Dark Web

TLDR: The dark web requires Tor or similar software to reach. It is a subset of the deep web that is intentionally hidden. It hosts private forums, whistleblower platforms, and illegal marketplaces.

The internet has three layers. The surface web is indexed by search engines and publicly accessible. The deep web includes all pages not indexed — banking portals, private databases, email inboxes. The dark web is a subset of the deep web. It requires special software to reach and intentionally conceals the identity of servers and users.

How the Dark Web Works

The most common access method uses the Tor (The Onion Router) network. Tor encrypts traffic in multiple layers and routes it through a series of volunteer-run relay nodes. Each relay decrypts one layer and forwards traffic to the next — like peeling an onion. The final relay (the exit node) connects to the destination. Dark web sites use .onion domains, which are only resolvable inside Tor. This design hides the location of both the user and the server.

What the Dark Web Contains

1. Privacy Communities: Forums for journalists, activists, and whistleblowers operating under censorship.
2. Secure Drop Sites: Anonymous document submission portals used by major news organizations.
3. Illegal Marketplaces: Vendors selling stolen credentials, drugs, counterfeit documents, and malware.
4. Leaked Data: Credential dumps, corporate breaches, and personal records traded between threat actors.
5. Hacker Forums: Communities where exploits, toolkits, and attack services are discussed and sold.

Dark Web Monitoring

Organizations monitor dark web forums and marketplaces for leaked credentials, stolen intellectual property, and early signs of planned attacks. A breach that surfaces on the dark web may not become public for months. Early detection allows security teams to respond before data is weaponized. Monitoring tools index dark web sources continuously and alert teams when company names, domains, or employee credentials appear.

Dark Web vs Deep Web

1. Deep Web: All web content not indexed by search engines. Includes your email inbox, private databases, and paywalled content. Accessible via normal browsers.
2. Dark Web: A small subset of the deep web. Requires Tor or I2P to access. Designed for anonymity.

Estimates suggest the dark web represents a small fraction of total internet traffic — but the concentration of sensitive, high-value data makes it a critical focus for security teams.