb-c479-5042-87e6-403e045f8c00" - }, - { - "value": "login-forms", - "expanded": "loginForms", - "description": "Authentication pages, login page, login forms that block access to an internal part of a website.", - "uuid": "b6913de4-0184-5261-9c64-9f0d52503c7b" - }, - { - "value": "contact-forms", - "expanded": "contactForms", - "description": "Forms to perform a contact request, send an e-mail, fill information, enter a password, ...", - "uuid": "8e3e6ec4-711b-504a-8772-3c01782f480f" - }, - { - "value": "encryption-keys", - "expanded": "encryptionKeys", - "description": "e.g. PGP Keys, passwords, ...", - "uuid": "04ef6db9-f206-5e65-8b55-f9597cc5ee82" - }, - { - "value": "police-notice", - "expanded": "policeNotice", - "description": "Closed websites, with police-equivalent banners", - "uuid": "765d98a5-c65f-5bf1-aca0-11ae735913ec" - }, - { - "value": "legal-statement", - "expanded": "legalStatement", - "description": "RGPD statement, Privacy-policy, guidelines of a websites or forum...", - "uuid": "03ba3686-4c49-5e0f-b56a-8b730955e344" - }, - { - "value": "test", - "expanded": "test", - "description": "Test websites without any real consequences or effects", - "uuid": "11044e87-a985-5c2a-a865-6531f46a5d6d" - }, - { - "value": "videos", - "expanded": "videos", - "description": "Videos and streaming", - "uuid": "c8e7e0c9-ce42-56c9-bf86-0e7997e4212a" - }, - { - "value": "ransomware-post", - "expanded": "ransomwarePost", - "description": "Ransomware post published by a ransomware group", - "uuid": "8adc9bef-350a-573e-bf09-b002981de97a" - }, - { - "value": "unclear", - "expanded": "unclear", - "description": "Unable to completely establish structure of material.", - "uuid": "9f67fb3a-1599-5fd6-b0d1-cc2a272246ce" - } - ] - }, - { - "predicate": "service", - "entry": [ - { - "value": "url", - "expanded": "url", - "description": "Uniform Resource Locator (URL) of a dark-web. The url should indicate a protocol (http), a hostname (www.example.com), and a file name (index.html). Example: http://www.example.com/index.html", - "uuid": "04522a6c-a2f2-51ed-a002-94802fe7e223" - }, - { - "value": "content-type", - "expanded": "contentType", - "description": "Content-Type representaton headerused to indicate the original media type of the resource (prior to any content encoding applied for sending). https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Type", - "uuid": "5a2563bf-2bfd-5ac8-b93e-4c32e9935e7d" - }, - { - "value": "path", - "expanded": "path", - "description": "The URL path is the string of information that comes after the top level domain name ", - "uuid": "a36a2eb9-4ba6-5fea-a8ac-4ee8fb26b5a8" - }, - { - "value": "detection-date", - "expanded": "detectionDate", - "description": "Date in which the dark-web was detected. The date should be in ISO 8601 format. Example: 2019-01-01T00:00:00Z", - "uuid": "7b2c8372-0075-5066-b71d-0bd789d5730b" - }, - { - "value": "network-protocol", - "expanded": "networkProtocol", - "description": "Network protocol used to access the dark-web site (e.g., HTTP, HTTPS)", - "uuid": "a4d64528-b02b-5d08-bbb9-62aed10e1edd" - }, - { - "value": "port", - "expanded": "port", - "description": "Port number where the dark-web service is being offered", - "uuid": "a59ef0e4-cac6-5083-8be9-1942a0e60bdc" - }, - { - "value": "network", - "expanded": "network", - "description": "Overlay network (darknet) that host the service or content", - "uuid": "9669a3bb-ed5f-5900-91de-bf08f19d910f" - }, - { - "value": "found-at", - "expanded": "foundAt", - "description": "Domain or service where the dark-web where found at", - "uuid": "df687db2-3985-50a6-902d-fbc779c9d472" - } - ] - }, - { - "predicate": "content", - "entry": [ - { - "value": "sha1sum", - "expanded": "sha1sum", - "description": "SHA-1 (Secure Hash Algorithm 1) hash of the HTML or objectName content", - "uuid": "116f6006-be87-5299-881e-03687011e0d2" - }, - { - "value": "sha256sum", - "expanded": "sha256sum", - "description": "SHA-256 hash of the HTML or objectName content", - "uuid": "44ebd31e-7bea-5c57-870b-54b489645ce6" - }, - { - "value": "ssdeep", - "expanded": "ssdeep", - "description": "ssdeep fuzzy hash of the HTML or objectName content", - "uuid": "55757904-9927-5aad-8fa8-d08f50e62207" - }, - { - "value": "language", - "expanded": "language", - "description": "Detected language of the service in ISO 639‑1 Code. Example: en", - "uuid": "88603a3f-cf87-555b-a5d0-e0413355b4af" - }, - { - "value": "html", - "expanded": "html", - "description": "HyperText Markup Language (HTML) used in a website", - "uuid": "75124a11-afcd-5861-8722-6ddd97b159e3" - }, - { - "value": "css", - "expanded": "css", - "description": "CSS (Cascading Style Sheets) used in a dark-web site", - "uuid": "dd5b3566-0a23-516f-8bef-f0394f97f5ed" - }, - { - "value": "text", - "expanded": "text", - "description": "Content of the dark-web service without HTML tags", - "uuid": "433c8804-df3c-5d3b-8349-95a157d5bd0a" - }, - { - "value": "page-title", - "expanded": "pageTitle", - "description": "HTML tag content of a dark-web site", - "uuid": "651f2b0d-911b-5446-9caf-ee648e40248d" - }, - { - "value": "phone-number", - "expanded": "phoneNumber", - "description": "Phone number identified in the dark-web site", - "uuid": "35743756-4657-5fb5-872b-b0a6b0631304" - }, - { - "value": "creditCard", - "expanded": "creditCard", - "description": "Credit card identified in the dark-web site", - "uuid": "8ab5572e-fa71-5c88-9f5f-c44f981a848f" - }, - { - "value": "email", - "expanded": "email", - "description": "Email address identified in the dark-web site", - "uuid": "28ca8c8a-675f-5b14-a5ac-b4973690734a" - }, - { - "value": "pgp-public-key-block", - "expanded": "pgpPublicKeyBlock", - "description": "PGP public key block identified in the dark-web site", - "uuid": "fd3c1c44-523b-553b-bcfd-24152f7abea7" - }, - { - "value": "country", - "expanded": "country", - "description": "Associated country detected on the code of the dark-web site, following ISO 3166-1 alpha-2", - "uuid": "10699158-da58-59a2-984e-f5a76fcc328f" - }, - { - "value": "company-name", - "expanded": "companyName", - "description": "Company name identified in a dark-web site", - "uuid": "3ab41a65-6779-5535-92c8-1303fbbaa17d" - }, - { - "value": "company-link", - "expanded": "companyLink", - "description": "Company link identified in a dark-web site", - "uuid": "b4a32a6b-9dab-5a7b-8d34-eaff81d27c33" - }, - { - "value": "victim-address", - "expanded": "victimAddress", - "description": "Business address identified in a dark-web site", - "uuid": "9139db18-9f0a-5756-b5dd-d7fcdee8b756" - }, - { - "value": "victim-TLD", - "expanded": "victimTLD", - "description": "Business Top Level Domain (TLD) of a company identified in a dark-web site", - "uuid": "e66bfbd4-32c1-558e-804c-5edf2328eb64" - } - ] - } - ], - "uuid": "73e689e1-a993-5962-bed6-6839f5e9d702" -} +{ + "namespace": "dark-web", + "expanded": "Dark Web", + "description": "Criminal motivation and content detection the dark web: A categorisation model for law enforcement. ref: Janis Dalins, Campbell Wilson, Mark Carman. Taxonomy updated by MISP Project and extended by the JRC (Joint Research Centre) of the European Commission, and subsequently re-extended by the Cátedra Ada Byron UAH-INCIBE.", + "version": 11, + "predicates": [ + { + "value": "topic", + "description": "Topic associated with the materials