Dark Web.

The Dark Web is the portion of the internet hosted on overlay networks (most prominently Tor's onion services and I2P's eepsites) that cannot be reached with a normal browser and standard DNS. Routing through layered, encrypted relays anonymises both visitors and operators, which is why it is used legitimately by journalists, dissidents, and whistleblowers, but also for cybercriminal marketplaces, ransomware leak sites, stolen-data brokers, and abuse-of-children material. Threat-intelligence teams monitor it to discover stolen credentials, exploit sales, and adversary infrastructure. Defences include continuous dark-web monitoring services, credential leak detection, takedown coordination, and blocking known Tor exit nodes from sensitive perimeters when appropriate.

How anonymity works — and how it fails

A Tor onion service is reached through a .onion address derived from the server's public key; the client and server rendezvous at an introduction point without either side learning the other's IP. Traffic is wrapped in three layers of encryption and bounced through volunteer relays, so no single hop sees both origin and destination. This is genuinely strong — but the humans and software behind it are not. Law enforcement rarely breaks the crypto; instead it exploits operational-security mistakes, server misconfiguration, cryptocurrency tracing, and infiltration.

The takedown record shows the pattern. Operation Bayonet (July 2017) seized AlphaBay — then the largest darknet market with over 200,000 users — arresting founder Alexandre Cazes, while Dutch police secretly ran the rival market Hansa as a honeypot for weeks to deanonymise fleeing users. Operation Cookie Monster (April 2023) dismantled Genesis Market, which sold "bots" bundling stolen cookies, credentials and browser fingerprints for account takeover. Operation Cronos (February 2024) disrupted the LockBit ransomware gang, seizing 34 servers, source code and decryption keys across eight countries.

For defenders, the practical takeaway is exposure monitoring: watch leak sites and credential dumps for your organisation's data, enforce MFA and passkeys so stolen passwords are less useful, and feed observed adversary infrastructure into blocklists.

flowchart LR
  U[User<br/>Tor Browser] --> G[Guard relay]
  G --> M[Middle relay]
  M --> R[Rendezvous point]
  R --> H[Hidden service<br/>.onion leak site / market]
  H -.->|OPSEC error<br/>server misconfig<br/>crypto tracing| LE[Law enforcement<br/>takedown]