{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,2,5]],"date-time":"2026-02-05T13:40:22Z","timestamp":1770298822016,"version":"3.49.0"},"reference-count":36,"publisher":"MDPI AG","issue":"11","license":[{"start":{"date-parts":[[2025,10,22]],"date-time":"2025-10-22T00:00:00Z","timestamp":1761091200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/501100004837","name":"Spanish Ministry of Science and Innovation","doi-asserted-by":"crossref","award":["PID2021-125645OB-I00"],"award-info":[{"award-number":["PID2021-125645OB-I00"]}],"id":[{"id":"10.13039\/501100004837","id-type":"DOI","asserted-by":"crossref"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Information"],"abstract":"<jats:p>The Dark Web, a hidden segment of the internet, has become a hub for illicit activities, facilitated by various forms of digital identification (IDs) such as email addresses, Telegram accounts, and cryptocurrency wallets. This study conducts a comprehensive analysis of the Dark Web\u2019s identification and communication patterns, focusing on the roles of different ID types and their associated activities. Using a dataset of Dark Web documents, we construct and analyze a bipartite network to model the relationships between IDs and web documents, employing graph\u2013theoretical metrics such as degree centrality, closeness centrality, betweenness centrality, and k-core decomposition, while analyzing subnetworks formed by ID type. Our findings reveal that Telegram forms the backbone of the network, serving as the primary communication tool for hacking-related activities, particularly within Russian-speaking communities. In contrast, email plays a more decentralized role, facilitating finance\u2013crypto and other activities but with a high level of fragmentation and English as the predominant language. XMR (Monero) wallets emerge as a key component in financial transactions, forming a cohesive subnetwork focused on cryptocurrency-related activities. The analysis also highlights the modular and hierarchical nature of the Dark Web, with distinct clusters for hacking, finance\u2013crypto, and drugs\u2013narcotics, often operating independently but with some cross-topic interactions. This study provides a foundation for understanding the Dark Web\u2019s structure and dynamics, offering insights that can inform strategies for monitoring and mitigating its risks.<\/jats:p>","DOI":"10.3390\/info16110924","type":"journal-article","created":{"date-parts":[[2025,10,22]],"date-time":"2025-10-22T07:03:51Z","timestamp":1761116631000},"page":"924","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":1,"title":["Unveiling Dark Web Identity Patterns: A Network-Based Analysis of Identification Types and Communication Channels in Illicit Activities"],"prefix":"10.3390","volume":"16","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-0718-8774","authenticated-orcid":false,"given":"Luis","family":"de-Marcos","sequence":"first","affiliation":[{"name":"Department of Computer Science, Universidad de Alcal\u00e1, Alcal\u00e1 de Henares, 28801 Madrid, Spain"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7632-8609","authenticated-orcid":false,"given":"Adri\u00e1n","family":"Dom\u00ednguez-D\u00edaz","sequence":"additional","affiliation":[{"name":"Department of Computer Science, Universidad de Alcal\u00e1, Alcal\u00e1 de Henares, 28801 Madrid, Spain"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4597-6539","authenticated-orcid":false,"given":"Javier","family":"Junquera-S\u00e1nchez","sequence":"additional","affiliation":[{"name":"Department of Computer Science, Universidad de Alcal\u00e1, Alcal\u00e1 de Henares, 28801 