tagged", + "expanded": "Topic", + "uuid": "99c3043d-75c9-5033-bd26-c28da3790599" + }, + { + "value": "motivation", + "description": "Motivation with the materials tagged", + "expanded": "Motivation", + "uuid": "0cf412bf-5d22-5777-a3f3-e8997b26adf4" + }, + { + "value": "structure", + "description": "Structure of the materials tagged", + "expanded": "Structure", + "uuid": "b35ff672-d3af-532b-bd4f-c540297a0a92" + }, + { + "value": "service", + "description": "Information related to an Dark-Web service", + "expanded": "Service", + "uuid": "177a84c2-adbf-5d9c-9ddb-5b3da021b80a" + }, + { + "value": "content", + "description": "Identifiable entities and information contained in a Dark-Web service", + "expanded": "Content", + "uuid": "0dda2a15-f88c-5cb4-9eea-4ab98ae78586" + } + ], + "values": [ + { + "predicate": "topic", + "entry": [ + { + "value": "drugs-narcotics", + "expanded": "drugsNarcotics", + "description": "Illegal drugs/chemical compounds for consumption/ingestion - either via blanket unlawfulness (e.g. proscribed drugs) or via unlawful access (e.g. prescription-only/restricted medications sold without lawful accessibility).", + "uuid": "c0bef0db-be23-54f0-8e0f-2d53bd5ace87" + }, + { + "value": "electronics", + "expanded": "electronics", + "description": "Electronics and high tech materials, described or to sell for example.", + "uuid": "0e992b11-d9ff-5207-b3be-255b8854d198" + }, + { + "value": "finance", + "expanded": "finance", + "description": "Any monetary/currency/exchangeable materials. Includes carding, Paypal etc.", + "uuid": "b1f66aec-a0fe-5a5f-8be3-e30965e82d82" + }, + { + "value": "finance-crypto", + "expanded": "cryptoFinance", + "description": "Any monetary/currency/exchangeable materials based on cryptocurrencies. Includes Bitcoin, Litecoin etc.", + "uuid": "e41b1c45-22a3-5556-ba83-76e733bb70a1" + }, + { + "value": "credit-card", + "expanded": "creditCard", + "description": "Credit cards and payments materials", + "uuid": "7974c6ce-6657-5a3c-b6d4-5b39d52daff9" + }, + { + "value": "cash-in", + "expanded": "cashIn", + "description": "Buying parts of assets, conversion from liquid assets, currency, etc.", + "uuid": "5eb42283-05a0-55f4-930b-97020f04eddc" + }, + { + "value": "cash-out", + "expanded": "cashOut", + "description": "Selling parts of assets, conversion to liquid assets, currency, etc.", + "uuid": "686950f3-af41-5725-8639-5447915b4cef" + }, + { + "value": "escrow", + "expanded": "escrow", + "description": "Third party keeping assets in behalf of two other parties making a transactions.", + "uuid": "931f7351-3dd6-5fc8-b852-4c36e8c48747" + }, + { + "value": "hacking", + "expanded": "hacking", + "description": "Materials relating to the illegal access to or alteration of data and/or electronic services.", + "uuid": "0f2b0736-5539-57f2-a851-79946edadc96" + }, + { + "value": "identification-credentials", + "expanded": "identificationCredentials", + "description": "Materials used for providing/establishing identification with third parties. Examples include passports, driver licenses and login credentials.", + "uuid": "699a8290-82bd-520a-8c8c-55c2933fc5d0" + }, + { + "value": "intellectual-property-copyright-materials", + "expanded": "intellectualPropertyCopyrightMaterials", + "description": "Otherwise lawful materials stored, transferred or made available without consent of their legal rights holders.", + "uuid": "a2231160-c16c-5b96-a6fb-f80678b08e31" + }, + { + "value": "pornography-adult", + "expanded": "pornographyAdult", + "description": "Lawful, ethical pornography (i.e. involving only consenting adults).", + "uuid": "01a8e7dc-ab88-55c1-8fba-6cc748aec64d" + }, + { + "value": "child-sexual-abuse-material", + "expanded": "ChildSexualAbuseMaterial", + "description": "Child