A December 2014 study by Gareth Owen from the
University of Portsmouth found that the most commonly hosted type of content on Tor was
child pornography, followed by
black markets, while the individual sites with the highest traffic were dedicated to
botnet operations (see attached metric). Many
whistleblowing sites maintain a presence as well as political discussion forums. Sites associated with
Bitcoin,
fraud-related services, and
mail order services are some of the most prolific. In July 2017,
Roger Dingledine, one of the three founders of the Tor Project, said that
Facebook is the biggest hidden service. The dark web comprises only 3% of the traffic in the Tor network. A February 2016 study from researchers at
King's College London gives the following breakdown of content by an alternative category set, highlighting the illicit use of .onion services.
Ransomware Ransomware groups rely on dark web infrastructure across the attack lifecycle. Ransomware-as-a-Service (RaaS) operators recruit affiliates through dark web forums such as RAMP and, prior to bans imposed after the 2021
Colonial Pipeline attack, Exploit and XSS, where they advertise toolkits, commission structures typically offering affiliates 60–80% of ransom proceeds, and vet prospective partners. Most prominent ransomware groups also operate dedicated data leak sites on the
Tor network as part of a double extortion model pioneered by the Maze ransomware group in November 2019, in which stolen data is published or threatened to be published if victims refuse to pay, with groups such as
LockBit, ALPHV/BlackCat, and
Cl0p hosting data from hundreds of victim organizations. Rather than conducting the full attack lifecycle independently, many ransomware affiliates purchase pre-established network access from
initial access brokers (IABs), specialized threat actors who compromise organizations through methods such as exploiting vulnerable systems, phishing, or leveraging credentials from
infostealer malware, and sell that access on underground forums, with listings typically priced by factors including victim revenue, access type (VPN, RDP, Active Directory), and geographic location. This division of labor has created an efficient criminal supply chain that lowers the technical barrier to entry for ransomware attacks.
Botnets Botnets are often structured with their
command-and-control servers based on a censorship-resistant hidden service, creating a large amount of bot-related traffic.
Darknet markets Commercial
darknet markets mediate transactions for illegal goods and typically use
Bitcoin as payment. These markets have attracted significant media coverage, starting with the popularity of
Silk Road and its subsequent seizure by legal authorities. Silk Road was one of the first dark web marketplaces that emerged in 2011 and has allowed for the trading of illegal
drugs,
weapons and
identity fraud resources. Although it found the digital information, such as concealment methods and shipping country, "seems accurate", the study uncovered issues with the quality of illegal drugs sold in Evolution, stating that, "the illicit drugs purity is found to be different from the information indicated on their respective listings." Darknet markets have also provided leaked credit card information that was made available for free.
Bitcoin services Bitcoin is one of the main
cryptocurrencies used in dark web marketplaces due to the flexibility and relative anonymity of the currency. With bitcoin, people can hide their intentions as well as their identity. A common approach was to use a
digital currency exchanger service which converted bitcoin into an online game currency (such as gold coins in
World of Warcraft) that will later be converted back into fiat currency.
Bitcoin services such as
tumblers are often available on
Tor, and some – such as
Grams – offer darknet market integration. A research study undertaken by Jean-Loup Richet, a research fellow at
ESSEC, and carried out with the
United Nations Office on Drugs and Crime, highlighted new trends in the use of bitcoin tumblers for
money laundering purposes, using
escrows. Due to its relevance in the digital world, bitcoin has become a popular product for users to scam companies with. Such groups include
xDedic,
hackforum, Trojanforge,
Mazafaka,
dark0de and the
TheRealDeal darknet market. Some have been known to
track and
extort apparent pedophiles. Cyber crimes and hacking services for financial institutions and banks have also been offered over the dark web. Attempts to monitor this activity have been made through various government and private organizations, and an examination of the tools used can be found in the
Procedia Computer Science journal. Use of Internet-scale DNS distributed reflection denial of service (
DRDoS) attacks have also been made through leveraging the dark web. There are many scam .onion sites also present which end up giving tools for download that are infected with
trojan horses or
backdoors. Recently, around 100,000 compromised
ChatGPT users' login information was sold on the dark web in 2023. Additionally, the logs showed, in the opinion of the researchers, that the majority of the compromised ChatGPT passwords had been extracted by the data-stealing virus Raccoon.
Financing and fraud Scott Dueweke the president and founder of Zebryx Consulting states that Russian electronic currency such as
WebMoney and Perfect Money are behind the majority of the illegal actions. There are numerous
carding forums,
PayPal and
bitcoin trading websites as well as fraud and counterfeiting services. Many such sites are scams themselves.
Phishing via cloned websites and other
scam sites are numerous, with
darknet markets often advertised with fraudulent URLs.
Illegal pornography The type of content that has the most popularity on the dark web is illegal pornography—more specifically,
child pornography. – often via compromising the site and tracking users'
IP addresses. In 2015, the
FBI investigated and took down a website called
Playpen. Other content includes
sexualised torture and killing of animals and
revenge porn. In May 2021,
German police said that they had dismantled one of the world's biggest child pornography networks on the dark web known as
Boystown; the website had over 400,000 registered users. Four people had been detained in raids, including a man from
Paraguay, on suspicion of running the network.
Europol said several pedophile chat sites were also taken down in the German-led intelligence operation.
Terrorism Terrorist organizations took to the internet as early as the 1990s; the birth of the dark web attracted these organizations due to the anonymity, lack of regulation, social interaction, and easy accessibility. These groups have been taking advantage of the chat platforms within the dark web to inspire terrorist attacks. With the increase of technology, it has allowed cyber terrorists to flourish by attacking the weaknesses of the technology. In the wake of the
November 2015 Paris attacks, an actual such site was hacked by an
Anonymous-affiliated hacker group,
GhostSec, and replaced with an advert for
Prozac. The
Rawti Shax Islamist group was found to be operating on the dark web at one time.
Social media Within the dark web, there exists emerging social media platforms similar to those on the World Wide Web, this is known as the Dark Web Social Network (DWSN). The DWSN works a like a regular social networking site where members can have customizable pages, have friends, like posts, and blog in forums.
Facebook and other traditional social media platforms have begun to make dark-web versions of their websites to address problems associated with the traditional platforms and to continue their service in all areas of the World Wide Web. Unlike Facebook, the privacy policy of the DWSN requires that members are to reveal absolutely no personal information and remain anonymous. however, these are believed to be exclusively scams. The creator of
Silk Road,
Ross Ulbricht, was arrested by Homeland Security investigations (HSI) for his site and allegedly hiring a hitman to kill six people, although the charges were later dropped. There is an
urban legend that one can find
live murder on the dark web. The term "
Red Room" has been coined based on the
Japanese animation and urban legend of the same name; however, the evidence points toward all reported instances being
hoaxes. On June 25, 2015, the
indie game Sad Satan was reviewed by YouTubers
Obscure Horror Corner which they claimed to have found via the dark web. Various inconsistencies in the channel's reporting cast doubt on the reported version of events. There are several websites which analyze and monitor the deep web and dark web for threat intelligence. == Policing the dark web ==