CyphrQ
Menu

What Is the Dark Web? How It Works, Who Uses It and the Risks

The dark web explained: how it differs from the deep web, who uses it, what stolen data is sold there, and what to do if your company data shows up.

By CyphrQ.ai

Written with AI assistance and human editorial review. Every figure linked to its source.

10 min read

The dark web is the part of the internet you can only reach through anonymity networks such as Tor, which hide where users and sites are. It is not illegal in itself. It hosts privacy tools and censorship workarounds, and it also hosts criminal markets that trade stolen passwords, card data and access to company networks.

For most businesses, the practical question isn't whether to go there. It's what to do when your data turns up there.

What is the dark web, compared with the surface web and the deep web?

People often use these three terms as if they meant the same thing. They don't.

Surface web Deep web Dark web
What it is Pages search engines can find and list Pages that need a login, or that search engines don't index Sites reachable only through an anonymity network
Everyday examples News sites, shop pages, public blogs Your inbox, online banking, company intranet, paywalled articles Privacy-focused sites, and criminal markets and leak sites
How you reach it Any browser Any browser, plus your credentials Special software that routes traffic through the network
Who can see your traffic Your network provider and the site Your network provider and the site Designed so neither side easily learns where the other is

The deep web is mostly mundane. Every time you check your email, you are on the deep web. The dark web is a small, deliberately hidden corner of it.

How does the dark web hide who is behind a site?

The best-known dark web network is Tor, short for "The Onion Router". It is maintained by the Tor Project, which the US Cybersecurity and Infrastructure Security Agency (CISA) describes as a nonprofit that provides anonymity and anti-censorship tools (CISA AA20-183A).

CISA explains the core idea. Tor encrypts traffic and passes it through at least three relays, servers run by volunteers, so that no single point sees both who you are and what you asked for. When traffic leaves Tor for the ordinary internet, it goes out through a public "exit node". The website sees the exit node's address, not yours.

The "onion" name comes from those layers of encryption. Each relay peels off one layer and learns only the next hop.

Dark web sites can only be reached inside the network, and the servers behind them are hard to find. That is why shutting one down usually takes patient police work to find and seize its physical servers, as German police did with the Hydra market in 2022 (more on that below).

Who uses the dark web, and why?

The same anonymity attracts two very different groups.

People who need privacy for legitimate reasons. CISA's advisory says Tor "can be used to promote democracy and free, anonymous use of the internet" (CISA AA20-183A). People living under censorship are the obvious example.

Criminals. CISA lists malicious uses of Tor that include reconnaissance, breaking into systems, stealing or manipulating data, and delivering ransomware. On the dark web itself, the criminal side shows up mainly as:

  • Markets selling drugs, stolen data, fake documents and hacking services.
  • Access brokers, who sell a way into a specific company's network or accounts to whoever pays, often ransomware groups.
  • Ransomware leak sites, where gangs name victims and threaten to publish stolen files unless a ransom is paid.

What is sold on the dark web? Three cases from US law enforcement

You don't have to guess what trades there. Takedown announcements from the US Department of Justice (DOJ) spell it out.

Hydra Market: drugs, stolen financial data and hacking tools

When German and US authorities shut Hydra down on 5 April 2022, the DOJ called it the world's largest and longest-running darknet market. According to the DOJ announcement, as published by IRS Criminal Investigation, Hydra accounted for an estimated 80% of all darknet market-related cryptocurrency transactions in 2021. It had received about $5.2 billion in cryptocurrency since 2015.

Its listings went well beyond drugs: stolen financial data, fake identity documents, hacking tools and services, and money laundering. Germany's Federal Criminal Police (BKA) seized the servers, and bitcoin wallets worth $25 million.

Genesis Market: your logins, packaged for resale

Genesis Market sold something every business should care about: account credentials stolen from malware-infected computers. The DOJ's 5 April 2023 announcement says that since March 2018 it had offered data from over 1.5 million compromised computers, holding over 80 million credentials. Those included accounts at financial firms, critical infrastructure operators and government agencies.

Genesis also sold device "fingerprints": device identifiers and browser cookies that let a buyer pose as the victim and get past anti-fraud checks. The DOJ called it one of the most prolific initial access brokers, and said ransomware actors sought out the access it sold. Stolen cookies are why a password change alone may not be enough, as explained in infostealers and session cookie theft.

LockBit: the leak site as a pressure tool

LockBit was a ransomware group that pushed victims to pay by threatening to publish their stolen data. In its 20 February 2024 announcement of the disruption by the UK's National Crime Agency (NCA), the FBI and international partners, the DOJ said LockBit had targeted over 2,000 victims and received more than $120 million in ransom payments. The NCA, the FBI and their partners seized LockBit's public-facing websites and servers.

For a step-by-step look at how these attacks unfold, see how ransomware attacks work.

Is it risky to visit the dark web out of curiosity?

Yes. It isn't worth it, whether for business research or personal curiosity. Four reasons:

  1. Scams. Nobody on a criminal market is accountable to you. There is no refund, no regulator and no one to complain to.
  2. Malware. These markets sell hacking tools. Files and links there come from the people who build them.
  3. Legal exposure. Buying stolen data, drugs, fake documents or network access is a crime in most countries, whatever your reason. Possessing some material is illegal in itself.
  4. Illegal content. You can come across material that is illegal to view, and that you can't unsee.

If your company needs to know what is out there about it, that is a job for a monitoring service or your security provider, working within the law. Staff browsing on their own is not the answer.

