The darknet is a set of overlay networks — above all Tor, but also I2P and Freenet — hosting sites that an ordinary browser cannot open and search engines do not index. This guide explains how the darknet differs from the deep web and the dark web, how the Tor network works, what risks it poses for companies and how to monitor it for leaks of your own data.
What is Darknet and how does it differ from the regular Internet?
Ordinary websites and services run on public IP addresses and domain names, and search engines index them. The darknet works differently: traffic passes through an overlay network (most often Tor) that encrypts it in layers and relays it through several nodes, so that no single node knows both the sender and the destination. This makes it hard to establish who is talking to whom, but not impossible — user mistakes, malware and traffic analysis have repeatedly led to the identification of users and site operators. The darknet is a small fragment of the internet; for a company it matters mainly because leaked data and offers to sell access to corporate networks end up there.
📚 Read the complete guide: IAM / Zero Trust: Identity and access management - from the basics to Zero Trust
How do the deep web, the dark web and the darknet differ?
The three terms are often used as synonyms, yet they describe different things. The deep web is everything an ordinary search engine will not show you: resources hidden behind a login or another safeguard — email, online banking, a company intranet, customer portals — as well as pages that ask search engine crawlers to leave them out of the index. Nearly everyone uses the deep web daily, and there is nothing illegal about it.
The dark web is a small slice of it. A regular browser cannot open these sites and Google will not find them — dedicated software is required. On the Tor network they are the so-called onion services (addresses ending in .onion), which, according to the Tor Project’s documentation, can be reached only through Tor. In this guide, the word darknet refers to the overlay networks that provide such access (Tor, I2P, Freenet — described below); in everyday speech, “darknet” and “dark web” usually mean the same thing.
Visiting the dark web is not a crime in itself — what is illegal are specific activities, such as trading stolen data, which thrives on hidden marketplaces. From a company’s point of view, something else matters more: data that normally sits in the deep web (mailboxes, cloud application accounts, customer databases) ends up on the dark web after a leak and becomes a commodity there.
What technologies enable the operation of Darknet?
The darknet relies on several technologies that make it hard to identify users and protect the content of communications.
A key aspect is network protocols that differ from standard data transmission mechanisms. Multi-layered encryption and relaying traffic through several nodes make it hard to establish who is talking to whom.
Professional cybersecurity strategies identify the Tor network (The Onion Router) as the fundamental technology of Darknet. Multi-layered packet encryption means that no single relay knows both the source and the destination of a transmission.
Advanced cryptographic mechanisms constitute another key technological element of Darknet. Specialized end-to-end encryption algorithms and advanced public key protocols protect the content of transmitted information.
A key aspect is decentralized peer-to-peer networks that make centralized control and network traffic monitoring harder.
The importance of virtual private network (VPN) technologies and advanced IP address masking tools is growing. Specialized software makes it harder to establish users’ location and identity.
Advanced encryption mechanisms also include specialized communication protocols such as I2P (Invisible Internet Project) and Freenet. A key element is the ability to create covert communication channels.
A key aspect is advanced anonymization technologies that utilize multi-layered redirection mechanisms and advanced data masking algorithms. A professional approach requires comprehensive understanding of these advanced technological solutions.
How does the Tor network work and how does it ensure anonymity?
The Tor network (The Onion Router) represents an advanced, multi-layered internet traffic anonymization system that comprehensively secures users’ identity and location.
A key aspect is the multi-layered encryption model that hides the route and source of data transmission from individual relays. Advanced cryptographic algorithms cause each information packet to pass through a series of multiply encrypted network nodes.
Professional cybersecurity strategies identify the mechanism of “onion” routing as the fundamental principle of the Tor network’s operation. Each data transmission is multiply encrypted, with each network node knowing only the previous and next point of information transfer.
Advanced Tor mechanisms utilize a global network of volunteer nodes distributed around the world. The network consists of thousands of active nodes that continuously transmit encrypted data packets.
