Dark Web Index (DWI) Country Rankings

SOCRadar, the extended threat intelligence platform, collects data from hacker forums and chatters on the dark web, including Telegram, Discord, and IRC hacker channels. While converting the raw data into intelligence, the SOCRadar Research Team also provides insightful statistics about dark web posts such as Dark Web Index – Country Rankings.

DWI is a metric to give an insight into threats towards countries concerning the number of deep web mentions between April 2022- April 2023. DWI is a number between 0 and 100 calculated based on the number of mentions, the attack type, and the mention time. See Methodology for details.

Do you want to know the data breaches about your company exposed on the deep web?

Methodology

SOCRadar automatically tags each deep web post based on the targeted country, attack type, industry, etc. The country is determined whether the country’s name is directly mentioned or one or more companies in the post operate in the country of interest.

See our recent regional and dark web reports

DWI for a country is a normalized value calculated by the equation below:

DWI for a country = 100 x (total DMI in the last 12 months for that country) / max (total DMIs), where DMI is the dark web mention index, and it is calculated for each mention.

DMI for a mention = Attack factor coefficient/days passed since the mention
DDMI is proportional to the attack factor coefficient (AFC), a metric between 0.0 and 5.0 based on the threat level. For instance, AFC for ransomware is 5.0, while a recruitment post gets only 1.0 as AFC. The DMI decreases by the aging of the mention.

(Current date range: April 1, 2022- March 31, 2023)
Calculation method:
There are two factors to consider when calculating dark web and ransomware indexes:
-Update: Nearest month (March 2023) x 12, Farthest month (April 2022) x 1
-Impact: An impact score based on the post’s tag on the SOCRadar platform: “Ransomware x 5”, “Buying, Selling, Sharing x 4″, Target Attack, Hack Announcement x 3”, “Partnership/Cooperation/Offer x 2”.
The result of multiplying these multipliers becomes the score of each post.
It is grouped according to countries, and the country total is found. Country Percentage = (Country total/ total shipment total) x 100
(The calculation does not include cyber attacks targeting more than one country.)