Why does stolen company data end up on the dark web?

Because it has a resale value. Stolen data rarely stays with the person who took it.

  • Infostealer malware on an employee's or contractor's device collects saved passwords and session cookies, and the logs get sold in bulk. That was Genesis Market's business.
  • Breaches of your company or a supplier produce databases that get sold or dumped.
  • Ransomware leaks publish data when a victim refuses to pay. Australia's privacy regulator said data stolen from Medibank was later released on the dark web, as the Medibank breach case file sets out.
  • Access brokers turn one stolen login into a product: "remote access to a company in sector X."

Data showing up there doesn't always mean you were breached. It might come from a reused password leaked by another site, or from an employee's infected home computer. Either way, treat it as a live risk.

What does dark-web monitoring actually do?

Dark-web monitoring services watch criminal markets, forums, leak sites and dumps of stolen data for information linked to you. That might be your email domain, staff logins, customer records or your brand. When they find a match, they alert you so you can act before someone uses it.

Most services work along the same lines:

  • Collection. They gather leaked data sets and watch places where data is traded.
  • Matching. They compare what they find with the identifiers you give them, such as domains, email addresses or card ranges.
  • Alerting. They report what was found, where, and when it was first seen.

A free starting point for individuals: after the Genesis Market takedown, investigators gave victims' credentials to the breach-notification service Have I Been Pwned so people could check whether their own details were included (DOJ).

Monitoring tells you about exposure after the fact. It doesn't prevent theft, and no service sees everything. Its value depends on how fast you act on an alert.

Going deeper: for security and IT teams

Reference. CISA's AA20-183A, Defending Against Malicious Cyber Activity Originating from Tor (last revised 2 August 2021, now archived), is still the clearest government guidance on Tor traffic in an enterprise. It covers both directions: inbound attacker traffic from Tor exit nodes, and outbound traffic that relays command and control (C2) through Tor.

Mechanism. For traffic leaving the network, your perimeter sees only the exit relay's IP, never the origin. That asymmetry shapes detection. Inbound Tor traffic is identifiable by source IP, because exit relays are public. Outbound Tor use shows up as connections from an internal host to relays, not as a hostname you can block.

Threat model. The three DOJ cases map onto one chain:

Stage What the attacker buys or does Documented example
Credential theft Infostealer logs, cookies, device fingerprints Genesis: 80 million+ credentials from 1.5 million+ computers
Initial access Bought access to a named organisation Genesis described by DOJ as a prolific initial access broker
Monetisation Encryption plus threat to publish LockBit: 2,000+ victims, $120 million+ in ransoms
Laundering Mixing and cash-out services Hydra listed money laundering and mixing services

The defensive point: a session cookie with a device fingerprint lets a buyer look like the legitimate user to risk engines. A dark-web hit on session material needs session revocation, not just a password reset.

Controls CISA describes.

  • Assess your own risk first. CISA frames blocking as a risk decision: compare the likelihood of malicious Tor traffic against the cost to legitimate users who need anonymity.
  • Block or closely monitor inbound and outbound traffic to and from known Tor nodes. Exit relays change often, so treat a static blocklist as already out of date.
  • Use your SIEM. Flag connections involving Tor exit-node IPs, and correlate them with authentication events, data-transfer volume and unusual ports.
  • Risk-based rather than blanket blocking where your business has legitimate users, for example a newsroom or a whistleblowing channel. Require stronger authentication from Tor exits instead of refusing them outright.

Detection to build.

  • Successful sign-ins to SSO, VPN or email from Tor exit IPs, especially for privileged accounts.
  • Internal hosts making connections that match Tor relay IPs. That points to unsanctioned software or malware C2.
  • Large outbound transfers to unfamiliar infrastructure. LockBit used a dedicated data-transfer platform, StealBit, and the 2024 operation disrupted its servers too (DOJ).

Responding to a monitoring hit. Confirm the data is genuine and current. Identify the source device, whether infostealer, supplier breach or reuse. Revoke sessions and tokens, reset credentials and check for persistence on that device. Then decide whether your breach-notification duties apply.

Questions for a monitoring provider.

  1. Which sources do you cover: markets, forums, leak sites, messaging channels, infostealer logs?
  2. How do you obtain the data, and do you ever pay criminals for it?
  3. How quickly, on average, do findings reach customers?
  4. Do alerts include session cookies and the infected-device context, or only email-and-password pairs?
  5. How do you handle and delete the personal data you collect about our staff and customers?

Checklist: if your company data turns up on the dark web

  • Treat the alert as real until proven otherwise. Check what was exposed, and how recent it is.
  • Reset the affected credentials and revoke active sessions, not just passwords.
  • Find the source: an infected device, a supplier breach or a reused password.
  • Turn on phishing-resistant sign-in for email, remote access and admin accounts.
  • Decide, with legal advice, whether the exposure triggers breach notification.
  • Tell staff not to go looking for the data themselves.

Read more about cyber threats and how to defend against them in Threats & Defence.

Key takeaways

  • The dark web is the part of the internet reachable only through anonymity networks. The deep web is everything behind logins, and is mostly ordinary.
  • Because the servers behind dark web sites are hard to locate, takedowns depend on police work.
  • US takedowns show what trades there: Genesis offered over 80 million stolen credentials, and LockBit had more than 2,000 victims and over $120 million in ransoms.
  • Don't send staff to look. Use monitoring, and when an alert arrives, revoke sessions as well as resetting passwords.

Sources