abuse materials, including 'fantasy' fiction materials, CGI. Also includes the provision/offering of child abuse materials and/or activities", + "uuid": "0f3bce10-2ce0-5d82-8adf-2d63eefa0ba7" + }, + { + "value": "pornography-illicit-or-illegal", + "expanded": "pornographyIllicitOrIllegal", + "description": "Illegal pornography NOT including children/child abuse materials. Includes bestiality, stolen/revenge porn, hidden cameras etc.", + "uuid": "54cd953b-e51b-5748-9dff-07340492114a" + }, + { + "value": "search-engine-index", + "expanded": "searchEngineIndex", + "description": "Site providing links/references to other sites/services. Referred to as a ‘nexus’ by (Moore and Rid, 2016)", + "uuid": "a6204e13-14a6-5738-ac34-f6fdf4d1e842" + }, + { + "value": "unclear", + "expanded": "unclear", + "description": "Unable to completely establish topic of material.", + "uuid": "43ab130f-e57b-518d-bf1f-7a771c614da8" + }, + { + "value": "extremism", + "expanded": "extremism", + "description": "Illegal or ‘of concern’ levels of extremist ideology. Note this does not provide blanket coverage of fundamentalist ideologies and dogma - only those associated with illegal acts. Socialist/anarchist/religious materials (for example) will not be included unless inclusive or indicative of associated illegal conduct, such as hate crimes.", + "uuid": "564a07fc-b2a6-5102-a94d-f97b20dc1d99" + }, + { + "value": "violence", + "expanded": "violence", + "description": "Materials relating to violence against persons or property.", + "uuid": "4e6c319d-3e08-5bb5-9731-3562751b2673" + }, + { + "value": "weapons", + "expanded": "weapons", + "description": "Materials specifically associated with materials and/or items for use in violent acts against persons or property. Examples include firearms and bomb-making ingredients.", + "uuid": "37a1b75a-3d95-5048-97bd-9332aa11e36e" + }, + { + "value": "softwares", + "expanded": "softwares", + "description": "Illegal or armful software distribution", + "uuid": "43c70d70-8370-522b-ad07-cd244e8e01c6" + }, + { + "value": "counterfeit-materials", + "expanded": "counterFeitMaterials", + "description": "Fake identification papers.", + "uuid": "2456cae3-087b-514a-b7aa-0da55b6ee64d" + }, + { + "value": "gambling", + "expanded": "gambling", + "description": "Games involving money", + "uuid": "64719351-5b69-5539-8359-0196b82741ee" + }, + { + "value": "library", + "expanded": "library", + "description": "Library or list of books", + "uuid": "00d6a94a-7f65-52cc-a19e-5258f5c34cce" + }, + { + "value": "other-not-illegal", + "expanded": "otherNotIllegal", + "description": "Material not of interest to law enforcement - e.g. personal sites, Facebook mirrors.", + "uuid": "cfc5c1e0-be6b-564f-967e-4d743cc778e7" + }, + { + "value": "legitimate", + "expanded": "legitimate", + "description": "Legitimate websites", + "uuid": "387c9069-d6c4-5f43-9eb7-32162941f399" + }, + { + "value": "chat", + "expanded": "chatsPlatforms", + "description": "Chats space or equivalent, which are not forums", + "uuid": "fb4c9c08-533c-5249-8c6b-5168ca323603" + }, + { + "value": "mixer", + "expanded": "mixer", + "description": "Anonymization tools for crypto-currencies transactions", + "uuid": "fb9642a9-19f6-5d91-957c-ea5e8bc0cffe" + }, + { + "value": "mystery-box", + "expanded": "mysteryBox", + "description": "Mystery Box seller", + "uuid": "ef7e8781-88de-57b0-828a-984f3cee421c" + }, + { + "value": "anonymizer", + "expanded": "anonymizer", + "description": "Anonymization tools", + "uuid": "b0c90be6-7222-5136-aaf1-d31611609075" + }, + { + "value": "vpn-provider", + "expanded": "vpnProvider", + "description": "Provides VPN