Madrid, Spain"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7107-8655","authenticated-orcid":false,"given":"Carlos","family":"Cilleruelo","sequence":"additional","affiliation":[{"name":"Department of Computer Science, Universidad de Alcal\u00e1, Alcal\u00e1 de Henares, 28801 Madrid, Spain"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2351-7163","authenticated-orcid":false,"given":"Jos\u00e9-Javier","family":"Mart\u00ednez-Herr\u00e1iz","sequence":"additional","affiliation":[{"name":"Department of Computer Science, Universidad de Alcal\u00e1, Alcal\u00e1 de Henares, 28801 Madrid, Spain"}]}],"member":"1968","published-online":{"date-parts":[[2025,10,22]]},"reference":[{"key":"ref_1","unstructured":"Chertoff, M., and Simon, T. (2025). The Impact of the Dark Web on Internet Governance and Cyber Security, Global Commission on Internet Governance."},{"key":"ref_2","unstructured":"Soska, K., and Christin, N. (2015, January 12\u201314). Measuring the longitudinal evolution of the online anonymous marketplace ecosystem. Proceedings of the USENIX Security Symposium, Washington, DC, USA."},{"key":"ref_3","first-page":"40","article-title":"Terrorist migration to the Dark Web","volume":"10","author":"Weimann","year":"2016","journal-title":"Perspect. Terror."},{"key":"ref_4","doi-asserted-by":"crossref","first-page":"67159","DOI":"10.1109\/ACCESS.2025.3560543","article-title":"LLM-Based Topic Modeling for Dark Web Q&A forums: A Comparative Analysis with Traditional Methods","volume":"13","year":"2025","journal-title":"IEEE Access"},{"key":"ref_5","doi-asserted-by":"crossref","first-page":"149880","DOI":"10.1109\/ACCESS.2025.3597975","article-title":"What\u2019s Going on in Dark Web Question and Answer Forums: Topic Diversity and Linguistic Characteristics","volume":"13","year":"2025","journal-title":"IEEE Access"},{"key":"ref_6","doi-asserted-by":"crossref","first-page":"118903","DOI":"10.1109\/ACCESS.2024.3448247","article-title":"Navigating the shadows: Manual and semi-automated evaluation of the dark web for cyber threat intelligence","volume":"12","author":"Wittorf","year":"2024","journal-title":"IEEE Access"},{"key":"ref_7","doi-asserted-by":"crossref","unstructured":"Sangher, K.S., Singh, A., Pandey, H.M., and Kumar, V. (2023). Towards Safe Cyber Practices: Developing a Proactive Cyber-Threat Intelligence System for Dark Web Forum Content by Identifying Cybercrimes. Information, 14.","DOI":"10.3390\/info14060349"},{"key":"ref_8","unstructured":"Soliman, K.S. (2025). A survey of challenges in dark web crawling: Technical, security, and ethical perspective. Artificial Intelligence and Machine Learning. IBIMA-AI 2024. Communications in Computer and Information Science, Springer."},{"key":"ref_9","doi-asserted-by":"crossref","unstructured":"Arabnezhad, E., La Morgia, M., Mei, A., Nemmi, E.N., and Stefa, J. (December, January 29). A light in the dark web: Linking dark web aliases to real internet identities. Proceedings of the 2020 IEEE 40th International Conference on Distributed Computing Systems (ICDCS), Singapore.","DOI":"10.1109\/ICDCS47774.2020.00081"},{"key":"ref_10","first-page":"15574","article-title":"VeriDark: A large-scale benchmark for authorship verification on the dark web","volume":"Volume 35","author":"Koyejo","year":"2022","journal-title":"Proceedings of the 36th International Conference on Neural Information Processing Systems (NIPS \u201922)"},{"key":"ref_11","doi-asserted-by":"crossref","first-page":"771","DOI":"10.1093\/ntr\/ntad248","article-title":"Identification and characterization of illegal sales of cannabis and nicotine delivery products on Telegram messaging platform","volume":"26","author":"Nali","year":"2024","journal-title":"Nicotine Tob. Res."