The dark web is the part of the internet that a standard browser cannot reach. Its sites live inside anonymity networks such as Tor, carry .onion addresses instead of .com, and do not appear in search engines. It is a small and hard-to-measure layer of the web, and it is not unlawful in itself.
It is also where data stolen from a company turns into a product. In Fluid Attacks’ State of Attacks 2026 report, covering security testing between January 1 and December 31, 2025, the weakness “Sensitive information in source code - Credentials” appeared in 37.4% of the systems we assessed, across 7,791 instances. More than a third of the applications we tested were shipping credentials written into the code.
This page covers what the dark web is, how it differs from the deep web, how people reach it, what gets traded there, and what your organization can do about it — including where our own scope begins and ends.
What is the dark web?
The dark web is a set of websites and services that are only reachable through software built for anonymity, most commonly the Tor network. A site published this way does not resolve in a normal browser, is not indexed, and hides the physical location of the server that hosts it. Access requires a specific client, not a password.
Being hidden is the design, not the crime. The European Parliamentary Research Service, in its April 2026 briefing Understanding the dark web, describes it as “while not unlawful in itself” a layer that “does contain websites providing access to illegal content and services”. The same briefing points to “legitimate and appropriate reasons for accessing the dark web”, naming “activists and whistleblowers avoiding identification”.
What the dark web is not is a measurable fraction of the internet. Figures of “4%” or “under 1%” circulate widely, almost always without a method behind them. The EPRS briefing avoids a number and calls it “a small but significant dark layer” instead, which is the framing that holds up: nobody holds the index, so nobody can measure the thing.
For a security team, the useful definition is narrower. The dark web is the distribution channel at the end of a breach: the place where credentials, customer records and internal documents are listed, priced and resold after they leave your systems.
The dark web, the deep web and the clear web are not the same
The deep web is everything a search engine does not index: your webmail, your bank’s account view, an internal wiki, a document behind a login. The dark web is a much smaller subset of it, defined by how you reach it rather than by whether it is indexed. Your inbox sits in the first group. It is not dark web.
The distinction matters because the two terms get used interchangeably in breach coverage, and the confusion changes what a reader thinks happened. “Your data was found on the deep web” could describe an unprotected database. “Your data was listed on the dark web” means somebody put it up for sale.
Layer | How you reach it | Indexed by search engines | Typical example |
|---|---|---|---|
Clear web | Any browser, no credentials | Yes | A public product page |
Deep web | Any browser, plus a login or a direct link | No | Webmail, an internal wiki, a paywalled archive |
Dark web | A dedicated client such as Tor | No | An |
The three layers differ by access method, not by how sensitive their content is.
One more correction worth making: a .onion address is not a dark version of a domain name. It is a cryptographic identifier derived from the service’s public key, which is why those addresses look like random strings and why no registrar controls them.
How the dark web is accessed
People reach the dark web with a client that routes traffic through volunteer-run relays. The Tor browser is the best known; I2P and Hyphanet (formerly Freenet) are smaller alternatives. All of them are free, and installing one is not an offense anywhere that the browser itself is legal.
Onion routing, the idea Tor is built on, began in the mid-1990s with researchers at the US Naval Research Lab; the Tor software itself was first deployed in October 2002. Today the Tor Project describes the browser as isolating “each website you visit so third-party trackers and ads can’t follow you”, relaying traffic “encrypted three times as it passes over the Tor network”, and aiming “to make all users look the same”.
Read that phrasing closely, because it is weaker than what most articles claim. Tor is built to make it hard to link a person, a location and an activity. It does not promise that the link can never be made, and deanonymization through browser flaws, device compromise or user error remains possible. Treat Tor as a strong privacy tool with real limits, not as a guarantee.
That tension — privacy technology that serves researchers and criminals with the same code — is a standing theme in the security community. Reporting on DEF CON 33, Simon Correa, Head of Research at Fluid Attacks, introduced a talk by Tor Project co-founder Roger Dingledine by describing Tor as “a tool closely related to the dark web — more specifically, to online privacy and anonymity”. The conference itself ran its sites over Tor, and kept a cash-only ticket option so attendees could register without handing over personal information.
Finding anything once you are there is a separate problem. Dark web search is poor, addresses change, and sites go down without notice. Discovery runs through link directories and closed forums, which is also why access to the better markets is frequently gated by invitation or reputation.
The dark web and Fluid Attacks
We do not operate on the dark web. We work at the other end of the pipeline: the application, the repository and the pipeline where the data is still yours. Everything below is drawn from our own testing.