services and related", + "uuid": "1d80b14f-b58f-56fd-8876-ce3d0beaea35" + }, + { + "value": "email-provider", + "expanded": "emailProvider", + "description": "Provides e-mail services and related", + "uuid": "6f16c756-1c15-5547-9ec5-b474f39729d5" + }, + { + "value": "ponies", + "expanded": "ponies", + "description": "self-explanatory. It's ponies", + "uuid": "f4b7373b-752a-5eb1-93b3-41d358352931" + }, + { + "value": "games", + "expanded": "games", + "description": "Flash or online games", + "uuid": "6bbb9ad9-e062-5c11-a7c0-70a3cc8fb40f" + }, + { + "value": "parody", + "expanded": "parodyOrJoke", + "description": "Meme, Parody, Jokes, Trolling, ...", + "uuid": "9b174b05-f0ec-5a64-b6ad-b23061e7d60b" + }, + { + "value": "whistleblower", + "expanded": "whistleblower", + "description": "Exposition and sharing of confidential information with protection of the witness in mind", + "uuid": "da304f47-3a05-51b0-84e2-2e99b7ec665f" + }, + { + "value": "ransomware-group", + "expanded": "ransomwareGroup", + "description": "Ransomware group PR or leak website", + "uuid": "d17ecc1e-def0-5b50-9fb9-e15575f120c1" + }, + { + "value": "hitman", + "expanded": "Hit Man Services", + "description": "Hit man or similar services", + "uuid": "dd97317a-ed28-53f4-be71-2ba06fabe2aa" + }, + { + "value": "directory-provider", + "expanded": "DirectoryProvider", + "description": "Provides list of addresses or references to other services", + "uuid": "39d73b81-6fb1-5497-af33-b1f45c2b8444" + }, + { + "value": "online-scam-reports", + "expanded": "onlineScamReports", + "description": "Posts where users report or warn about scams, fraudulent activities, or untrustworthy users on various online platforms, including darknet markets and communication apps.", + "uuid": "90341342-afc5-47fa-beb0-7045ee8214a9" + }, + { + "value": "platform-mechanics-and-community", + "expanded": "platformMechanicsAndCommunity", + "description": "Discussions related to the functioning of the platform itself, including user registration, scoring systems, user profiles, comments, and community feedback.", + "uuid": "c9610531-4d59-43e3-be93-b89600030f6a" + }, + { + "value": "politics-and-governance", + "expanded": "politicsAndGovernance", + "description": "Discussions related to political structures, governance, laws, international relations, and public service of specific countries or regions.", + "uuid": "eccf6951-f2d0-431d-ac24-a0f8e4c15bf9" + }, + { + "value": "mental-health", + "expanded": "mentalHealth", + "description": "Cluster of posts discussing various mental health issues, including depression, anxiety and suicidal thoughts.", + "uuid": "941b48b2-c25a-4750-8758-239228fe0ca6" + }, + { + "value": "confessions-and-personal-secrets", + "expanded": "confessionsAndPersonalSecrets", + "description": "A collection of posts where users share personal secrets, confessions or unusual behaviors, including paranormal experiences.", + "uuid": "bfc0bef4-25c5-4256-a5d9-72ea598ec94a" + }, + { + "value": "aliens-and-the-universe", + "expanded": "aliensAndTheUniverse", + "description": "Discussions about the existence, nature, and possibility of extraterrestrial life and other cosmological mysteries.", + "uuid": "c0b99d6c-5195-4aee-b42a-89ef63a98c74" + }, + { + "value": "english-learning", + "expanded": "englishLearning", + "description": "Posts and resources focused on learning English: grammar, vocabulary, speaking, listening, exam prep (e.g., TOEFL/IELTS), and study communities.", + "uuid": "07216474-2f38-4f8e-809e-16aa6813c6aa" + } + ] + }, + { + "predicate": "motivation", + "entry": [ + { + "value": "education-training", + "expanded": "educationTraining", + "description": "Materials providing