DARK WEB INVESTIGATION & ATTRIBUTION REPORT

[SUBJECT / HANDLE / ENTITY / INCIDENT]

The Dark Web Investigation & Attribution Report identifies, maps, and attributes dark-web activity - accounts, handles, marketplaces, forums, hidden services, and communications - to a real-world subject, entity, or threat actor. It is a forensic-OSINT product that traces the subject’s dark-web footprint, establishes attribution confidence, and surfaces actionable intelligence on illicit activity, network connections, and operational security (OPSEC) posture. It is not a general Dark-Web Exposure Assessment (→ that product surveys an organization’s leaked/breached credentials and dark-web surface exposure without attribution to a specific subject), not a Digital Footprint & Exposure Assessment (→ that product covers clearnet social-media, professional, and public-record exposure, not dark-web activity), and not a cryptocurrency tracing report (→ Financial Intelligence node, Crypto Tracing & Attribution). If the investigation requires blockchain-forensic attribution of cryptocurrency transactions, route to the Crypto Tracing & Attribution product. This product assumes lawful, open-source-only collection via anonymized research infrastructure; it does not include undercover engagement, honeypot operation, or technical exploitation of hidden services.

---

Document Control

Field	Value
Report Reference	[REF-YYYY-###]
Date of Report	[YYYY-MM-DD]
Investigation As-Of Date	[YYYY-MM-DD]
Subject / Target	[Subject name / handle / entity / incident reference]
Triggering Requirement	[Client request / incident / threat / compliance trigger]
Client	[CLIENT NAME]
Prepared By	[ANALYST NAME / ID]
Reviewed By	[REVIEWER NAME / ID]
Approving Officer	[APPROVER NAME / ID]
Version	[1.0]
Distribution	[NAMED RECIPIENTS]

Handling & Legal Caveat

Handling: [Classification/TLP]. Named recipients only. No onward dissemination without originator approval.

Lawful open-source collection: All dark-web research was conducted using publicly available tools and anonymized access to publicly accessible hidden services. No unauthorized access, no computer intrusion (CFAA / Computer Misuse Act / equivalent), no undercover engagement, no technical exploitation, and no purchase of illicit goods or services was undertaken. Collection was limited to passive observation and lawful access to open/proprietary data sources.

Attribution limitations: Dark-web attribution is inherently probabilistic. Identifiers (handles, PGP keys, wallet addresses, writing patterns) are circumstantial evidence. Attribution confidence is stated separately from likelihood of activity. This product does not constitute proof of identity for legal or evidentiary purposes unless independently confirmed by law enforcement or judicial process.

Permissible purpose: Conducted for the lawful investigative/protective purpose of [PURPOSE]. Not a “consumer report” and not prepared by a “consumer reporting agency” under the FCRA (15 U.S.C. § 1681); not for any FCRA-covered eligibility determination.

Data protection: Personal data processed under [GDPR/CCPA/applicable regime]; handle per the client DPA and retention schedule [RETENTION REF]. Privilege: [If applicable] Attorney–Client Privileged / Work Product.

Currency: Dark-web activity is ephemeral. This report reflects data captured as of the as-of date. Hidden services, accounts, and content may be taken offline, moved, or altered after capture.

Investigation Snapshot

Field	Value
Subject / Handle(s)	[Primary identifier(s)]
Primary Dark-Web Venues	[Marketplace(s) / forum(s) / hidden service(s)]
Attribution Confidence	[Confirmed / Probable / Possible / Unresolved]
Primary Illicit Activity Indicated	[Type - e.g., credential trafficking / narcotics / fraud / data sale / C2 infrastructure]
Network / Affiliation Indicators	[Group / threat-actor cluster / marketplace affiliation]
OPSEC Posture	[Low / Moderate / High - basis]
Recommended Action	[One line]

---

Table of Contents

Page numbers populate on export to Word/PDF.

