The dark web is the part of the internet that can only be reached with special software, most often the Tor network. Its sites do not appear in ordinary search engines, and their operators and visitors can hide their network location. The dark web is a small part of the wider deep web, which covers any content that search engines do not index.

How it works

• Sites run as onion services with addresses that end in .onion and are only reachable through Tor.
• Traffic is routed through several volunteer relays, so neither side learns the other’s IP address.
• Other overlay networks, such as I2P, follow a similar model.
• Many sites are invite-only or require registration, which makes them harder to observe.

The technology itself is neutral. Journalists, activists and privacy-conscious users rely on it, and some well-known services run onion versions of their websites.

Why it matters for dark web monitoring

Criminals also use the dark web to trade stolen data, credentials and access to company networks. MITRE ATT&CK notes that attackers may buy information about victims from dark web or cybercrime black markets. For defenders, this means stolen data can circulate long before a breach becomes public. Dark web monitoring watches these sources so that an organization learns early when its data, accounts or brand appear there.

Sources: Tor Project: What are .onion sites and onion services?, MITRE ATT&CK T1597: Search Closed Sources