The route is chosen by the Tor client itself: by default a circuit consists of three relays — a guard (entry), a middle and an exit relay. The guard knows the user’s IP address but not the destination; the exit knows the destination but not the user.
The circuit does not change with every connection: Tor Browser routes all connections to a given website address through the same circuit, and the guard (entry) relay changes only after 2–3 months.
Each Tor relay knows only the previous and next transmission point, so none of them knows the entire route of the connection. We describe the risks Tor traffic poses for companies in the article What is Tor and what threats does it pose to business?.
A key aspect is advanced cryptographic protocols that multiply encrypt and decrypt data packets. A professional approach requires comprehensive understanding of advanced information protection mechanisms.
What are the legal applications of Darknet?
Tor is used by journalists, whistleblowers and human rights defenders in countries where the internet is censored or surveilled. Many newsrooms run SecureDrop inboxes for whistleblowers as .onion services, and some major sites (e.g. news publishers) maintain their own .onion addresses so that readers in censoring countries can reach them. Security teams, in turn, watch criminal forums and marketplaces to learn early about a data leak or an offer to sell access to a corporate network.
What threats lurk for Darknet users?
Darknet represents a complex internet space that, despite numerous advantages, generates a range of serious threats for users. Professional cybersecurity analyses point to a comprehensive catalog of risks accompanying navigation in this advanced information infrastructure.
A key aspect is threats related to potential access to illegal content and services. A significant share of Darknet content consists of materials of a criminal nature, which generates serious legal and security risks.
Professional strategies identify the risk of malicious software infection as one of the most serious problems. Darknet users are exposed to sophisticated cyberattacks that use advanced methods of IT systems infiltration.
Advanced criminal mechanisms used in Darknet include, among others, sophisticated forms of phishing, identity theft, and ransomware attacks. A key element is awareness of dynamically changing methods of cybercriminal operations.
A key aspect is threats related to privacy loss. Despite apparent anonymity, advanced tracking techniques and network traffic analysis can lead to Darknet user identification.
There is a risk of unintentional involvement in illegal transactions or criminal activity. Users may unintentionally become an element of complex criminal networks.
Advanced threat mechanisms also include the risk associated with data manipulation and disinformation. Darknet constitutes a space where verifying information credibility is extremely difficult.
Accidentally coming across illegal content is not a crime in itself, but downloading or storing it may be. That is why employees should not browse the darknet from company devices, and monitoring these sources is best left to a specialised service.
What policy should a company adopt towards Tor traffic?
From a company’s point of view, the darknet is above all a question of what to do with Tor traffic that reaches its infrastructure or leaves it. In advisory AA20-183A, published in 2020, CISA and the FBI describe how criminals hide behind Tor at successive stages of an attack — while scouting targets, breaking in, stealing or altering data, launching denial-of-service attacks and delivering ransomware. Both agencies advise every organization to weigh up its own exposure first and then either block or tightly supervise incoming and outgoing connections that involve known Tor nodes.
The advisory outlines three models:
- most restrictive — all traffic to public Tor entry nodes and from exit nodes is blocked, whether harmful or not; this requires a list of node addresses that is kept up to date at all times;
- less restrictive — Tor traffic is allowed but analyzed, and only connections that are unusual for a given service are blocked; it starts with several months of observing what ordinary traffic to and from Tor nodes looks like;
- blended — a full block for some resources and monitored access where using Tor is justified.
Which model fits depends on who uses the company’s services. CISA points out that some people turn to Tor to protect their privacy, so a blanket block will cut them off from internet-facing services. On the outbound side, the advisory names a rule blocking connections to Tor entry nodes as a way to hinder data theft and malware calling back to C2 servers: less sophisticated malware then loses its communication channel. Still, no model settles the matter. Some network access points, known as bridges, are deliberately left out of the public Tor relay directory, and a skilled attacker can add a VPN on top. Address-based blocking will therefore stop less prepared criminals, but the policy has to go hand in hand with detection.