1. Bottom Line Up Front (BLUF)
2. Executive Summary
3. Key Judgments
4. Priority Intelligence Requirements (PIRs)
5. Subject Identification & Dark-Web Handles
6. Venue & Platform Mapping
7. Activity & Communications Analysis
8. Attribution Analysis
9. Network & Affiliation Mapping
10. Illicit Activity & Threat Indicators
11. Operational Security (OPSEC) Assessment
12. Risk Assessment
13. Verified Findings Summary
14. Red Flag / Notable Indicators
15. Analysis of Competing Hypotheses (ACH)
16. Key Assumptions Check
17. Collection Gaps & RFIs
18. Recommendations
19. Sources & Methodology
20. Appendices

---

1. BLUF (Bottom Line Up Front)

2–4 sentences. State the most critical finding - whether the subject’s dark-web activity was identified, the attribution determination, the primary illicit activity surfaced, and the immediate recommended action.

• Attribution determination: [Confirmed / Probable / Possible / Unresolved.]
• Primary finding: [One-sentence summary of the most significant dark-web activity or connection.]
• Immediate action: [Protective / investigative / legal / monitoring action.]

2. Executive Summary

Triggering Requirement

What prompted this investigation - client request, threat indicator, compliance trigger, incident response.

[Narrative.]

Scope & Limitations

What was investigated, dark-web venues searched, time window, and constraints (no undercover engagement, no technical exploitation, no purchase, attribution limitations, ephemeral nature of dark-web content).

[Narrative.]

Key Findings (Overview)

Narrative summary of the investigation’s principal findings - handles identified, venues frequented, activity observed, attribution evidence, network connections.

[Narrative.]

Attribution Bottom Line

The net attribution determination in narrative form - consistent with §8.

[Narrative.]

3. Key Judgments

Analytic assessments. Likelihood (of the subject’s involvement in identified activity) and analytic confidence in SEPARATE columns (never combined - ICD 203). Each judgment names its change indicator.

#	Judgment	Likelihood	Analytic Confidence	Change Indicator
KJ-1	[e.g., Subject operates the identified dark-web handle(s)]	[almost no chance … almost certain]	[HIGH/MOD/LOW]	[ ]
KJ-2	[e.g., Subject is engaged in the identified illicit activity]	[ ]	[ ]	[ ]
KJ-3	[e.g., Subject is connected to the identified threat-actor network]	[ ]	[ ]	[ ]
KJ-4	[e.g., Subject’s OPSEC posture is [low/moderate/high]]	[ ]	[ ]	[ ]
KJ-5	[e.g., Subject’s dark-web activity poses [risk level] to client]	[ ]	[ ]	[ ]

4. Priority Intelligence Requirements (PIRs)

The questions this investigation must answer (PIR → indicator → source). Answer, evidence, confidence, residual gap each.

PIR-1: [e.g., What dark-web handles / accounts does the subject operate?]

Assessment	Supporting Evidence	Confidence
[IDENTIFIED / PARTIALLY IDENTIFIED / NOT IDENTIFIED]	[ ]	[HIGH/MOD/LOW]

Residual gap: [Carry to §17 if open.]

PIR-2: [e.g., What dark-web venues does the subject frequent?]

Assessment	Supporting Evidence	Confidence
[ ]	[ ]	[ ]

Residual gap: [ ]

PIR-3: [e.g., What illicit activity is the subject engaged in?]

Assessment	Supporting Evidence	Confidence
[ ]	[ ]	[ ]

Residual gap: [ ]

PIR-4: [e.g., Can the subject’s dark-web activity be attributed to a real-world identity?]

Assessment	Supporting Evidence	Confidence
[ ]	[ ]	[ ]

Residual gap: [ ]

PIR-5: [e.g., What network / affiliation connections exist?]