instruction - e.g. ‘how to’ guides", + "uuid": "d8147c03-b4bf-5067-afc5-a64718ba2ed2" + }, + { + "value": "wiki", + "expanded": "wiki", + "description": "Wiki pages, documentation and information display", + "uuid": "e0bd35b8-64ef-59c4-be25-76a6935d5056" + }, + { + "value": "forum", + "expanded": "forum", + "description": "Sites specifically designed for multiple users to communicate as peers", + "uuid": "b973983f-135c-522d-bfa8-49e1db6087b2" + }, + { + "value": "file-sharing", + "expanded": "fileSharing", + "description": "General file sharing, typically (but not limited to) movie/image sharing", + "uuid": "702a2777-de00-5db2-8fd5-fc6526be76a6" + }, + { + "value": "hosting", + "expanded": "hosting", + "description": "Hosting providers, e-mails, websites, file-storage etc.", + "uuid": "f1e6d068-532a-5562-b5a2-34b8e445c4da" + }, + { + "value": "ddos-services", + "expanded": "ddosServices", + "description": "Stresser, Booter, DDoSer, DDoS as a Service provider, DDoS tools, etc.", + "uuid": "1c67e426-988e-58a1-9be5-799c0e00ce6f" + }, + { + "value": "general", + "expanded": "general", + "description": "Materials not covered by the other motivations. Typically, materials of a nature not of interest to law enforcement. For example, personal biography sites.", + "uuid": "a05cfb9e-cf25-59f3-bde4-a86dfc5c74b3" + }, + { + "value": "information-sharing-reportage", + "expanded": "InformationSharingReportage", + "description": "Journalism/reporting on topics. Can include biased coverage, but obvious propaganda materials are covered by Recruitment/Advocacy.", + "uuid": "67160e7a-b00c-5e35-8bc4-62919bacc8c0" + }, + { + "value": "scam", + "expanded": "scam", + "description": "Intentional confidence trick to fraud people or group of people", + "uuid": "61e67c0c-38e9-528c-a29a-f7a23451a7d1" + }, + { + "value": "political-speech", + "expanded": "politicalSpeech", + "description": "Political, activism, without extremism.", + "uuid": "cc41bd8f-8e32-56db-9453-077dec7a2882" + }, + { + "value": "conspirationist", + "expanded": "conspirationist", + "description": "Conspirationist content, fake news, etc.", + "uuid": "7d482ac9-17d3-5357-9a9e-d6af5acbdc4b" + }, + { + "value": "hate-speech", + "expanded": "hateSpeech", + "description": "Racism, violent, hate... speech.", + "uuid": "397c30d0-cc5a-5945-ae16-8ce75d35fcfc" + }, + { + "value": "religious", + "expanded": "religious", + "description": "Religious, faith, doctrinal related content.", + "uuid": "6db14a02-536d-5138-bc38-5ecad840b468" + }, + { + "value": "marketplace-for-sale", + "expanded": "marketplaceForSale", + "description": "Services/goods for sale, regardless of means of payment.", + "uuid": "9368f7f6-e932-5339-9b23-2f843339a128" + }, + { + "value": "smuggling", + "expanded": "smuggling", + "description": "Information or trading of wild animals, prohibited goods, ... ", + "uuid": "81b9160b-89d8-501b-9799-a65c56742564" + }, + { + "value": "recruitment-advocacy", + "expanded": "recruitmentAdvocacy", + "description": "Propaganda", + "uuid": "630ba296-6f1f-53b1-9a29-f7b3ba93a83f" + }, + { + "value": "system-placeholder", + "expanded": "systemPlaceholder", + "description": "Automatically generated content, not designed for any identifiable purpose other than diagnostics - e.g. “It Works” message provided by default by Apache2", + "uuid": "dc940230-d400-5476-9abe-65cd2f616f70" + }, + { + "value": "confessions-and-secrets", + "expanded": "confessionsAndSecrets", + "description": "A collection of posts where individuals share personal secrets or confessions, ranging from mundane to controversial topics.", + "uuid": "9bad55a3-d09f-4eae-a7df-a64fbbcc3a7f" + }, + { + "value": "unclear", + "expanded": "unclear", + "description": "Unable