The dark web is the part of the internet that is reachable only through anonymising networks such as Tor, where sites hide their real location.
How the dark web works
The web has three layers. The surface web is indexed by search engines. The deep web is everything behind logins and paywalls – e-mail, online banking, company intranets. The dark web is a small part that needs special software. The best known network is Tor: traffic is routed through three randomly chosen relays with layered encryption, and sites run as onion services with addresses ending in .onion. Other darknets include I2P and Freenet.
Why the dark web matters for security
Anonymity protects journalists, whistleblowers and people in countries with censorship; major media and even social networks run official onion sites. At the same time the dark web is the marketplace of cybercrime:
- forums and shops that sell stolen databases, credit cards and access to hacked companies;
- “logs” from infostealers with passwords and session cookies;
- malware, exploit kits and ransomware-as-a-service programmes;
- data leak sites where ransomware gangs publish files of victims who do not pay.
Law enforcement regularly takes down large markets, but new ones replace them quickly.
Best practices
- Monitor dark web and leak sites for your company’s domains and credentials, or use a monitoring service.
- Assume leaked passwords will be tried everywhere: use unique passwords and MFA.
- Visiting the dark web for research is legal in most countries, but downloads and purchases carry legal and malware risks.