Assessment	Supporting Evidence	Confidence
[ ]	[ ]	[ ]

Residual gap: [ ]

PIR Summary Matrix

PIR	Question (brief)	Answer	Confidence
PIR-1	Handles / accounts	[ ]	[H/M/L]
PIR-2	Venues frequented	[ ]	[H/M/L]
PIR-3	Illicit activity	[ ]	[H/M/L]
PIR-4	Attribution to real-world identity	[ ]	[H/M/L]
PIR-5	Network / affiliation connections	[ ]	[H/M/L]

5. Subject Identification & Dark-Web Handles

All dark-web identifiers associated with the subject - handles, usernames, nicknames, PGP key IDs, wallet addresses, email addresses, and any cross-platform identifiers. Distinguish primary from secondary/alias handles and note the basis for association.

Identifier Type	Identifier	Venue / Platform	Basis for Association	Source Grade
[Handle / PGP key / Wallet / Email / Other]	[ ]	[ ]	[Cross-post / writing style / PGP key reuse / wallet clustering / registration data / self-disclosure]	[A–F/1–6]
[ ]	[ ]	[ ]	[ ]	[ ]

Handle summary: [Primary handle(s), secondary/alias handles, and the confidence of association to the subject.]

6. Venue & Platform Mapping

The dark-web venues, forums, marketplaces, and hidden services where the subject’s identifiers have been observed. Include the nature of the venue, the subject’s activity level, and the time window of observed presence.

Venue / Platform	Type	URL / .onion	Subject Handle(s)	Activity Level	Time Window	Source Grade
[ ]	[Marketplace / Forum / Chat / Leak site / Paste site / Other]	[ ]	[ ]	[Active / Occasional / Historical / Single post]	[YYYY-MM – YYYY-MM]	[ ]
[ ]	[ ]	[ ]	[ ]	[ ]	[ ]	[ ]

Venue summary: [Primary venues, activity pattern, and any escalation or change in venue usage over time.]

7. Activity & Communications Analysis

Analysis of the subject’s dark-web activity - posts, listings, messages, transactions, and interactions. Characterize the nature, frequency, and content of activity. Distinguish between public posts, private messages (if observable), and transactional activity.

Activity Type	Venue	Date	Summary / Content	Significance	Source Grade
[Post / Listing / Message / Transaction / File upload / Other]	[ ]	[YYYY-MM-DD]	[ ]	[ ]	[ ]
[ ]	[ ]	[ ]	[ ]	[ ]	[ ]

Activity pattern assessment: [Frequency, timing, escalation, change in behavior, operational security awareness.]

Communications Content Themes

Key themes, topics, and language patterns observed in the subject’s communications - without reproducing verbatim content that would identify the subject or compromise the investigation.

[Narrative.]

Writing Style & Linguistic Analysis

Linguistic markers, writing patterns, language use, and any distinctive stylistic elements that support attribution or cross-platform linking.

[Narrative.]

8. Attribution Analysis

The core attribution artifact. Map the evidence chain linking the subject’s real-world identity to the dark-web identifiers. Use the identity-resolution confidence scale (Confirmed / Probable / Possible / Unresolved). State the evidence for and against attribution, and the discriminating factors.

Attribution Evidence Chain

Evidence Type	Evidence Detail	Strength	Source Grade
[PGP key reuse / cross-platform handle / wallet clustering / registration data / self-disclosure / writing style / metadata / operational mistake / other]	[ ]	[Strong / Moderate / Weak]	[ ]
[ ]	[ ]	[ ]	[ ]

Attribution Confidence Determination

Determination	Finding	Basis
Attribution confidence	[Confirmed / Probable / Possible / Unresolved]	[ ]
Primary linking evidence	[ ]	[ ]
Contradictory / exculpatory evidence	[ ]	[ ]
Namesake / false-flag risk	[ ]	[ ]

Attribution rationale: [Narrative argument for the attribution determination. State the strongest evidence, the weakest link, and the residual uncertainty.]

9. Network & Affiliation Mapping

The subject’s dark-web network - known associates, co-posting accounts, transactional counterparties, forum connections, and any affiliation with threat-actor groups, marketplaces, or criminal networks.

Connection / Associate	Handle(s)	Venue	Nature of Connection	Confidence	Source Grade
[ ]	[ ]	[ ]	[Co-poster / transaction partner / forum interaction / shared infrastructure / group affiliation]	[H/M/L]	[ ]
[ ]	[ ]	[ ]	[ ]	[ ]	[ ]

Network assessment: [Size, structure, centrality of subject, key connections, and any escalation in network activity.]