to completely establish motivation of material.", + "uuid": "f82f4748-1756-52c0-bb83-f7e2f72736a3" + } + ] + }, + { + "predicate": "structure", + "entry": [ + { + "value": "incomplete", + "expanded": "incomplete", + "description": "Websites and pages that are unable to load completely properly", + "uuid": "163fc4a7-6dc9-5e76-8858-15ee8dc3bec9" + }, + { + "value": "captcha", + "expanded": "captcha", + "description": "Captchas and solvers elements", + "uuid": "1a335beb-c479-5042-87e6-403e045f8c00" + }, + { + "value": "login-forms", + "expanded": "loginForms", + "description": "Authentication pages, login page, login forms that block access to an internal part of a website.", + "uuid": "b6913de4-0184-5261-9c64-9f0d52503c7b" + }, + { + "value": "contact-forms", + "expanded": "contactForms", + "description": "Forms to perform a contact request, send an e-mail, fill information, enter a password, ...", + "uuid": "8e3e6ec4-711b-504a-8772-3c01782f480f" + }, + { + "value": "encryption-keys", + "expanded": "encryptionKeys", + "description": "e.g. PGP Keys, passwords, ...", + "uuid": "04ef6db9-f206-5e65-8b55-f9597cc5ee82" + }, + { + "value": "police-notice", + "expanded": "policeNotice", + "description": "Closed websites, with police-equivalent banners", + "uuid": "765d98a5-c65f-5bf1-aca0-11ae735913ec" + }, + { + "value": "legal-statement", + "expanded": "legalStatement", + "description": "RGPD statement, Privacy-policy, guidelines of a websites or forum...", + "uuid": "03ba3686-4c49-5e0f-b56a-8b730955e344" + }, + { + "value": "test", + "expanded": "test", + "description": "Test websites without any real consequences or effects", + "uuid": "11044e87-a985-5c2a-a865-6531f46a5d6d" + }, + { + "value": "videos", + "expanded": "videos", + "description": "Videos and streaming", + "uuid": "c8e7e0c9-ce42-56c9-bf86-0e7997e4212a" + }, + { + "value": "ransomware-post", + "expanded": "ransomwarePost", + "description": "Ransomware post published by a ransomware group", + "uuid": "8adc9bef-350a-573e-bf09-b002981de97a" + }, + { + "value": "unclear", + "expanded": "unclear", + "description": "Unable to completely establish structure of material.", + "uuid": "9f67fb3a-1599-5fd6-b0d1-cc2a272246ce" + } + ] + }, + { + "predicate": "service", + "entry": [ + { + "value": "url", + "expanded": "url", + "description": "Uniform Resource Locator (URL) of a dark-web. The url should indicate a protocol (http), a hostname (www.example.com), and a file name (index.html). Example: http://www.example.com/index.html", + "uuid": "04522a6c-a2f2-51ed-a002-94802fe7e223" + }, + { + "value": "content-type", + "expanded": "contentType", + "description": "Content-Type representaton headerused to indicate the original media type of the resource (prior to any content encoding applied for sending). https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Type", + "uuid": "5a2563bf-2bfd-5ac8-b93e-4c32e9935e7d" + }, + { + "value": "path", + "expanded": "path", + "description": "The URL path is the string of information that comes after the top level domain name ", + "uuid": "a36a2eb9-4ba6-5fea-a8ac-4ee8fb26b5a8" + }, + { + "value": "detection-date", + "expanded": "detectionDate", + "description": "Date in which the dark-web was detected. The date should be in ISO 8601 format. Example: 2019-01-01T00:00:00Z", + "uuid": "7b2c8372-0075-5066-b71d-0bd789d5730b" + }, + { + "value": "network-protocol", + "expanded": "networkProtocol", + "description": "Network protocol used to access the dark-web site (e.g., HTTP, HTTPS)", + "uuid": "a4d64528-b02b-5d08-bbb9-62aed10e1edd" + }, + { + "value": "port", + "expanded": "port", + "description": "Port number where the