Media coverage and casual conversation often use "dark web" and "deep web" interchangeably. The deep web covers content that search engines do not index. The dark web is a smaller subset built for anonymous access and requires specific software.
The distinction helps security teams define what a monitoring service can collect and what a reported match means.
The Internet Iceberg Analogy
The iceberg analogy places searchable pages above the waterline and unindexed content below it. It is useful for showing the distinction, but percentage estimates are not measurable in a stable or consistent way.
Surface Web: Content that standard search engines such as Google, Bing, or DuckDuckGo can index, including public websites, news articles, blogs, and public social posts.
Deep Web: Content not indexed by public search engines, including private accounts, databases, and subscription services.
Dark Web: Intentionally hidden services that require software such as Tor to access. It is a subset of unindexed content, not a fixed percentage of the internet.
What Is the Deep Web?
The deep web is any web content that standard search engines do not index. It includes routine private content such as account pages, internal tools, and subscription databases.
Examples of Deep Web Content:
- Password-Protected Sites: Your email inbox, online banking, company intranet, subscription services like Netflix
- Database Content: Academic databases, library catalogs, government records, medical records
- Private Social Media: Private Facebook posts, Instagram stories visible only to friends, private Discord servers
- Dynamic Pages: Pages generated in response to specific searches (flight booking results, real-time stock prices)
- Paywalled Content: Premium news articles, research papers, subscription-only content
- Administrative Pages: Backend admin panels, content management systems, draft content
You use the deep web when you check email, access a bank account, or sign in to a work system. Those pages stay out of search results because they require authorization or depend on a private query.
Size is not measurable as a stable ratio:
Private databases, password-protected accounts, and dynamically generated pages change continuously. Treat iceberg percentages as an illustration, not a census of the internet.
What Is the Dark Web?
The dark web is a collection of deliberately hidden sites that standard browsers cannot reach directly. Visitors commonly use the Tor browser to open .onion domains. The network obscures identifying information about site operators and visitors.
Key Characteristics of the Dark Web:
- Requires Special Software: Primarily Tor (The Onion Router), also I2P and Freenet
- .onion Domains: URLs look like random character strings (e.g., 3g2upl4pq6kufc4m.onion)
- Anonymity Focus: Traffic is encrypted and routed through multiple servers to hide user identity and location
- Not Indexed: Search engines cannot and do not index dark web content
- Intentionally Hidden: Sites are designed to avoid detection and tracking
What's on the Dark Web?
The dark web also supports legal uses:
- Privacy Protection: Journalists, whistleblowers, and activists in oppressive regimes use Tor for secure communication
- Anonymous Communication: People seeking privacy from government surveillance or corporate tracking
- Research: Security researchers studying cybercrime and law enforcement investigating criminal activity
- Forums and Communities: Discussion forums on various topics, some entirely legal
The same anonymity also attracts criminal activity:
- Stolen data marketplaces selling credentials, credit cards, personal information
- Ransomware leak sites where stolen data is published
- Hacker forums discussing vulnerabilities and selling exploits
- Drug marketplaces (though many have been shut down by law enforcement)
- Illegal services and contraband
Dark web services include legitimate privacy resources as well as criminal forums, credential markets, and ransomware leak sites. The mix changes as services appear, disappear, or restrict access.
Key Differences: Dark Web vs Deep Web
Accessibility:
- Deep Web: Standard browsers, just requires login/credentials
- Dark Web: Requires special software like Tor
Purpose:
- Deep Web: Keeps private or dynamic content out of search results
- Dark Web: Obscures the identity of users and site operators
Size:
- Deep Web: Hundreds of times larger than surface web
- Dark Web: Intentionally hidden services reached through networks such as Tor
Content:
- Deep Web: Mostly routine private content, such as email, banking, databases, and private social media
- Dark Web: Mix of legitimate privacy tools and illegal marketplaces
Legality:
- Deep Web: Entirely legal
- Dark Web: Accessing is legal, but much hosted content involves illegal activity
Why the Confusion?
Several features contribute to the confusion:
Media Coverage: Some reports use "deep web" for stories that refer specifically to dark web sites.
Technical Definitions: Hidden content and anonymously accessed content sound similar until the access methods are explained.
Overlapping Definitions: Since the dark web is technically part of the deep web, some definitions blur the lines.
Loose Language: Headlines sometimes use the broader term even when the story concerns a .onion site or criminal forum.
Why This Matters for Cybersecurity
The distinction affects monitoring scope, risk assessment, and vendor evaluation.
Threat Monitoring Focus: A monitoring service watches defined sources such as ransomware leak sites, criminal forums, and public messaging channels. It cannot inspect private email accounts, bank portals, or every other part of the deep web.
Resource Allocation: Source definitions help a team decide where monitoring is useful. A credential listing on a criminal market calls for different handling than an ordinary private account page.
Risk Assessment: "We found your company mentioned on the deep web" does not identify a source or explain the risk. A useful alert names the source type, shows the available evidence, and gives an analyst enough context to investigate.
Regulatory Compliance: Teams should map any monitoring requirement to named sources and documented review procedures instead of treating "deep web" as a measurable coverage claim.
Vendor Evaluation: Ask a vendor that claims to monitor "the entire deep web" for a source list, collection method, and coverage limits. Specific answers make the service easier to evaluate.
What Organizations Should Monitor
Security teams commonly watch these source types:
- Ransomware Leak Sites: Dark web sites where ransomware groups publish stolen data
- Credential Marketplaces: Forums and markets selling stolen usernames/passwords
- Hacker Forums: Underground communities discussing exploits and selling access
- Initial Access Broker Markets: Sites where network access is auctioned
- Paste Sites: Where attackers dump stolen data (some paste sites are surface web, monitored similarly)
- Telegram Channels: Encrypted messaging channels where threat actors operate
A match from one of these sources is an investigation lead. Analysts still need to validate the source evidence and determine whether it concerns the organization.
Conclusion
The deep web includes ordinary private content that search engines do not index. The dark web is a smaller, intentionally hidden subset that supports both privacy tools and criminal markets.
Dark web sources relevant to security work include credential markets, ransomware leak sites, and forums where access brokers advertise compromised networks.
Use the distinction to define monitoring coverage and to ask vendors what they collect, how often they collect it, and what evidence accompanies an alert.
If someone says they monitor "the deep web," ask which source types the service covers. The answer should be specific enough to test.