Group / Threat-Actor Affiliation

Any indicators linking the subject to a known threat-actor group, cybercriminal collective, or organized crime network.

[Narrative.]

10. Illicit Activity & Threat Indicators

Specific illicit activities the subject is engaged in or facilitating through dark-web activity. Categorize by type and assess the threat to the client or other parties.

Illicit Activity Type	Evidence	Severity	Confidence	Source Grade
[Credential trafficking / data sale / narcotics / fraud / malware / C2 infrastructure / stolen financial data / identity documents / other]	[ ]	[Critical / High / Moderate / Low]	[H/M/L]	[ ]
[ ]	[ ]	[ ]	[ ]	[ ]

Illicit activity assessment: [Primary activity, scale, recency, and trajectory.]

Threat to Client / Protectee

Specific threat posed to the client - whether the subject’s activity targets the client, uses client data, or otherwise creates exposure or risk.

[Narrative.]

11. Operational Security (OPSEC) Assessment

Evaluate the subject’s OPSEC posture - the degree to which they take measures to conceal their identity, activity, and infrastructure. Low OPSEC = easier to attribute; high OPSEC = harder to attribute and may indicate sophistication or professional criminal/state affiliation.

OPSEC Factor	Finding	Assessment
Handle / identity compartmentalization	[ ]	[Strong / Moderate / Weak / Unknown]
PGP / encryption usage	[ ]	[ ]
VPN / Tor / proxy usage (inferred)	[ ]	[ ]
Operational security mistakes observed	[ ]	[ ]
Counter-OSINT / anti-forensic measures	[ ]	[ ]
Consistency of OPSEC across venues	[ ]	[ ]

OPSEC posture: [Low / Moderate / High - with rationale and implications for further collection.]

12. Risk Assessment

Risk scoring of the subject’s dark-web activity to the client. Likelihood (1–5) × Impact (1–5) = 1–25. See methodology annex for scale definitions.

Risk Domain	Likelihood (1–5)	Impact (1–5)	Risk Score (1–25)	Risk Level	Mitigation / Notes
[Data exposure / credential compromise]	[ ]	[ ]	[ ]	[Low / Moderate / Elevated / High / Critical]	[ ]
[Reputational risk]	[ ]	[ ]	[ ]	[ ]	[ ]
[Operational / security risk]	[ ]	[ ]	[ ]	[ ]	[ ]
[Legal / regulatory risk]	[ ]	[ ]	[ ]	[ ]	[ ]
[Financial risk]	[ ]	[ ]	[ ]	[ ]	[ ]

Overall risk rating: [Narrative assessment of the net risk to the client from the subject’s dark-web activity.]

13. Verified Findings Summary

#	Finding	Status	Confidence	Materiality
F-1	[ ]	[Verified / Unverified / Contradicted]	[H/M/L]	[Material / Minor]
F-2	[ ]	[ ]	[ ]	[ ]
F-3	[ ]	[ ]	[ ]	[ ]

14. Red Flag / Notable Indicators

Flag table of notable indicators - behaviors, connections, or activity patterns that warrant heightened attention or escalation.

Flag	Type	Finding	Severity	Source Grade
[ ]	[Behavioral / Network / Activity / OPSEC / Attribution]	[ ]	[Critical / High / Moderate / Low]	[ ]
[ ]	[ ]	[ ]	[ ]	[ ]

Flag severity rollup: [Summary of the most critical flags and their implications.]

15. Analysis of Competing Hypotheses (ACH)

Test the alternatives - genuine attribution, misattribution (namesake / false flag / framing), shared account / multiple users, or the subject being unaware of the account’s activity.

