Dark Web Fundamentals

Learning Objectives

• After this, students can explain the difference between the surface web, the deep web, and the dark web without falling for the usual myths.
• After this, students can describe how Tor routes traffic and how onion services hide both the visitor and the server.
• After this, students can explain what makes v3 onion addresses look the way they do, and why that matters for OSINT.
• After this, students can name legitimate uses of the dark web and legitimate organizations that run onion sites.
• After this, students can describe how the cybercrime economy is organized and where threat intelligence analysts fit in.

1. Surface Web, Deep Web, Dark Web

These three terms get mixed up constantly, including in the news. Getting them right is the first step to talking about this topic credibly.

Key points to stress:

• The deep web is mostly boring. Your Gmail inbox is “deep web.” Nothing sinister about it. Most of the internet by volume is deep web simply because most data sits behind logins.
• The dark web is a small part of the deep web. It’s defined by technology (anonymizing overlay networks), not by content.
• “Darknet” usually means the overlay network itself (e.g., the Tor network); “dark web” usually means the websites hosted on it. People use them interchangeably.
• The popular “iceberg” graphic (surface web is the tip, dark web is the huge bottom) is misleading. It blends the deep web and dark web together and makes the dark web sound far bigger and more mysterious than it is.

Why this matters for OSINT

A lot of what threat intel analysts call “dark web monitoring” actually covers clear-web sources too: cybercrime forums on normal domains, Telegram channels, paste sites, and Discord servers. The criminal underground isn’t limited to .onion addresses, and neither is the research.

2. How Tor Works

Tor (“The Onion Router”) grew out of onion routing research at the US Naval Research Laboratory in the 1990s and is now maintained by the nonprofit Tor Project. Tor Browser is a hardened version of Firefox that sends all traffic through the Tor network.

Circuits and layered encryption

When you open Tor Browser, your Tor client builds a circuit through three volunteer-run relays:

You ──► Guard (entry) relay ──► Middle relay ──► Exit relay ──► Website

Your client wraps each message in three layers of encryption, one for each relay, like layers of an onion. Each relay peels off only its own layer, which reveals just enough to pass the message to the next hop.

No single relay knows both who you are and where you’re going. The middle relay exists so the guard and exit never talk directly. More hops would add delay without much extra security, so Tor uses three.

Teaching point: when you visit a normal website through Tor, the website sees the exit relay’s IP, not yours. But the exit relay is still a stranger’s computer — HTTPS still matters.

Onion services (formerly “hidden services”)

An onion service is a server that is only reachable inside Tor. Both sides stay hidden:

1. Introduction points — The onion service builds anonymous circuits to a few Tor relays and asks them to act as its introduction points. It publishes a signed descriptor (listing those points) to Tor’s distributed hash table. The introduction points never learn where the server is.
2. Rendezvous point — Your Tor client picks a relay to be the rendezvous point and gives it a one-time secret.
3. Introduction — Your client contacts an introduction point and passes along the rendezvous point’s address and the secret.
4. Connection — The onion service builds its own anonymous circuit to the rendezvous point and presents the secret. The rendezvous point now relays encrypted traffic between you.

Neither you nor the server learns the other’s IP address, and traffic never leaves the Tor network through an exit relay. The connection is end-to-end encrypted.

v3 onion addresses

• A v3 onion address is 56 characters followed by .onion, e.g. <56 random-looking characters>.onion.
• It’s long because it contains the service’s full ed25519 public key (plus a checksum and version). The address is the key, so the address is self-authenticating: if you reached that address, you reached whoever holds the matching private key.
• The older v2 addresses were 16 characters and used weaker cryptography. Tor warned operators starting in September 2020, removed v2 support in the 0.4.6 series, and in October 2021 released stable clients that disabled v2 entirely.

What this means for OSINT investigators

• No DNS, no WHOIS, no hosting provider to look up. Most of the infrastructure-recon techniques from the rest of this unit don’t work on onion services.
• Addresses are unmemorable, which makes phishing clones trivially easy: a criminal can spin up a lookalike site on a different random address and nobody can tell by eye. This is why verification (see 6.2-finding-underground-sources.md) matters so much.
• Sites disappear and move constantly. Discovery is mostly done by pivoting from mentions elsewhere, not by searching.
• Operators still make mistakes. Misconfigured servers, reused usernames, and clear-web activity have repeatedly exposed people behind onion services (see the Silk Road example below).

3. I2P Basics

I2P (the Invisible Internet Project) is another anonymity network. You’ll see it mentioned in threat intel reports, and platforms like Flare monitor it.

For this class, the key takeaway is that I2P is a second place underground communities can live, and it needs its own software (an I2P router) to reach.

4. Legitimate Uses of the Dark Web

The dark web isn’t only for criminals. Tor protects real people in real danger:

• Censorship circumvention — People in countries that block news sites or social media use Tor to reach them.
• Journalism and whistleblowing — SecureDrop, an open-source whistleblower submission system used by many news organizations, runs as an onion service so sources can submit documents anonymously.
• Privacy from tracking — People who don’t want advertisers, ISPs, or abusive ex-partners tracking their browsing.
• Activists and human rights workers in hostile environments.
• Security researchers and law enforcement investigating crime.

Legitimate organizations with onion sites

These make a great, safe classroom demo (instructor-led — see labs.md):

Where to get their onion addresses safely: from the organization’s own clear-web site or from Tor Browser’s “.onion available” button (explained in 6.2-finding-underground-sources.md) — never from a random link list.