dark-web service is being offered", + "uuid": "a59ef0e4-cac6-5083-8be9-1942a0e60bdc" + }, + { + "value": "network", + "expanded": "network", + "description": "Overlay network (darknet) that host the service or content", + "uuid": "9669a3bb-ed5f-5900-91de-bf08f19d910f" + }, + { + "value": "found-at", + "expanded": "foundAt", + "description": "Domain or service where the dark-web where found at", + "uuid": "df687db2-3985-50a6-902d-fbc779c9d472" + } + ] + }, + { + "predicate": "content", + "entry": [ + { + "value": "sha1sum", + "expanded": "sha1sum", + "description": "SHA-1 (Secure Hash Algorithm 1) hash of the HTML or objectName content", + "uuid": "116f6006-be87-5299-881e-03687011e0d2" + }, + { + "value": "sha256sum", + "expanded": "sha256sum", + "description": "SHA-256 hash of the HTML or objectName content", + "uuid": "44ebd31e-7bea-5c57-870b-54b489645ce6" + }, + { + "value": "ssdeep", + "expanded": "ssdeep", + "description": "ssdeep fuzzy hash of the HTML or objectName content", + "uuid": "55757904-9927-5aad-8fa8-d08f50e62207" + }, + { + "value": "language", + "expanded": "language", + "description": "Detected language of the service in ISO 639‑1 Code. Example: en", + "uuid": "88603a3f-cf87-555b-a5d0-e0413355b4af" + }, + { + "value": "html", + "expanded": "html", + "description": "HyperText Markup Language (HTML) used in a website", + "uuid": "75124a11-afcd-5861-8722-6ddd97b159e3" + }, + { + "value": "css", + "expanded": "css", + "description": "CSS (Cascading Style Sheets) used in a dark-web site", + "uuid": "dd5b3566-0a23-516f-8bef-f0394f97f5ed" + }, + { + "value": "text", + "expanded": "text", + "description": "Content of the dark-web service without HTML tags", + "uuid": "433c8804-df3c-5d3b-8349-95a157d5bd0a" + }, + { + "value": "page-title", + "expanded": "pageTitle", + "description": "HTML <title> tag content of a dark-web site", + "uuid": "651f2b0d-911b-5446-9caf-ee648e40248d" + }, + { + "value": "phone-number", + "expanded": "phoneNumber", + "description": "Phone number identified in the dark-web site", + "uuid": "35743756-4657-5fb5-872b-b0a6b0631304" + }, + { + "value": "creditCard", + "expanded": "creditCard", + "description": "Credit card identified in the dark-web site", + "uuid": "8ab5572e-fa71-5c88-9f5f-c44f981a848f" + }, + { + "value": "email", + "expanded": "email", + "description": "Email address identified in the dark-web site", + "uuid": "28ca8c8a-675f-5b14-a5ac-b4973690734a" + }, + { + "value": "pgp-public-key-block", + "expanded": "pgpPublicKeyBlock", + "description": "PGP public key block identified in the dark-web site", + "uuid": "fd3c1c44-523b-553b-bcfd-24152f7abea7" + }, + { + "value": "country", + "expanded": "country", + "description": "Associated country detected on the code of the dark-web site, following ISO 3166-1 alpha-2", + "uuid": "10699158-da58-59a2-984e-f5a76fcc328f" + }, + { + "value": "company-name", + "expanded": "companyName", + "description": "Company name identified in a dark-web site", + "uuid": "3ab41a65-6779-5535-92c8-1303fbbaa17d" + }, + { + "value": "company-link", + "expanded": "companyLink", + "description": "Company link identified in a dark-web site", + "uuid": "b4a32a6b-9dab-5a7b-8d34-eaff81d27c33" + }, + { + "value": "victim-address", + "expanded": "victimAddress", + "description": "Business address identified in a dark-web site", + "uuid": "9139db18-9f0a-5756-b5dd-d7fcdee8b756" + }, + { + "value": "victim-TLD", + "expanded": "victimTLD", + "description": "Business Top Level Domain (TLD) of a company identified in a dark-web site", + "uuid": "e66bfbd4-32c1-558e-804c-5edf2328eb64" + } + ] + } + ], + "uuid": "73e689e1-a993-5962-bed6-6839f5e9d702" +} \ No newline at end of file