Deep Web Index (DWI)

 Country Rankings

SOCRadar, the extended threat intelligence platform, collects data from hacker forums and chatters on the deep web including Telegram/Discord/IRC hacker channels. While converting the raw data into intelligence, the SOCRadar Research Team also provides insightful statistics about the deep web posts such as Deep Web Index - Country Rankings.

DWI is a metric to give an insight about threats towards countries with respect to the number of deep web mentions in the last 12 months. DWI is a number between 0 and 100 calculated based on the number of mentions, the attack type, and the time of the mention. See Methodology for details.

Do you want to know the data breaches about your company exposed on the deep web?

Free Deep Web Report

Deep web index (DWI) – Country rankings


SOCRadar automatically tags each deep web post based on the targeted country, attack type, industry, etc. The country is determined whether the name of the country is directly mentioned or one or more companies in the post operate in the country of interest.

See our recent regional and deep web reports

DWI for a country is a normalized value and calculated by the equation below.

DWI for a country = 100 x (total DMI in the last 12 months for that country) / max (total DMIs), where DMI is deep web mention index and it is calculated for each mention.

DMI for a mention = Attack factor coefficient/days passed since the mention DDMI is proportional to the attack factor coefficient (AFC), a metric that is between 0.0 and 5.0 based on the threat level. For instance, AFC for ransomware is 5.0 while a recruitment post gets only 1.0 as AFC. The DMI decreases by the aging of the mention.

Explore suites

SOCRadar offers cyber threat intelligence, digital risk protection, and external attack surface management capabilities as suites to improve your security posture.