5. Common Myths

Case study: OPSEC failure behind an onion service (Silk Road)

Silk Road was an onion-service drug marketplace run by someone using the name “Dread Pirate Roberts.” IRS investigator Gary Alford, working with the DEA, traced the operator to Ross Ulbricht in 2013. The breakthrough was a clear-web trail: Ulbricht had used the username “altoid” to promote Silk Road in its early days, and in another forum post under that name he asked for programming help and included an email address containing his full name. He was arrested on October 1, 2013, in a San Francisco public library. (He received a presidential pardon on January 21, 2025, after serving about 11 years of a life sentence.)

Lesson for OSINT: Tor hid the server, but the person left breadcrumbs on the open web. Pivoting on a reused username is the same technique taught in Module 3 and Module 4 — and the reason investigators need their own OPSEC (Module 8).

6. The Cybercrime Economy (High Level)

Modern cybercrime works like a supply chain. Instead of one hacker doing everything, specialists sell services to each other. Understanding the chain tells analysts what to look for and where.

Malware developers ──► Infostealer / malware operators ──► Log shops & Telegram channels
                                                                 │
                                                                 ▼
                                    Initial access brokers (IABs) ──► Ransomware affiliates
                                                                             │
                                                                             ▼
                                                    Ransomware-as-a-service operators ──► Leak sites / extortion

Double extortion and leak sites

Most ransomware groups now use double extortion: they encrypt files and steal data, then threaten to publish it. CISA’s Medusa advisory describes an onion data leak site that lists victims alongside countdown timers and posts ransom demands with links to cryptocurrency wallets. These leak sites are one of the most-watched sources in threat intelligence, because a victim listing is often the first public sign of a breach.

Marketplaces

• Hydra Market was a Russian-language darknet marketplace selling drugs and other illegal goods. Germany’s Federal Criminal Police Office (BKA), working with US authorities, shut it down on April 5, 2022, seizing its servers and about 543 BTC (roughly €23 million). Hydra had around 17 million customer accounts and over 19,000 seller accounts and is believed to have processed over $5 billion in cryptocurrency during its lifetime.

Where threat intelligence fits

Defenders watch this economy to catch problems before they become breaches:
- An employee’s credentials show up in a stealer log → reset the password and revoke sessions.
- An IAB advertises “access to a US manufacturing company” matching your profile → investigate.
- Your company appears on a leak site → incident response starts (or you learn a vendor was hit).

This is exactly what dark web intelligence platforms like Flare automate — see 6.4-dark-web-intelligence-platforms.md.

Key Terms

• Surface web: Content indexed by search engines.
• Deep web: Content not indexed by search engines, usually because it’s behind a login or paywall.
• Dark web: Websites on anonymizing overlay networks like Tor and I2P that need special software to access.
• Darknet: The overlay network itself (e.g., the Tor network).
• Tor: “The Onion Router,” a network that routes traffic through three relays with layered encryption.
• Guard / middle / exit relay: The three hops in a Tor circuit.
• Onion service: A server reachable only through Tor, hiding both server and visitor locations.
• Introduction point / rendezvous point: Relays that let a client and an onion service connect without learning each other’s IP.
• v3 onion address: A 56-character .onion address that contains the service’s ed25519 public key.
• I2P: The Invisible Internet Project, an anonymity network using garlic routing and unidirectional tunnels.
• Eepsite: A website hosted inside I2P (.i2p).
• SecureDrop: An open-source, onion-based whistleblower submission system used by news organizations.
• Malware-as-a-Service (MaaS): Renting malware to other criminals by subscription.
• Initial access broker (IAB): A criminal who sells access to compromised networks.
• Ransomware-as-a-Service (RaaS): A model where ransomware developers rent their tools to affiliates for a share of profits.
• Double extortion: Encrypting data and threatening to leak stolen copies.
• Leak site: A site where ransomware groups publish victim names and stolen data.

Key Takeaways

• Deep web ≠ dark web: your email inbox is deep web; the dark web is sites on networks like Tor and I2P.
• Tor uses three relays and layered encryption so no single relay knows both who you are and where you’re going.
• Onion services hide both the visitor and the server; v3 addresses are 56 characters because they contain the service’s public key.
• No DNS or WHOIS for onion sites, and addresses are easy to clone, so verification is critical.
• The dark web has real legitimate uses: censorship circumvention, journalism (SecureDrop), and onion sites run by BBC, NYT, ProPublica, Facebook, and the CIA.
• Tor hides your IP, not your mistakes (Silk Road’s operator was found through a reused clear-web username).
• Cybercrime is a supply chain: malware developers → stealer logs → initial access brokers → ransomware affiliates → leak sites.
• Much underground activity happens on clear-web forums and Telegram, not just .onion sites.

References

• Tor Project — V2 Onion Services Deprecation
• Tor Project Blog — Onion Service version 2 deprecation timeline
• Wikipedia — .onion
• Tor Project — How do Onion Services work?
• Tor Specifications — Onion service protocol overview
• Tor Project — Types of relays on the Tor network
• I2P — Garlic Routing
• Proton VPN — What is I2P and how does it work?
• Wikipedia — Facebook onion address
• NordVPN — Safe Tor websites (legitimate onion sites overview)
• Wikipedia — Ross Ulbricht
• CISA — #StopRansomware: Medusa Ransomware (AA25-071A)
• The Hacker News — Germany Shuts Down Russian Hydra Darknet Market
• TRM Labs — Hydra Market takedown
• BleepingComputer — FBI seizes stolen credentials market Genesis in Operation Cookie Monster