Recognise the Signs

Spot dark web indicators in surface web research: .onion addresses, PGP keys, marketplace signals and the language of dark web communities.

Access Safely

Set up an isolated environment, install Tor Browser correctly and understand the attribution risks before you go in.

Understand The Landscape

What the dark web is and isn’t, how Tor and other darknets work, who uses them and why it matters for your investigations.

ABOUT THIS COURSE

Dark web activity surfaces in everyday investigations: a leaked credential, an .onion address in a dataset, a vendor handle on a forum. Knowing what you’re looking at, and how to look further without exposing yourself or your organisation, is now a core OSINT skill.

This course gives you that foundation. You’ll learn how Tor and other darknets work, recognise dark web indicators, set up a safe research environment, find dark web content from the surface web, and record what you find. Just as importantly, you’ll learn where the limits are: what to do if you encounter illegal material, how to look after yourself, and when to escalate. Lessons are sourced so you can follow them up.

For investigators who need to understand the dark web properly before working with it. Certificate on completion.

WHAT YOU’LL BE ABLE TO DO

Explain the layers

Explain how the surface, deep and dark web differ, and how Tor routes traffic to protect anonymity.

Spot the indicators

Recognise v3 .onion addresses, PGP keys, marketplace and escrow indicators, and common dark web terminology.

Research safely

Apply a read-only approach to preliminary research, and know what to do if you encounter illegal material.

Set up securely

Set up an isolated research environment and install Tor Browser from the official source.

Manage attribution

Assess network and client attribution risks, and reduce your exposure.

Record and escalate

Find dark web references from the surface web, record your discovery path, and know when to escalate.

WHO THIS COURSE IS FOR

1

Set up a VM

Use the free Trace Labs VM, or an approved alternative, for safer research.

2

Connect to Tor

Download, install and connect Tor Browser, then inspect your own Tor circuit.

3

Find references

Use Google search operators and Reddit to find dark web references on the surface web.

4

Navigate directories

Use dark web directories, and verify links before relying on them.

5

Capture and record

Take screenshots safely inside a VM, and document how you found each item.

6

Test yourself

Six knowledge-check quizzes, with explanations for every answer.

WHAT’S INCLUDED

Seven short modules, about 80 minutes of video and six knowledge-check quizzes. You also get reporting resources for Australia, the US, the UK, Canada and Europe, and the free Dark Web Bookmark Stack to keep.

TIME, AUDIENCE & PREREQUISITES

Estimated time to complete: about 3 hours, including videos, reading and quizzes. Allow up to an extra hour if you set up the virtual machine and Tor Browser as you go. This course is self-paced: complete it in one sitting or return whenever it suits you over 12 months.

Who this course is for: investigators, intelligence analysts, law enforcement, corporate security and due diligence professionals who come across dark web elements in their work. It’s also the foundation for Illuminating the Dark Web.

What you’ll need: A web browser. To follow the hands-on lessons, you’ll also need a computer that can run a virtual machine, and your organisation’s approval for dark web access. If you can’t install a VM, you can still follow every lesson on video.

Prerequisites: None. Familiarity with OSINT and basic operational security will help, but isn’t required.

WHAT'S NEXT?

This course is the foundation. Illuminating the Dark Web builds on it with dark web search engines, forum and actor investigations, communication channels such as PGP and Telegram, and other darknets including I2P. Get both in the Dark Web Bundle.

Attribution: Digital Footprint Assessment goes deeper on operational security and attribution management before you take on sustained or sensitive research.

Course curriculum

    1. Welcome to the Dark Web Course

    2. Before We Begin

    3. Introduction to the Darknet

    4. Surface, Deep and Dark Web

    5. What is Tor

    6. Other Darknets

    7. Use and Scale

    8. Who Uses and Why

    9. Why It Matters for Investigations

    10. Quiz: An Overview of Tor and Other Darknets

    1. Common Risks and Mistakes

    2. Preliminary Research Principles

    3. Encountering Illegal Material: What To Do

    4. Reporting Resources by Jurisdiction

    5. Looking After Yourself

    6. Check Your Organisational Policy

    7. Quiz: Risks and Protective Measures

    1. Identifying .onion Links

    2. Understanding PGP in Context

    3. Escrow and Marketplace Indicators

    4. Dark Web Terminology and Subcultures

    5. Quiz: Recognising Dark Web Activity

    1. Setting Up a Virtual Machine (VM)

    2. VM Options and Setup Orientation

    3. Downloading and Configuring Tor Browser

    4. Network and Client Attribution Basics

    5. Quiz: Accessing the Dark Web

    1. Google Dorking for .onion References

    2. Using Reddit for Dark Web References

    3. Using Dark Web Directories

    4. Managing Bookmarks

    5. Quiz: Finding Dark Web Content

    1. Basic Screenshot Methods

    2. Recording What You Find

    3. When to Escalate

    4. Quiz: Capturing and When to Escalate

About this course

  • $199.00
  • 38 lessons
  • 1.5 hours of video content