Analysis of CSEM offenders on the dark web using honeypots to geolocate IP addresses from Spain

Gathering evidence in cybercrime is a complex process. Under this premise, it is very important to have cutting-edge methodologies that allow the observation of criminal phenomena on the Internet and protect the personal integrity of the investigator, especially when the content is extremely critical and is located in the so-called dark zone of the Internet (hereinafter Dark Web). This article develops a new research methodology in the field of cybercrime based on the use of honeypots, and its main objective is to evaluate the ability to de-anonymize users in the Tor network to collect geographic coordinates and demographic data on the Dark Web in order to obtain digital evidence related to minors sexual (CSEM) offenders. The information collected aims to map the consumption of CSEM through cartograms, with a particular focus on the Spanish territory. The outcomes demonstrate the ability of using honeypots to assess the prevalence of CSEM consumption on the Dark Web. Future improvements of the methodology will be discussed. •The objective is to evaluate a methodology based on honeypots to de-anonymize users on the Tor network.•The use of honeypots makes it possible to obtain real Ips, and therefore, to geolocate users on the Dark Web.•The countries with the highest rate of access to CSEM material were the United States of America and Spain.•The Spanish autonomous communities with the highest number of CSEM users were Madrid and Andalucía.