How do you detect Tor-related traffic on a corporate network?
CISA describes two complementary approaches. The first is indicator-based: a SIEM or another log analysis platform flags events involving Tor exit node IP addresses. These addresses are tracked by the Tor Project itself in its Exit List service, which can be downloaded in full or queried on the fly. The list changes every hour, so it is worth pulling it automatically. The Tor Project also reminds readers that each relay has its own exit policy and that the make-up of the network keeps shifting, which is why a list copied into a configuration once soon loses its value.
The second approach looks for behavior typical of Tor software. According to the advisory, this includes connections to ports 9001, 9030, 9040, 9050, 9051 or 9150 (TCP and UDP), DNS lookups with a regular structure aimed at domains under torproject.org, and lookups for .onion domains, which give away a misconfigured Tor client — possibly malware trying to reach a hidden service. Tor traffic can also be routed through ports 443 and 8443, but generic monitoring of port 443 produces a flood of false positives and calls for traffic analysis tools.
Monitoring should have separate rules for three signals:
- large data flows between the company network and Tor addresses, on any port — they may point to unauthorized data exfiltration;
- connections coming in from Tor exit nodes to addresses and ports that should not accept outside traffic (that is, anything other than VPN gateways, mail and web services);
- traffic between an ephemeral port and a Tor address where Tor use is not expected — it may be a C2 channel or a data leak.
Before writing custom rules, check what the security tools already in place can do: according to CISA, firewalls, WAFs and intrusion detection systems often come with built-in Tor detection. An alert on its own says little, however — it gains meaning only when set against server, proxy and endpoint logs. That correlation, and the call on whether an event is an incident, is the job of a SOC team.
What does the issue of privacy and anonymity look like in Darknet?
Anonymity on Tor has limits. Tor hides the user’s IP address, but it does not protect against what users reveal themselves: logging in to personal accounts, opening downloaded documents outside the browser, or malware on their computer. Operators of .onion services also make configuration mistakes, and law enforcement has repeatedly identified them through traffic analysis, server seizures and tracing of cryptocurrency payments.
What are the differences between Tor, I2P, and Freenet networks?
The Tor, I2P, and Freenet anonymization networks represent advanced technologies for securing internet communication that differ in key operating mechanisms. Professional cybersecurity analyses point to fundamental features distinguishing these advanced platforms.
A key aspect of the Tor network is the multi-layered encryption model: each relay removes one layer and knows only the previous and next point of the route, and the network consists of thousands of globally distributed relays.
Professional strategies identify I2P (Invisible Internet Project) as a decentralized peer-to-peer network that offers advanced communication encryption mechanisms. Unlike Tor, I2P focuses on communication inside its own network.
Advanced Freenet mechanisms offer a unique model of storing and exchanging information based on decentralized, censorship-resistant infrastructure. A key element is the ability to store encrypted data in a distributed system.
Tor is mainly used for anonymous access to the ordinary internet and to .onion services: traffic leaves for the internet through exit relays. I2P is designed primarily for communication inside its own network (.i2p addresses), and each participant usually relays other people’s traffic too. Freenet — developed as Hyphanet since 2023 — is a distributed data store: content is encrypted and spread across participants’ computers, which makes it hard to remove.
A key aspect is the differences in security models and privacy protection. Each network offers a unique set of security mechanisms adapted to specific user needs.
How do law enforcement agencies monitor activity in Darknet?
Monitoring activity in Darknet represents a comprehensive challenge for law enforcement agencies, requiring advanced tools and analytical strategies. Professional cybersecurity analyses point to key mechanisms used by services in the process of identifying criminal activity.
A key aspect is advanced network traffic analysis tools that allow for identification of communication patterns and potential contact points with the surface internet. Advanced machine learning algorithms enable detection of anomalies in data transmission.
Professional strategies identify deanonymization techniques as a key element of Darknet monitoring. Services use advanced data correlation methods that allow for gradual revelation of user identities through analysis of multi-layered informational connections.