Where the data comes from
Most of what ends up listed for sale leaves through a small number of recurring weaknesses. The clearest one in our 2025 data is credentials written into source code. Our weakness catalog describes sensitive information in source code as a repository that “contains sensitive information such as usernames, passwords, email addresses and IP addresses”, and in the State of Attacks 2026 report that weakness reached 37.4% of assessed systems, with 7,791 instances and 877,409 CVSSF units of risk exposure. Across the full report we registered 1,119,396 vulnerabilities and 27,440,146 CVSSF units, a mean of 1,266 vulnerabilities per system.
More than a third of the systems we assessed in 2025 carried credentials written into the source code.
The second route is business information leak, where an application exposes username lists, employee records, client data or supplier data to someone who should not see them. Neither weakness requires a sophisticated attacker. Both produce exactly the material that sells.
What we do about it
Our Secret Scanning product looks for hardcoded secrets — API keys, passwords, tokens — in code, configuration files and infrastructure as code, and runs both locally through a CLI and inside CI/CD. When a secret turns up, the CI Gate can stop the change from shipping: “With the strict flag in our CI Gate, the scan can fail the pipeline when secrets are found.”
The weakness that leaves credentials sitting in a repository, documented in our public database.
Each finding links back to our vulnerability database, which pairs every weakness with secure code examples in more than 20 programming languages and with security requirements mapped to more than 60 standards. The point is that a developer who finds a leaked key gets the fix and the control, not just an alert.
Extortion, not only resale
Selling data is one business model. Threatening to publish it is another, and ransomware operators run both. When we analyzed Babuk Locker in 2021, the ransom note it dropped on encrypted folders carried a link to a Tor page where victims were expected to negotiate, and the operators warned that they could leak the stolen files on the dark web, specifically on a hacker forum, if no agreement was reached.
That changes the calculation for a security team. Restoring from backup answers the encryption. It does nothing about the copy already in someone else’s hands, which is why preventing the exfiltration matters more than planning the recovery.
Where our scope ends
Our testing covers your applications, your cloud and your supply chain. It does not extend to monitoring dark web markets or forums, and it is worth being clear about that, because the two jobs sit on opposite sides of the same event.
Once data is published, no scanner retracts it. Secret scanning finds the key sitting in your repository; it cannot reach the copy already circulating. When a credential is confirmed exposed, the responses that work are rotation, revocation and a review of what that credential could reach. Dark web monitoring services tell you an exposure happened, which has real value for incident response — just not the same value as the exposure never happening. Knowing which of the two you are buying is the part worth getting right.
What you find on the dark web, and where it came from
Stolen data is the dark web’s main commodity, and a darknet market is best understood as a storefront for it. Europol makes that the central argument of Steal, deal and repeat, its 2025 Internet Organised Crime Threat Assessment report, where digital infrastructure “and the data within it have become prime targets”, with data “serving both as a target and an enabler in the cybercrime threat landscape”. A record is rarely the end of an attack. It is the input to the next one.
The listings themselves are mundane in form and specific in content: credential dumps, payment card batches, identity documents, corporate access. Our own breach research shows the pattern repeating across a decade. LinkedIn’s 117 million email and password pairs were seen for sale on the dark web. Wattpad’s breach, affecting more than 270 million users, was sold there for 10 bitcoins. And in July 2020, the ShinyHunters group released more than 386 million user records stolen from 18 companies on a hacker forum — for free, which is its own warning: not every dump has a price.
What gets listed | Weakness it usually comes from | Where we would catch it |
|---|---|---|
Credential dumps | Secret scanning in the repository and the pipeline | |
Employee and client records | Manual penetration testing against the running application | |
Working account access | Authentication review during assessment | |
Bulk login attempts that produce it | Rate-limit and lockout testing |
Law enforcement reaches the dark web, slowly and occasionally. The FBI’s record of Ross Ulbricht’s laptop sets out how he ran “a darknet market called the Silk Road from 2011 to 2013”, accessible only through Tor, until agents seized the machine on October 1, 2013; he was sentenced to life in prison in 2015. More recently, the Bureau reports that “spanning 20 countries, Operation Shrouded Horizon has dismantled an online criminal forum”. Takedowns work. They also take years, and the sellers reappear.
How stolen data gets used against you
A leaked password rarely stays inside the service that lost it. Attackers replay credentials across unrelated sites, and the technique has a name: credential stuffing. As that article puts it, “Lists of user/password pairs are stolen from various places on the Internet”, and “those mountains of information are then offered and sold in the ‘dark web.’” The dark web supplies the raw material; automation does the rest.
The consequences land on companies that were never breached. More than six thousand Norton LifeLock accounts were compromised in a credential stuffing campaign we covered in 2023, using previously exposed credentials against a service that had not leaked them. Some password managers now scan breach collections, and a few query dark web sources directly, to flag whether a stored password has already appeared in one. That helps a user react. It does not undo the exposure.