},{"key":"ref_12","unstructured":"La Morgia, M., Mei, A., Mongardini, A.M., and Wu, J. (2021). Uncovering the dark side of Telegram: Fakes, clones, scams, and conspiracy movements. arXiv."},{"key":"ref_13","doi-asserted-by":"crossref","unstructured":"Lee, S., Yoon, C., Kang, H., Kim, Y., Kim, Y., Han, D., Son, S., and Shin, S. (2019, January 24\u201327). Cybercriminal minds: An investigative study of cryptocurrency abuses in the dark web. Proceedings of the Network and Distributed Systems Security (NDSS) Symposium 2019, San Diego, CA, USA.","DOI":"10.14722\/ndss.2019.23055"},{"key":"ref_14","first-page":"1","article-title":"Ransomware payments in the Bitcoin ecosystem","volume":"5","author":"Haslhofer","year":"2019","journal-title":"J. Cybersecur."},{"key":"ref_15","doi-asserted-by":"crossref","first-page":"257","DOI":"10.1177\/10439862231157521","article-title":"Follow the money: Analyzing darknet activity using cryptocurrency and the Bitcoin blockchain","volume":"39","author":"Dearden","year":"2023","journal-title":"J. Contemp. Crim. Justice"},{"key":"ref_16","doi-asserted-by":"crossref","first-page":"160","DOI":"10.1080\/17440572.2012.702523","article-title":"The social network of hackers","volume":"13","author":"Dupont","year":"2012","journal-title":"Glob. Crime"},{"key":"ref_17","doi-asserted-by":"crossref","unstructured":"Takaaki, S., and Atsuo, I. (2019, January 27). Dark web content analysis and visualization. Proceedings of the ACM International Workshop on Security and Privacy Analytics (IWSPA \u201919), Richardson, TX, USA.","DOI":"10.1145\/3309182.3309189"},{"key":"ref_18","doi-asserted-by":"crossref","first-page":"61","DOI":"10.1109\/MIC.2020.3037723","article-title":"Interconnection between darknets","volume":"25","author":"Cilleruelo","year":"2021","journal-title":"IEEE Internet Comput."},{"key":"ref_19","doi-asserted-by":"crossref","first-page":"21746","DOI":"10.1109\/ACCESS.2021.3055532","article-title":"Exploring the topological properties of the Tor dark web","volume":"9","author":"Alharbi","year":"2021","journal-title":"IEEE Access"},{"key":"ref_20","unstructured":"Borgatti, S.P., Everett, M.G., and Johnson, J.C. (2018). Analyzing Social Networks, SAGE Publications."},{"key":"ref_21","doi-asserted-by":"crossref","unstructured":"Javed, M.S., Sajjad, S.M., Mehmood, D., Mansoor, K., Iqbal, Z., Kazim, M., and Muhammad, Z. (2024). Analyzing Tor Browser Artifacts for Enhanced Web Forensics, Anonymity, Cybersecurity, and Privacy in Windows-Based Systems. Information, 15.","DOI":"10.3390\/info15080495"},{"key":"ref_22","first-page":"103229","article-title":"Drawing the web structure and content analysis beyond the Tor darknet: Freenet as a case of study","volume":"66","year":"2022","journal-title":"J. Inf. Secur. Appl."},{"key":"ref_23","first-page":"301086","article-title":"Measuring dark web marketplaces via Bitcoin transactions: From birth to independence","volume":"35","author":"Hiramoto","year":"2020","journal-title":"Forensic Sci. Int. Digit. Investig."},{"key":"ref_24","first-page":"301093","article-title":"Dark web in the dark: Investigating when transactions take place on cryptomarkets","volume":"36","author":"Tsuchiya","year":"2021","journal-title":"Forensic Sci. Int. Digit. Investig."},{"key":"ref_25","doi-asserted-by":"crossref","unstructured":"Almukaynizi, M., Grimm, A., Nunes, E., Shakarian, J., and Shakarian, P. (2017, January 19\u201322). Predicting cyber threats through hacker social networks in darkweb and deepweb forums. Proceedings of the CSS \u201917, CSSSA\u2019s Annual Conference on Computational Social Science, New York, NY, USA.","DOI":"10.1145\/3145574.3145590"},{"key":"ref_26","first-page":"87","article-title":"Predicting enterprise cyber incidents using social network analysis on dark web hacker forums","volume":"4","author":"Sarkar","year":"2019","journal-title":"Cyber Def. Rev."