The Dark Web vs. Deep Web

The Internet is an intrinsic part of our lives and livelihood. We’re all familiar with what’s called the Surface Web, or Clear Web, which are all the sites that you find when Googling for information. But then you hear terms like ‘Dark Web,’ ‘Deep Web,’ and even ‘Gray Web’. You may wonder if they are just different terms for the same thing. It is essential to distinguish between the these terms as they are not interchangeable, even though they do overlap significantly, so that you know where to look for threats and protect the security of your organization. View the latest cybercrime stats on Underground Explorer.

The 3 Main Types of the Web

Surface Web (or Clear Web)

What most people think of as the “Internet” or the World Wide Web is actually what is known as the Surface Web, or Clear Web. This is the part of the Internet that is:

• Visible to search engines like Google
• Accessible via normal web browsers

The Gray Web is referred to as the part of the Surface Web where fraudsters discuss or research their activities. However, the Surface Web represents only the tip of the iceberg when it comes to the Internet – the majority of it is actually hidden.

Deep Web

The Deep Web makes up a much larger portion of the Internet than the Surface Web and includes sites that are:

• Accessible via normal browsers
• Not visible to search engines

Dark Web

The Dark Web is:

• Only accessible via special web browsers
• Built on the same network infrastructure as the Surface and Deep Web
• Completely distinct from both Surface and Deep Web

The Gray Web, Deep Web, and Dark Web are all valuable sources of threat intelligence, but many organizations limit their information-gathering efforts to the Surface Web. Expanding their reach – through the use of Dark Web monitoring tools – can be invaluable to a corporate cybersecurity and risk management program. 

What is the Deep Web?

Not all of the Internet is intended for public consumption. The Deep Web houses web pages that are designed for restricted use and are protected by registration portals, paywalls, etc. These Deep Web sites are not indexed by search engines, making them impossible to find via traditional search engines like Google, Bing, etc.

Unlike the Dark Web, sites on the Deep Web can be accessed using normal web browsers like Firefox, Google Chrome, and Safari. Also, these sites are often linked to publicly accessible pages, making them findable and accessible by users with the right login credentials and willingness to pay. For example, sites like Netflix are reachable from search engines, but the videos hosted on the site are only accessible to users who have created an account and paid a subscription fee.

Deep Web sites include private databases, restricted content, and other sources of in-depth information about companies and their operations. This makes these sites valuable sources of information if the content is accessible. However, the access restrictions on the Deep Web can make this information more complex and difficult to access.

What is the Dark Web?

“The Dark Web” is an overused term that can be a source of mystery and confusion for most cybersecurity professionals. Put simply, the Dark Web is any site, messaging platform, community, or other online entity that is not indexed by any search engine. A subset of the Deep Web, the Dark Web is intentionally hidden from your standard search engines, and is much more difficult to access as all its data is encrypted.

Web pages on the Dark Web can only be accessed using the Tor browser, and users need to know the URL of the website to find it. Dark Web sites are designed to offer anonymity and privacy, and many marketplaces offering illegal goods and services, forums where cyberattack campaigns are discussed, and other illegal discussions are hosted on the Dark Web. This makes Dark Web sites a rich source of threat intelligence for organizations; however, the design of the Dark Web can make this information difficult to find.

What is the Gray Web?

The Gray Web is the part of the Surface Web that is used by fraudsters. Unlike the Dark Web, no special browser is needed to access it. The Gray Web is where you can find forums on topics such as cracking tools, and hacking tips, often centered around eCommerce as a target. A cyber researcher, Ido Rozen, says the Gray Web is “the perfect place for a fraudster to share tips easily and exploits about eCommerce fraud with others who may not have access to the Dark Web.”

You can also find websites to download copyrighted material such as music, movies, games, software, and even Netflix credentials. Some downloads contain malware for the fraudsters to hack the unsuspecting user later. Law enforcement agencies don’t pay much attention to the Gray Web, so users don’t feel the need to be anonymous.

What's the Difference between Deep Web & Dark Web?

Many mistakenly believe the Deep Web and Dark Web are synonymous but they are distinctly different. Like the Surface Web and even the Gray Web, the Deep Web does not require a special browser like the Dark Web.