Advanced investigative mechanisms include the use of specialized software for penetrating anonymous networks. A key element is tools allowing for infiltration of network nodes and identification of criminal infrastructure.
A key aspect is international cooperation programs of special services that enable comprehensive information exchange and coordination of actions against crimes in Darknet. Advanced information exchange platforms allow for global crime prosecution.
The importance of blockchain technology and cryptocurrency analysis in tracking criminal activity is growing. Advanced tools allow for tracing financial transactions conducted in Darknet.
Advanced monitoring mechanisms also include the use of OSINT (Open Source Intelligence) techniques and advanced intelligence tools for gathering information about potential criminal activity.
A key aspect is specialized units trained in navigating advanced anonymous networks. Professional services have experts capable of effective operation in the Darknet environment.
How can companies protect themselves from threats originating from Darknet?
Protection from Darknet threats requires a comprehensive, multi-layered approach to cybersecurity. Professional strategies point to key mechanisms for minimizing risk for organizations in the context of advanced cyber threats.
A key aspect is the implementation of advanced threat intelligence systems that allow for continuous monitoring of Darknet activity. Advanced analytical tools, such as OSINT (white intelligence) services, enable early identification of potential threats directed against the organization.
Professional strategies recommend establishing specialized cybersecurity teams that possess advanced knowledge about Darknet functioning. A key element is the ability to proactively respond to identified threats.
Advanced protection mechanisms include comprehensive encryption of key information resources and implementation of multi-factor authentication systems. Companies should employ advanced security protocols, including firewall implementation, that minimize the risk of unauthorized access.
A key aspect is regular security audits and penetration tests that allow for identification of potential vulnerabilities in IT infrastructure. Organizations should also consider establishing a dedicated incident response plan to handle breaches originating from darknet-sourced attacks. A professional approach requires continuous improvement of protective mechanisms.
Implementing advanced educational systems for employees is necessary. A key element is building cyber awareness and training personnel in recognizing Darknet threats.
Advanced protection mechanisms also include comprehensive monitoring and early warning systems. Companies should invest in advanced analytical tools that allow for immediate identification of potential threats.
A key aspect is developing comprehensive procedures for responding to incidents related to Darknet threats. Professional strategies require preparation of detailed action plans in the event of a potential attack.
Such a plan should also cover the scenario in which personal data of customers or employees surfaces on the darknet — at that point the incident has a legal dimension as well. Article 33(1) GDPR requires the controller to notify such a personal data breach to the competent supervisory authority without undue delay and, where feasible, not later than 72 hours after having become aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons. Where the risk is high, Article 34(1) adds a duty to inform the affected individuals themselves. The procedure should therefore settle in advance who assesses the risk once a leak is found and who prepares the notification — otherwise the deadline is easy to miss.
How do you monitor the dark web for your company’s data leaks?
Dark web monitoring means continuously searching the forums, marketplaces and sites where criminals publish or sell data for traces of one specific organization. The search covers the company name and its domains, corporate email addresses paired with passwords, database dumps and listings that offer access to the company network. The last category is the most dangerous: in its Threat Landscape 2024 report (covering July 2023 to June 2024), ENISA noted that intermediaries selling such access — so-called Initial Access Brokers — kept their popularity and continue to profit by reselling it to other criminal groups, helped along by infostealers, i.e. malware that harvests stored login data.
A monitoring hit rarely closes the matter. According to the same report, ransomware groups resell stolen data on dark web black-market platforms after the first attack and use previously obtained credentials to strike the same organization again. Discovered data is therefore treated as an early warning, and each finding gets a specific follow-up:
- employee login data — forcing a password change on the affected accounts; NIST SP 800-63B-4 requires a change when there is evidence a password has been compromised, and every new password to be checked against a list of passwords known from earlier breaches;
- an offer to sell access — verifying whether the described access (e.g. a VPN or administrator account) really exists, and handling the case as a security incident;
- personal data of customers or employees — assessing the risk and, where necessary, notifying the breach within the GDPR deadlines described in the previous section.