Hypothesis 1: [Subject genuinely operates the identified dark-web handles]

• Evidence for / against: [ ] / [ ]
• Assessment: [ ]

Hypothesis 2: [Misattribution - handles belong to a different person (namesake / false flag)]

• Evidence for / against: [ ] / [ ]
• Assessment: [ ]

Hypothesis 3: [Shared account / multiple users - subject is one of several operators]

• Evidence for / against: [ ] / [ ]
• Assessment: [ ]

Hypothesis 4: [Subject is unaware of the account / activity (compromised identity / planted evidence)]

• Evidence for / against: [ ] / [ ]
• Assessment: [ ]

Most consistent hypothesis: [Which, and the discriminating evidence.]

16. Key Assumptions Check

#	Assumption	Basis	Confidence	Impact if Wrong
A-1	[e.g., Handles are not shared / multi-user]	[ ]	[H/M/L]	[ ]
A-2	[e.g., Dark-web content was not tampered with / planted]	[ ]	[ ]	[ ]
A-3	[e.g., Subject’s OPSEC posture is consistent across venues]	[ ]	[ ]	[ ]
A-4	[e.g., No law-enforcement / intelligence operation is running the account]	[ ]	[ ]	[ ]

17. Collection Gaps & RFIs

Gap / RFI	Impact on Assessment	Recommended Collection	Priority
[ ]	[ ]	[Method / venue / technique]	[HIGH/MED/LOW]
[ ]	[ ]	[ ]	[ ]

18. Recommendations

For Client Stakeholders

Stakeholder	Recommendation	Rationale	Priority
[Security / Legal / Executive / IT]	[ ]	[ ]	[H/M/L]
[ ]	[ ]	[ ]	[ ]

Next Investigative Actions

Action	Rationale	Estimated LOE	Priority
[Further dark-web monitoring / expanded venue search / writing-style analysis / wallet clustering / PGP key analysis / associate mapping]	[ ]	[Hours / days / weeks]	[H/M/L]
[ ]	[ ]	[ ]	[ ]

Monitoring & Reassessment

Recommended monitoring cadence and triggers for reassessment.

[Narrative.]

19. Annex A - Sources & Methodology

Reference scales - reproduced verbatim per TEMPLATE-STANDARD §3 (the tables below elaborate them per row).

Source reliability (Admiralty, A–F): A Completely reliable · B Usually reliable · C Fairly reliable · D Not usually reliable · E Unreliable · F Reliability cannot be judged.

Information credibility (Admiralty, 1–6): 1 Confirmed by other sources · 2 Probably true · 3 Possibly true · 4 Doubtful · 5 Improbable · 6 Truth cannot be judged.

Estimative probability / likelihood (ICD 203): almost no chance / remote (01–05%) · very unlikely / highly improbable (05–20%) · unlikely / improbable (20–45%) · roughly even chance (45–55%) · likely / probable (55–80%) · very likely / highly probable (80–95%) · almost certain / nearly certain (95–99%).

Analytic confidence (evidence base, separate from likelihood): HIGH (multiple independent reliable sources, primary documentation, no significant contradiction) · MODERATE (some corroboration, gaps, minor unresolved inconsistency) · LOW (single / uncorroborated source, significant gaps, plausible alternatives open). Never combine a likelihood term and a confidence level in the same sentence.

Risk scoring: Likelihood (1–5) × Impact (1–5) = 1–25; key: 1–5 Low · 6–10 Moderate · 11–15 Elevated · 16–20 High · 21–25 Critical.

Methodology & Frameworks

Describe the collection methodology - anonymized dark-web research, venue selection, search techniques, data capture and preservation, attribution methodology, and analytic frameworks applied.

