Communication Transforms

Extract and search for communication channels including email addresses, Telegram links, and Discord invites. These transforms help identify vendor contacts, customer support channels, and link operators across platforms.

Overview

Communication transforms cover three main channels commonly used on the dark web:

• Email - Contact addresses for vendors, support, and communications
• Telegram - Popular encrypted messaging platform used for customer support
• Discord - Community and support servers

For each communication type, there are two transforms:

• Fetch - Extract contacts from an onion site
• Search - Find all onion sites using a specific contact

Email Transforms

FetchEmailAddresses

Transform Name: FetchEmailAddresses

Description

Extracts all email addresses found on a specified onion site.

Input Entity

• hades.v2.onion - An onion site address

Output Entities

• hades.v2.email - Email addresses

Properties Returned

• Appearances - Number of times the email appears on the site
• Hades Link - Direct link to view the onion site in Project Hades web interface

Use Cases

• Identify vendor contact emails
• Extract customer support addresses
• Find administrative contacts
• Discover hidden contact information in page source

SearchByEmail

Transform Name: SearchByEmail

Description

Finds all onion sites that contain a specific email address.

Input Entity

• hades.v2.email - An email address

Output Entities

• hades.v2.onion - Onion site addresses

Properties Returned

• Hades Link - Direct link to view each onion site in Project Hades web interface

Use Cases

• Track a vendor’s operations across multiple sites
• Identify all marketplaces where a vendor is active
• Link sites operated by the same person/team
• Monitor where a specific contact email is advertised

Investigation Tips

• Email addresses shared across multiple sites strongly indicate same operator
• Look for patterns in email domains (e.g., protonmail, tutanota for privacy-focused operators)
• Cross-reference with cryptocurrency addresses for stronger attribution

Telegram Transforms

FetchTelegramLinks

Transform Name: FetchTelegramLinks

Description

Extracts all Telegram links and handles found on a specified onion site.

Input Entity

• hades.v2.onion - An onion site address

Output Entities

• hades.v2.telegram - Telegram links/handles

Properties Returned

• Appearances - Number of times the Telegram link appears on the site
• Hades Link - Direct link to view the onion site in Project Hades web interface

Use Cases

• Identify customer support channels
• Find vendor Telegram handles
• Extract community group links
• Discover communication channels for marketplace disputes

What Gets Extracted

• Telegram usernames (e.g., @vendorname)
• Telegram invite links (t.me/…)
• Telegram group links
• Telegram channel links

SearchByTelegramLink

Transform Name: SearchByTelegramLink

Description

Finds all onion sites that reference a specific Telegram link or handle.

Input Entity

• hades.v2.telegram - A Telegram link or handle

Output Entities

• hades.v2.onion - Onion site addresses

Properties Returned

• Hades Link - Direct link to view each onion site in Project Hades web interface

Use Cases

• Track a vendor across multiple marketplaces
• Identify all sites using the same support channel
• Link related operations through shared Telegram contacts
• Monitor where specific Telegram groups are advertised

Investigation Tips

• Vendors often use the same Telegram handle across multiple platforms
• Shared Telegram support channels may indicate affiliated marketplaces
• Active Telegram accounts can be monitored separately from dark web presence

Discord Transforms

FetchDiscordInvites

Transform Name: FetchDiscordInvites

Description

Extracts all Discord invite links found on a specified onion site.

Input Entity

• hades.v2.onion - An onion site address

Output Entities

• hades.v2.discord - Discord invite links

Properties Returned

• Appearances - Number of times the Discord invite appears on the site
• Hades Link - Direct link to view the onion site in Project Hades web interface

Use Cases

• Identify community Discord servers
• Find customer support channels
• Extract marketplace community links
• Discover hidden communication platforms

What Gets Extracted

• Discord invite links (discord.gg/…)
• Discord server invites (discord.com/invite/…)

SearchByDiscordInvite

Transform Name: SearchByDiscordInvite

Description

Finds all onion sites that share a specific Discord invite link.

Input Entity

• hades.v2.discord - A Discord invite link

Output Entities

• hades.v2.onion - Onion site addresses

Properties Returned

• Hades Link - Direct link to view each onion site in Project Hades web interface

Use Cases

• Find all sites linking to the same Discord community
• Identify related marketplaces through shared Discord servers
• Track community presence across multiple sites
• Link sites operated by the same team

Investigation Tips

• Multiple sites linking to the same Discord server are likely related
• Discord servers can be infiltrated separately from dark web sites
• Discord invites may be time-limited or use-limited - document them quickly

Investigation Workflow Examples

Vendor Attribution Across Platforms

1. Extract contacts from known vendor

   • Input: Vendor’s marketplace listing page
   • Run: FetchEmailAddresses, FetchTelegramLinks, FetchDiscordInvites
   • Result: All contact methods used by the vendor

2. Search for each contact across dark web

   • Input: Each email, Telegram, Discord found
   • Run: SearchByEmail, SearchByTelegramLink, SearchByDiscordInvite
   • Result: All sites where vendor advertises each contact

3. Build vendor presence map

   • Map all sites where vendor is active
   • Identify which marketplaces vendor prefers
   • Track vendor migration between platforms
   • Note primary vs. backup contact methods

4. Cross-reference with financial intelligence

   • For each site where vendor is active:
   • Run: FetchBitcoinAddresses and other crypto transforms
   • Link contact information with payment addresses
   • Build comprehensive vendor profile

Marketplace Network Analysis

1. Extract support channels

   • Input: Multiple known marketplaces
   • Run: FetchTelegramLinks and FetchDiscordInvites on each
   • Result: Support/community channels for each marketplace

2. Identify shared channels

   • Look for marketplaces sharing the same Telegram or Discord
   • Run: SearchByTelegramLink or SearchByDiscordInvite on shared contacts
   • Result: Network of sites using common support infrastructure

3. Analyze relationships

   • Shared support channels indicate:
     • Same operators running multiple markets
     • Affiliated marketplaces
     • Marketplace franchises
     • Merged operations after market takedowns

4. Map ecosystem

   • Visualize marketplace clusters based on shared communications
   • Track how support channels change over time
   • Identify primary vs. backup marketplaces in a network

Customer Support Chain Analysis

1. Start with marketplace

   • Input: Marketplace onion address
   • Run: FetchEmailAddresses, FetchTelegramLinks, FetchDiscordInvites
   • Result: All official support channels

2. Verify channel authenticity

   • Check if support channels appear on multiple trusted sources
   • Compare with known scam/phishing contacts
   • Document official vs. suspicious channels

3. Monitor support presence

   • Track which communication platforms are prioritized
   • Note changes in support channels over time
   • Identify backup communication methods

4. Infiltration opportunities

   • Active Telegram/Discord channels may be accessible for intelligence gathering
   • Support staff may leak operational information
   • Community discussions can reveal marketplace issues, disputes, and insider information

Contact Evolution Tracking

1. Baseline current contacts

   • Document all email, Telegram, and Discord contacts for target sites
   • Note which platforms are used for which purposes

2. Periodic re-extraction

   • Regularly run Fetch transforms on monitored sites
   • Compare new contacts to baseline

3. Detect changes

   • New contacts added - Expansion or diversification
   • Contacts removed - Compromise, abandonment, or service changes
   • Contact replacement - Security incident or operational security improvement

4. Investigate changes

   • When contacts change, run Search transforms on both old and new contacts
   • Track migration patterns
   • Identify if old contacts are still active elsewhere