At nFlo, dark web monitoring is part of the Threat Intelligence service and covers company mentions, data leaks and access sales. Identifying an organization’s footprint in open and hidden sources is also supported by white intelligence (OSINT).
What are the legal consequences of using Darknet?
Using Darknet generates complex legal consequences that vary depending on jurisdiction and the nature of activities undertaken. Professional legal analyses point to key aspects of legal responsibility associated with activity in this advanced internet space.
A key aspect is European Union legal regulations that treat the mere fact of using Darknet as legal, however, penalize specific types of activities. Advanced legal mechanisms focus on identifying and punishing crimes committed in this space.
Professional strategies identify key areas of criminal liability, which include among others:
-
Participation in computer crimes
-
Trade in illegal substances
-
Distribution of prohibited content
-
Money laundering
-
Trade in materials of a criminal nature
Polish law punishes acts, not tools: crimes committed on the darknet fall under the same provisions of the Criminal Code and specific statutes as crimes committed on the ordinary internet.
Criminal liability generally requires intent — under Polish law an unintentional act is punishable only where a statute expressly says so (Article 8 of the Criminal Code). Merely coming across illegal content by accident is not a crime; knowingly downloading, storing or distributing it may be, and in the case of pornographic content involving minors even knowingly accessing it is an offence (Article 202 § 4a of the Criminal Code).
The importance of international cooperation of services in prosecuting crimes committed in Darknet is growing. Advanced information exchange mechanisms allow for effective cross-border actions.
Advanced legal mechanisms require comprehensive assessment of intentions and the nature of activity in Darknet. A key element is proving conscious intent to commit a crime.
A key aspect is differentiated legal consequences depending on the type of activity undertaken. A professional approach requires detailed analysis of potential legal threats.
How does the development of blockchain technology and cryptocurrencies affect Darknet?
Cryptocurrencies are the main means of payment on darknet markets, but they do not guarantee anonymity. Bitcoin transactions are public and permanently recorded on the blockchain, so chain analysis lets law enforcement follow the flow of funds. This is why criminals turn to privacy-focused coins (e.g. Monero) and mixing services.
Frequently Asked Questions (FAQ)
Is it illegal to access the darknet?
Accessing the darknet itself is not illegal in most countries, including the EU and the US. The Tor browser is legal software. However, engaging in illegal activities on the darknet — such as purchasing drugs, stolen data, or illegal services — is a criminal offense and can carry severe penalties.
What is the deep web?
The deep web is the part of the internet that ordinary search engines do not show: resources behind a login or another safeguard (email, online banking, intranets, company databases) and pages excluded from indexing. We use it daily and legally. The dark web is only a small fragment of it, reachable solely with dedicated software.
Are the dark web and the darknet the same thing?
In everyday speech, usually yes. Strictly speaking, the darknet means overlay networks such as Tor, I2P or Freenet, while the dark web means the sites and services running on them — e.g. onion services, which according to the Tor Project can be reached only through the Tor network. No ordinary search engine will find any of these sites.
Is using Tor safe for browsing the darknet?
Tor hides the user’s IP address from the site they visit, but it does not protect against malware, scams or the user’s own mistakes, such as logging in to a personal account. The exit node can see traffic to ordinary sites if that traffic is not encrypted. For a company, a different question matters more: who on its network uses Tor and why — see the section on Tor traffic policy.
How can companies monitor the darknet for threats?
Dark web monitoring means continuously searching forums, marketplaces and leak sites for the company name, its domains, corporate email addresses with passwords and offers to sell access to the company network. Each hit should trigger a specific action: a password reset, verification of the offered access, or an assessment of whether a GDPR breach notification is required. At nFlo, such monitoring is part of the Threat Intelligence service.
What corporate data is most commonly sold on the darknet?