},{"key":"ref_27","doi-asserted-by":"crossref","first-page":"62","DOI":"10.1016\/j.diin.2017.12.003","article-title":"Criminal motivation on the dark web: A categorisation model for law enforcement","volume":"24","author":"Dalins","year":"2018","journal-title":"Digit. Investig."},{"key":"ref_28","first-page":"301604","article-title":"Busting up monopoly: Methods for modern darknet marketplace forensics","volume":"46","author":"Pluskal","year":"2023","journal-title":"Forensic Sci. Int. Digit. Investig."},{"key":"ref_29","doi-asserted-by":"crossref","first-page":"331","DOI":"10.1007\/s10207-023-00745-4","article-title":"Forensic investigation of the dark web on the Tor network: Pathway toward the surface web","volume":"23","author":"Jin","year":"2024","journal-title":"Int. J. Inf. Secur."},{"key":"ref_30","unstructured":"Bastian, M., Heymann, S., and Jacomy, M. (2020, January 17\u201320). Gephi: An open source software for exploring and manipulating networks. Proceedings of the International AAAI Conference on Web and Social Media, San Jose, CA, USA."},{"key":"ref_31","doi-asserted-by":"crossref","unstructured":"Jacomy, M., Venturini, T., Heymann, S., and Bastian, M. (2014). ForceAtlas2, a continuous graph layout algorithm for handy network visualization designed for the Gephi software. PLoS ONE, 9.","DOI":"10.1371\/journal.pone.0098679"},{"key":"ref_32","doi-asserted-by":"crossref","first-page":"493","DOI":"10.1086\/210318","article-title":"Networks, dynamics, and the small-world phenomenon","volume":"105","author":"Watts","year":"1999","journal-title":"Am. J. Sociol."},{"key":"ref_33","unstructured":"Phillips, E., Nurse, J.R.C., Goldsmith, M., and Creese, S. (2015, January 26\u201327). Extracting social structure from darkweb forums. Proceedings of the International Conference on Cyber Security for Sustainable Society, Coventry, UK."},{"key":"ref_34","doi-asserted-by":"crossref","unstructured":"L\u2019Huillier, B., R\u00edos, S.A., Alvarez, H., and Aguilera, F. (2010, January 25\u201328). Topic-based social network analysis for virtual communities of interests in the dark web. Proceedings of the ACM SIGKDD Workshop on Intelligence and Security Informatics ACM, Washington, DC, USA.","DOI":"10.1145\/1938606.1938615"},{"key":"ref_35","doi-asserted-by":"crossref","unstructured":"Pete, I., Hughes, J., Chua, Y.T., and Bada, M. (2020, January 7\u201311). A social network analysis and comparison of six dark web forums. Proceedings of the 2020 IEEE European Symposium on Security and Privacy Workshops (EuroSPW), Genoa, Italy.","DOI":"10.1109\/EuroSPW51379.2020.00071"},{"key":"ref_36","unstructured":"Zhang, Y., Zeng, S., Fan, L., Dang, Y., Larson, C.A., and Chen, H. (2009, January 8\u201311). Dark web forums portal: Searching and analyzing jihadist forums. Proceedings of the 2009 IEEE International Conference on Intelligence and Security Informatics, Dallas, TX, USA."}],"container-title":["Information"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2078-2489\/16\/11\/924\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,24]],"date-time":"2025-10-24T04:16:23Z","timestamp":1761279383000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2078-2489\/16\/11\/924"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,10,22]]},"references-count":36,"journal-issue":{"issue":"11","published-online":{"date-parts":[[2025,11]]}},"alternative-id":["info16110924"],"URL":"https:\/\/doi.org\/10.3390\/info16110924","relation":{},"ISSN":["2078-2489"],"issn-type":[{"value":"2078-2489","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,10,22]]}}}