The Deep Web contains all the web sites that web crawlers cannot index. Examples of sites on the Deep Web that require a login to access include bank accounts, Netflix accounts, and social media accounts. Other content on the Deep Web include private files like medical records, legal documents, and sites that have blocked search engine crawlers. Because the Deep Web contains valuable information like login credentials and personal data, fraudsters will target these sites to steal and sell data on the Dark Web.

Types of Sources

• Surface (Clear) Web: Paste sites (e.g. pastebin), Reddit, 8chan, NVD, Twitter (secondary+direct), GitHub (secondary+direct)
• Deep Web: Open and closed (invite-only) forums, markets, credit card markets, paste sites and internet relay chat (IRC)
• Dark Web: Open and closed (invite-only) forums, markets, credit card markets, paste sites and internet relay chat (IRC), plus software such as Dread or Zeronet
• Social Messaging: Open and closed (invite-only) groups and channels on Telegram, Discord and QQ, ICQ

Who Uses the Dark Web?

The Dark Web is designed to provide privacy and anonymity to its users by encrypting and anonymizing the traffic by using darknets. However, these features can be used for both legitimate and malicious purposes. On the positive side, the privacy and anonymity of the Dark Web are important for dissidents, journalists, whistleblowers, and freedom of speech advocates – the ability to communicate without being identified protects their safety. This is the primary reason why the US NRL developed the TOR technology used by most Dark Web visitors. However, the Dark Web is more famous for its illegal uses. Cybercriminals take advantage of the privacy and anonymity that the Dark Web provides for a variety of purposes. Dark Web marketplaces are used to buy and sell illegal goods and services. Forums hosted on the Dark Web host discussions on successful and ongoing cyberattacks, newly discovered vulnerabilities, and other details of cyberattacks. Dark Web users also use the platform to exchange tips and tools for performing different cyberattacks and fraudulent activities.

History of the Dark Web

Since the Dark Web is hosted on a darknet, its history is linked to the development of encrypted and peer-to-peer networks that run on top of the Internet. The Dark Web first emerged with the creation of Freenet in the early 2000s. Freenet was designed to allow peer-to-peer, anonymous communication to protect against censorship. The Onion Router (TOR) technology used by the TOR browser and the Dark Web was created by a project funded by the US Naval Research Lab (NRL). The goal of TOR was to allow secure communication by intelligence sources in dangerous environments and has since been adopted by the general public for secure, anonymous browsing. The scale and impact of the Dark Web expanded with the development of cryptocurrencies like Bitcoin, which allow semi-anonymous financial transactions to be performed on the Internet. This made it easier to buy and sell services on the Dark Web without going through financial institutions and helped to enable the growth of ransomware, ransom Distributed Denial of Service (DDoS), and other extortion-based attacks.

What is the Darknet?

Since the Dark Web is a collection of websites that are only accessible via darknets, let’s take a moment to define what darknets are. Darknets are encrypted overlay networks that sit on top of the public Internet. These include peer-to-peer and privacy-focused networks and can only be accessed using special tools like the TOR browser. These networks use the infrastructure of the Internet for communications, but access to them is restricted. Darknets are designed for anonymity and privacy, making them ideal for criminals to communicate and buy and sell illegal goods and services. Famous illegal marketplaces like the Silk Road are hosted on the Darknet. By encrypting all traffic and making it difficult to determine the source and destination of web traffic, darknets make it more difficult to identify and attribute illegal activities and communications on the Internet.

Accessing Dark Web Sites

Darknets and Dark Web sites are encrypted, peer-to-peer networks that are only accessible via certain tools. Most Dark Web users use the TOR browser, which is designed to make the Dark Web easier to navigate. TOR gets its name (The Onion Router) from the fact that all traffic is wrapped in multiple layers of encryption that are unwrapped by different people, making it impossible to learn both the source and destination of a request. The TOR browser provides improved privacy and anonymity on the public Internet and makes it possible to access .onion sites on the Dark Web.