Scale is where reporting usually loses the plot. The “Mother of All Breaches” we examined was reported as more than 26 billion records, and our read of it was that the find “looks more like a database of multiple data breaches” — a compilation, not a new incident, with duplicates, dead accounts and entries already disclosed years earlier. A record count is not a people count, and treating an aggregated dump as a fresh data breach inflates the threat while hiding the question that matters. For a security team, the practical question about leaked credentials is never how many records sit on the dark web. It is which of yours still open a door.
How to keep your data off the dark web
Prevention happens before the listing exists. Four controls carry most of the weight, and none of them involve watching a dark web marketplace.
Scan for secrets continuously, and block on them: find hardcoded secrets in code and infrastructure as code on every change, and fail the build when the scan hits one. A key that never reaches a repository never reaches the dark web.
Reject credentials that are already burned: our catalog’s weak credential policy entry covers systems that fail to reject “weak, word-based, previously breached, or context-specific credentials” — including any password already published in a data breach — or that let credentials be shared across accounts.
Rate-limit authentication: lack of protection against brute force attacks describes systems with no defense “against automated attacks designed to guess credentials” — the same gap credential stuffing exploits.
Rotate on suspicion, not on confirmation: by the time exposure is confirmed, the leaked credentials have had a head start.
Automation alone will not get you there. In Fluid Attacks’ benchmark of 36 third-party AppSec tools against a target with 1,201 vulnerabilities across 105 CWE categories, a pentester found 1,076 of them — 89.6% recall at 100% precision — while the strongest automated performer, our own scanner, reached 22.7% recall. In the State of Attacks 2026 data, 87% of critical-severity vulnerabilities were identified through manual review. The exposures that end up on the dark web are frequently the ones a scanner alone does not see, which is why penetration testing belongs in the same program as the scanning.
Conclusions
The dark web is a transport and distribution layer, not a villain. It is small, deliberately unindexed, reachable with free software, and used by journalists, ransomware crews and researchers with the same code. Treating the dark web as a place rather than as the end of a process leads organizations to buy monitoring for a market they cannot influence.
The part you control sits upstream. Credentials in a repository, an authentication flow with no rate limit, an endpoint that returns more than it should: those are the inputs. Our 2025 testing found credentials sitting in source code in more than a third of the systems we assessed, which means the most common path onto a dark web listing is also one of the most preventable.
Frequently asked questions
What is the dark web in simple terms?
The dark web is a group of websites that only open in software built for anonymity, such as the Tor browser. Those sites use .onion addresses instead of ordinary domain names, hide the location of their servers, and never appear in search results. Using the software is legal in most countries; some of the activity it reaches is not.
Are the dark web and the deep web the same thing?
No. The deep web is everything search engines do not index, including your webmail, your online banking and any page behind a login — ordinary content you reach with an ordinary browser. The dark web is a far smaller subset that needs a specific client, such as the Tor browser, to open at all. Every such site belongs to the deep web; almost nothing in the deep web is dark web.
Is it illegal to access the dark web?
Accessing it is not illegal in itself in most jurisdictions, and the European Parliamentary Research Service describes it as “while not unlawful in itself” a layer that hosts illegal content alongside legitimate uses such as activists and whistleblowers avoiding identification. What is illegal is what some people do there: trading stolen data or commissioning attacks.
How does my company’s data end up on the dark web?
Usually through a weakness that exposed it long before it was listed. In Fluid Attacks’ State of Attacks 2026 report, covering testing through 2025, credentials written into source code appeared in 37.4% of the systems assessed, across 7,791 instances. Other common routes are exposed business information, weak credential policies and authentication endpoints with no protection against automated guessing.
Can you remove your information from the dark web?
No. Once a dataset is published or sold, copies spread beyond any single operator’s control, and no service can retract them. What you can do is reduce the value of the data: rotate and revoke exposed credentials, enable multi-factor authentication, stop reusing passwords across services, and review what the compromised credential could reach.
Does Fluid Attacks monitor the dark web?
No. Our testing works on your applications, cloud and supply chain, where the data is still yours to protect — detecting hardcoded secrets before they ship, testing authentication against brute force and credential reuse, and reporting findings with the remediation guidance to close them. We prevent the leak rather than watch the market that follows it.
Keep your credentials out of the market
Our scanners and pentesters review your code, your pipelines and your running applications so that exposed secrets get found while they are still yours to rotate, not after they reach the dark web. Start free trial · Contact us.
Get started with Fluid Attacks' RBVM solution right now
