Analysis of CSEM offenders on the dark web using honeypots to geolocate IP addresses from Spain

Abstract

Gathering evidence in cybercrime is a complex process. Under this premise, it is very important to have cutting-edge methodologies that allow the observation of criminal phenomena on the Internet and protect the personal integrity of the investigator, especially when the content is extremely critical and is located in the so-called dark zone of the Internet (hereinafter Dark Web). This article develops a new research methodology in the field of cybercrime based on the use of honeypots, and its main objective is to evaluate the ability to de-anonymize users in the Tor network to collect geographic coordinates and demographic data on the Dark Web in order to obtain digital evidence related to minors sexual (CSEM) offenders. The information collected aims to map the consumption of CSEM through cartograms, with a particular focus on the Spanish territory. The outcomes demonstrate the ability of using honeypots to assess the prevalence of CSEM consumption on the Dark Web. Future improvements of the methodology will be discussed.