• [Methods: passive dark-web observation, forum scraping (lawful), marketplace monitoring, PGP key analysis, wallet clustering (if applicable), writing-style analysis, cross-platform handle correlation, metadata analysis]

Source Register

Ref	Source	Type	Reliability (A–F)	Credibility (1–6)	Date
S-1	[ ]	[Forum post / marketplace listing / hidden service / PGP key / wallet transaction / chat log / other]	[ ]	[ ]	[YYYY-MM-DD]
S-2	[ ]	[ ]	[ ]	[ ]	[ ]

Source Reliability Scale (Admiralty, A–F)

Grade	Meaning
A	Completely reliable
B	Usually reliable
C	Fairly reliable
D	Not usually reliable
E	Unreliable
F	Reliability cannot be judged

Information Credibility Scale (Admiralty, 1–6)

Grade	Meaning
1	Confirmed by other sources
2	Probably true
3	Possibly true
4	Doubtful
5	Improbable
6	Truth cannot be judged

Estimative Probability (Likelihood) Lexicon - ICD 203

Term	Range
Almost no chance / remote	01–05%
Very unlikely / highly improbable	05–20%
Unlikely / improbable	20–45%
Roughly even chance	45–55%
Likely / probable	55–80%
Very likely / highly probable	80–95%
Almost certain / nearly certain	95–99%

Analytic Confidence Scale (evidence base)

Level	Criteria
HIGH	Multiple independent, reliable sources; corroborated evidence; no significant contradiction.
MODERATE	Partial corroboration; some gaps; minor unresolved inconsistencies.
LOW	Single/uncorroborated source; significant gaps; plausible alternatives open.

Risk Scoring Key (where applied)

Score	Level	Criteria
1–5	Low	Minimal impact; routine handling.
6–10	Moderate	Manageable impact; active monitoring.
11–15	Elevated	Significant impact; active mitigation required.
16–20	High	Severe impact; immediate action required.
21–25	Critical	Existential / catastrophic impact; urgent escalation.

Identity-Resolution Confidence Scale (dark-web attribution)

Level	Criteria
Confirmed	Multiple independent, corroborated evidence streams linking the subject to the dark-web identifier(s); no significant contradictory evidence.
Probable	Strong circumstantial evidence; multiple indicators converge; some residual uncertainty.
Possible	Single evidence stream or weak circumstantial indicators; plausible alternatives not excluded.
Unresolved	Insufficient evidence to assess attribution; significant gaps or contradictory indicators.

Methodological note: Dark-web attribution is inherently probabilistic. Attribution confidence is a structured judgment based on the weight and convergence of evidence, not a legal or evidentiary standard. Likelihood (of activity) and analytic confidence (in the evidence) are stated separately (ICD 203). All collection was conducted via lawful, open-source, anonymized methods; no undercover engagement, technical exploitation, or purchase of illicit goods/services was undertaken.

20. Appendices

• Appendix A - Handle & Identifier Index: [All dark-web identifiers with cross-references to venues, evidence, and source grades.]
• Appendix B - Venue & Platform Register: [Full list of venues searched, with access method, date, and findings.]
• Appendix C - Evidence Archive & Chain of Custody: [Captured content, screenshots, hashes, timestamps, preservation method.]
• Appendix D - PGP Key / Wallet Address Index: [If applicable - PGP key IDs, fingerprints, wallet addresses with clustering analysis.]
• Appendix E - Network Map (Textual): [Associate/connection map with relationship descriptions and confidence.]
• Appendix F - Glossary & Abbreviations (dark-web terminology, OPSEC terms, attribution concepts).
• Appendix G - Revision History.

---

END OF REPORT

This Dark Web Investigation & Attribution Report is a forensic-OSINT product prepared from lawful, open-source, anonymized dark-web research as of the stated as-of date. Attribution is probabilistic and does not constitute proof of identity for legal or evidentiary purposes. All collection was passive and lawful; no undercover engagement, technical exploitation, or purchase of illicit goods/services was undertaken. Dark-web content is ephemeral and this report reflects data captured as of the as-of date. If imminent threat or criminal activity requiring law-enforcement action is identified, contact appropriate authorities immediately.

Field	Value
Prepared By	[ANALYST NAME / ID]
Reviewed By	[REVIEWER NAME / ID]
Approving Officer	[APPROVER NAME / ID]
Date	[YYYY-MM-DD]
Version	[X.X]

Model wiring

Generated from cell frontmatter at publish time.

• Inputs: OSINT-058
• Produces for: OSINT-022
• Related: OSINT-055, OSINT-058