The most frequently traded corporate data on the darknet includes employee login credentials, customer databases, financial records, intellectual property, and access to corporate VPNs or RDP sessions. Stolen credentials from data breaches are particularly common, often sold in bulk at low prices.
How do stolen passwords from the darknet come back to the company?
Stolen credentials come back to the company in two ways. The first is credential stuffing: the attacker automatically tries username–password pairs from leaks against corporate applications, VPNs or Microsoft 365, betting that an employee reused the same password. The second is targeted phishing: leaked data makes a message to a specific employee more convincing. MFA and screening passwords against breached-password lists stop the first; training and phishing simulations address the second.
Is the darknet a source of supply-chain attacks on IT?
Yes — the darknet acts as an access marketplace. Brokers known as Initial Access Brokers sell other criminals access to specific companies there, obtained e.g. through infostealers or flaws in edge devices. In its Threat Landscape 2024 report, ENISA noted that this model has kept its popularity. Spotting an offer that concerns your own company gives you time to close the access before it is used.
How does a vCISO help with a darknet threat response strategy?
A vCISO brings darknet monitoring findings into the risk management process: decides who assesses the hits and when a case becomes an incident, makes sure the response procedure covers GDPR deadlines, and reports this risk to the board — without hiring a full-time CISO.
Related Terms
Learn key terms related to this article in our cybersecurity glossary:
- Ransomware — Ransomware is a type of malicious software (malware) that blocks access to a…
- Network Security — Network security is a set of practices, technologies, and strategies aimed at…
- Wireless Network Security — Wireless network security refers to the measures and practices used to protect…
- Cybersecurity — Cybersecurity is a collection of techniques, processes, and practices used to…
- Cybersecurity Incident Management — Cybersecurity incident management is the process of identifying, analyzing,…
Learn More
Explore related articles in our knowledge base:
- ICT Cybersecurity: Comprehensive Guide for Organizations
- Guide: How to implement high availability (HA) solutions in your IT infrastructure step by step
- The dark side of IIoT: How to secure smart sensors before they become a gateway for attackers?
- What Cybersecurity Regulations Apply to Local Governments?
- API Security: Security in the microservices era
Explore Our Services
Need cybersecurity support? Check out:
- Penetration Testing — identify vulnerabilities that may lead to data leaks later appearing on the darknet
- Phishing Simulations — testing how employees respond to targeted phishing that uses leaked data
- vCISO — strategic advisory and risk management, including leak response procedures
- NIS2 Compliance — NIS2/KSC gap analysis and preparation for incident reporting to the CSIRT: early warning within 24 h, incident notification within 72 h, final report within one month
- Security Audits — comprehensive security assessment
- SOC as a Service — 24/7 security monitoring
Glossary of key darknet concepts
- Darknet
- Overlay networks (Tor, I2P, Freenet) hosting sites that an ordinary browser cannot open and search engines do not index; leaked data and offers to sell access to corporate networks end up there.
- Deep Web
- Everything an ordinary search engine does not show (email, online banking, intranets, company databases). The dark web is a small fragment of it, reachable only with dedicated software.
- Tor (The Onion Router)
- Anonymising network using multi-layer "onion" encryption across thousands of nodes spread globally; the most popular gateway to the darknet.
- I2P (Invisible Internet Project)
- Decentralised peer-to-peer network focused on hidden communication inside its own ecosystem (eepsites .i2p); an alternative to Tor; traffic usually stays inside I2P, so exit nodes play a smaller role.
- Initial Access Broker (IAB)
- A broker selling other criminals access to specific companies (e.g. VPN, RDP or Active Directory accounts) on the darknet.
- Dark Web Monitoring
- Continuous searching of forums, marketplaces and leak sites for passwords, mentions of the company and offers to sell access to its network.
- Credential Stuffing
- An attack consisting of automatically trying logins and passwords stolen from other services (often sold on the darknet) against corporate SaaS applications, VPN, Microsoft 365 accounts.
Related topics
See also:
