Dark web

The dark web refers to specific content on the World Wide Web that exists within overlay networks known as darknets. While these networks use the standard Internet, they require specialized software, specific configurations, or particular authorization to access. Users often distinguish the regular, unencrypted web as the "clearnet." The dark web is actually a small subset of the much larger deep web. The deep web consists of all web content that is not indexed by standard search engines. Many people mistakenly use the terms "deep web" and "dark web" to mean the same thing, but they are technically different.

To understand how the dark web works, one must look at the mechanism of onion routing. This technique is used by the Tor Project, which stands for "The Onion Routing" project. Tor creates encrypted entry points and pathways for its users. The system routes data through a large number of intermediate servers to protect identities. This process uses a layered encryption system to ensure anonymity. A piece of transmitted information can only be decrypted by the specific subsequent node in the sequence. This sequence eventually leads to an exit node. This complicated structure makes it nearly impossible to reproduce the path or decrypt the information layer by layer.

Because of this high level of encryption, websites cannot track a user's IP address or geolocation. Similarly, users cannot obtain information about the host of a website. This allows for highly encrypted communication, enabling people to blog, talk, or share files with high levels of confidentiality. There are several different types of darknets in use today. Some are small, friend-to-friend networks used for private communication. Others are large, popular networks operated by individuals or public organizations. These include networks like Tor, Hyphanet, I2P, and Riffle. Within the Tor network, sites use the ".onion" domain suffix to identify themselves.

The history of the term "dark web" began around 2009, though the exact origin of the actual networks is unknown. Public awareness of these networks grew significantly due to reporting on the Silk Road. Silk Road was one of the first major dark web marketplaces, emerging in 2011. It allowed for the trading of weapons, illegal drugs, and identity fraud resources. Although authorities eventually seized it, new marketplaces often appear in its place. As of 2020, there were at least 38 active dark web marketplaces, even though many more may exist. These markets function similarly to eBay or Craigslist, where users interact and leave reviews.

The scale of the dark web is significant, though it represents only a small fraction of total web activity. As of December 2020, there were an estimated 76,300 active .onion sites on the Tor network. However, many of these are simply copies of other sites. Only about 18,000 of those sites are estimated to contain original content. Interestingly, Facebook has been described as the largest hidden service on the network. Despite the large number of sites, the dark web accounts for only 3% of the total traffic in the Tor network.

The content hosted on these networks varies from helpful to highly illegal. Many whistleblowing sites and political discussion forums maintain a presence there. However, much of the traffic involves illicit activities. A 2014 study found that child pornography was the most commonly hosted content on Tor, followed by black markets. Other significant uses include ransomware operations and botnet command-and-control servers. Ransomware groups often use a "double extortion" model, where they threaten to publish stolen data if victims do not pay. In 2023, researchers even found that login information for approximately 100,000 ChatGPT users was being sold on the dark web.

The dark web is deeply connected to the world of digital finance and cybercrime. Many darknet markets rely on Bitcoin because it offers relative anonymity and flexibility. Users sometimes use "tumblers," which are services that help hide the origins of digital currency. This connection creates an efficient criminal supply chain. For example, some actors act as "initial access brokers," selling stolen network access to ransomware affiliates. This division of labor lowers the technical barriers for attackers. Law enforcement and private organizations constantly monitor these networks to track fraud, hacking, and terrorism.