The ‘Dark Web‘ is the part of the internet that is not indexed by standard search engines and is accessible only through anonymising software, most commonly the Tor browser. It is commonly associated with criminal activity, and that association is not entirely wrong — the dark web hosts markets for stolen data, ransomware-as-a-service operations, fraud toolkits, and communications infrastructure for criminal and state-sponsored threat actors. But it is also used by journalists, activists, researchers, and privacy-conscious individuals for entirely legitimate purposes.
For businesses, the dark web is most relevant as an intelligence environment: a place where stolen data is traded, where threat actors discuss targets and techniques, and where early warning of a breach or a targeted attack can sometimes be obtained before the attack occurs or before the stolen data is widely circulated. Dark web investigation for business clients is therefore primarily a threat intelligence and brand protection exercise, not an intrusion into criminal operations.
What Is the Dark Web?
The dark web is a portion of the internet hosted on overlay networks that require specific software, configurations, or authorisation to access. The most widely used overlay network is Tor (The Onion Router), which anonymises internet traffic by routing it through a series of encrypted relays. Websites on the Tor network use ‘.onion’ domain suffixes and are not accessible through standard browsers.
The dark web exists within the broader ‘deep web’, which refers to all internet content not indexed by standard search engines — including banking portals, private databases, corporate intranets, and academic archives. The dark web, properly defined, is the subset of the deep web that is specifically designed to be inaccessible to casual access and that is most associated with anonymised activity.
Why Businesses Investigate the Dark Web
Businesses monitor and investigate the dark web for several distinct purposes:
Data breach detection: stolen credentials, database records, payment card data, and other sensitive information obtained through data breaches are typically listed for sale on dark web marketplaces within hours or days of the breach occurring. Dark web monitoring can provide early warning that an organisation’s data has been compromised, often before the breach has been detected internally.
Brand protection: counterfeit goods, fraudulent websites impersonating the brand, and services that exploit the brand’s reputation for criminal purposes are advertised on dark web forums. Dark web intelligence can identify these activities and support brand protection and takedown actions.
Threat intelligence: dark web forums are used by threat actors to discuss targets, share techniques, and advertise services. Intelligence gathered from these forums can provide advance warning of a planned attack, identify the tools and techniques being used against the organisation’s sector, and inform defensive measures.
Third-party risk: organisations that hold sensitive data on behalf of clients, or that are part of a supply chain that handles sensitive information, may monitor the dark web for evidence that a supplier or partner has been compromised in a way that creates risk for the organisation.
Stolen Data Monitoring
Dark web monitoring for stolen data is a continuous intelligence function rather than a one-time investigation. It involves systematic monitoring of dark web marketplaces, data leak sites, and criminal forums for the organisation’s sensitive data: email addresses and credentials from corporate domains, payment card data, personal data relating to employees or customers, intellectual property, and any other data category whose appearance on the dark web would indicate a breach.
When a data match is identified, the intelligence provides the basis for a rapid incident response: identifying the likely source of the leak, assessing the scope of the breach, initiating the regulatory reporting process, and taking steps to mitigate the ongoing harm. The earlier the detection, the more of these steps can be taken before the data is widely used.
Threat Intelligence Gathering
Threat intelligence from the dark web supplements the technical indicators of compromise that traditional security monitoring provides. While a SIEM or endpoint detection tool can identify that an attack is occurring, dark web intelligence can sometimes identify that an attack is being planned, that an organisation has been identified as a target by a specific threat actor group, or that credentials belonging to the organisation’s employees are being traded.
This proactive intelligence is most valuable when it can be acted upon before the attack occurs: resetting compromised credentials, patching vulnerabilities being discussed in threat actor forums, enhancing monitoring in the areas identified as targets, and briefing security teams on the specific techniques and tools associated with the identified threat actor.
Incident Response Support
In the context of an active incident, dark web investigation provides several forms of support. Where the attack is a ransomware or extortion incident, the attacker’s communications and data leak site may be on the dark web, and monitoring those sites provides intelligence about the attacker’s claims, the data they have exfiltrated, and the negotiation position they are taking. Where the incident involves the theft of customer or employee data, monitoring the dark web for the appearance of that data provides real-time intelligence about whether and how it is being used.
Dark web investigation also supports attribution: threat actor groups and the infrastructure they use have distinctive signatures that are often discussed or visible in dark web environments, and the intelligence gathered can supplement the technical forensic attribution being conducted through other investigative channels.
Need dark web monitoring or investigation support for your business? Contact iSpy Detectives for specialist cyber intelligence services. Our cyber investigators have recently undertaken Dark web investigation for business customers in London, Manchester, Dundee, Birmingham, Liverpool, Leeds, Rochester and Lincoln.