Dark web

How it works

The Tor Project describes onion services as services that can only be accessed over Tor. A user needs Tor Browser, and the sites use long addresses ending in .onion. Tor routes traffic through multiple servers and encrypts it at each step, which hides who is communicating with whom.

Anonymity has legitimate uses. The Tor Project's onion services page features onion sites run by news organizations such as the BBC and Deutsche Welle, by Amnesty International and by software projects. The same anonymity attracts criminals, which is why the dark web is associated with illicit markets.

What it means for stolen data

Stolen data is traded on and off the dark web. Mandiant, writing about the 2024 campaign against Snowflake customers, notes that large lists of stolen credentials "exist both for free and for purchase inside and outside of the dark web". Kaspersky has documented cybercriminal channels and groups on Telegram that distribute leaked databases. A search limited to .onion sites misses those venues.

For executive exposure, the more useful questions are which records exist, where they appeared and how old they are. The same records often reappear in many copies, reposted across communities. How stolen data is sold walks through the venues, and dark web forums and marketplaces covers who trades there.

What this means for monitoring

WebThreat covers two layers. EDG3 watches dark web forums and marketplaces, Telegram and other channels, and links reposted copies back to the first post, so you see where leaked data was traded first. CEM starts from a company name, finds the leadership team and shows which leaders appear in breach corpora and leak databases, ranked by what to fix first. Together they show where leaked data is traded and which executives appear in it. Dark web monitoring for executives sets out what such coverage can tell you.

Reducing the risk

Once a record is posted, the person it describes has little control over it, so prevention happens upstream. Use unique passwords, enable multi-factor authentication, and treat any exposed credential as burned. Rotate it, then check where else it was used.

How it differs from related terms

The dark web is a technical network layer. A leak database is a collection of records, and it can be on the open web or reachable only through Tor. A combolist is a file format of credentials. The dark web is one place such things are posted, not a synonym for any of them.