There are many clear, deep, and dark web sites, forums and marketplaces where threat actors can access victims’ online accounts. In addition, encrypted messaging platforms like Telegram and QQ provide a safe haven for communications about malicious acts and are, therefore, popular among threat actors. 

Challenges to Finding Dark Web Sites

One of the most significant barriers to finding deep and dark web sources is that you must use the exact URL to access sources that are not indexed — even with a browser like Tor. For example, to access the popular dark web forum CryptBB, you must know the exact onion link; conducting a web search for the forum will not turn up anything useful. Many dark web sites deploy tools that prevent bots and web crawlers from accessing the site. Some well-known underground sources can be easier to find because there are dedicated sites that share links and maintain regular status updates. But in many cases, finding the exact URLs through manual search methods can be next to impossible.

That said, not everything that occurs on the dark web is bad. For example, many dark web sites, such as gaming forums and online marketplaces, are used for legitimate purposes — and distinguishing between the good and the bad can be difficult without proper intelligence tools.

7 Strategies for Researching the Deep & Dark Web

The deep and dark web is a treasure-trove of information on threat actor activity, however making use of this resource to protect your organization can be (to the uninitiated), challenging. Below are 7 strategies for researching the deep and dark web. 

Creating a complete intelligence picture of the threat landscape relevant to your company or organization is a complex and difficult task. First, you must begin with a question. After forming the question (or questions) that will drive an investigation, an analyst must define a methodology and framework to answer it. While each scenario is different, there are some generally promising ways for analysts to confirm or refute a hypothesis. Depending on the nature of your threat investigation, your best approach may be to combine several strategies in order to broaden your search. Below you’ll find the seven strategies that we at Bitsight have found to be especially useful:

1. Aggregate mentions to determine a trend
2. Follow major events and correlate to dark web activity
3. Follow the services
4. Search for tools in the attack chain
5. Search for products of attacks
6. Search for indirect indications
7. Extrapolate what threat actors aren’t saying

For in-depth insight on these research strategies, read this guide, as used by Bitsight analysts, to help enhance your threat intelligence program.

Myths About the Dark Web

The concept known today as the Dark Web set its foundation in the early 2000s. In March of 2000, Freenet was released to allow a censorship-resistant way to use the Web. It also opened the way for sharing illegal pornographic material and pirated data. One of the key tools used on the Dark Web today was first released in 2002 – Tor, The Onion Router. Users gain greater anonymity online when using Tor because it encrypts Internet traffic and passes through several nodes. Ironically, the U.S. Government developed Tor so their operatives could remain untraceable.

There are a lot of myths about the Dark Web that it’s important to clarify:

It’s hard to access: False

Although you can’t use just any browser, all that’s needed is downloading and installing a special browser like Tor. Users of the Dark Web will often use a VPN to hide their identity and location further, but accessing the Dark Web is not required.

It’s illegal to access the Dark Web: False

Although the Dark Web is often used for illegal activities, it’s not illegal to access it in many countries. Some people use the Dark Web for legitimate reasons, but prefer to remain anonymous.

The Dark Web is only for technical professionals: False

Besides the illegal activities on the Dark Web, political dissidents and privacy advocates also use it for anonymity. Well-known organizations like Facebook and DuckDuckGo have Web sites on the Dark Web. It’s not as convenient as the Surface Web, but anyone of average technical prowess can use it.

What’s for sale on the Dark Web? Fraudsters who have hacked into systems and stolen data oftentimes turn to the Dark Web to sell what they've gathered. Common items for sale include credit card data, credentials, and even fingerprints. Cryptocurrency is the preferred payment method for transactions. The price tag for these items may be surprising, with usernames and passwords selling anywhere from $.10 to $1 and fingerprints selling for about $2 each.

Gain the Tactical Advantage

The illicit activities of fraudsters are happening across the Gray, Deep, and Dark Web. But the real battle against fraudsters is on the Deep and Dark Web, where tracking their activity is much more difficult. Choosing the right Cyber Threat Intelligence platform can be the best weapon to win the war and protect your organization and customer data. Deploying a CTI solution will allow you to monitor and gather data on what’s happening on the Deep and Dark Web get alerts on activity specific to your organization.