Dark web
The part of the web reachable only through Tor or a similar network, where stolen credentials, network access and victim data change hands.
In October 2013, the FBI shut down Silk Road, the drug marketplace reachable through Tor. In April 2022, Germany's Federal Criminal Police Office (BKA) seized the servers of Hydra, the largest Russian-language market. In April 2023, Operation Cookie Monster, led by the FBI and its partners, took down Genesis Market. The market sold stolen credentials and browser fingerprints: enough to log in to a site as the victim without tripping an alert. The dark web is the part of the web that can only be reached through an anonymizing network such as Tor, with .onion addresses that hide the host as well as the visitor. Access-broker forums, credential shops and ransomware leak sites live there, and often reappear under a new name after a takedown. For an insurer, it matters at two points. Before binding, vendors monitor a prospect's leaked credentials (addresses on its domain and passwords for sale or posted openly), and the result feeds the external security rating or the questions sent to the broker. After a breach, resale of the data on these markets drags the claim out: more notifications, fraud against the people affected, lawsuits that arrive months later. Monitoring sees what is posted on the marketplaces it indexes, and nothing else; access sold through a private message slips past it. Not to be confused with the deep web, the ordinary mass of pages search engines do not index (webmail, customer portals, intranets), which makes up most of the web and is in no way clandestine.
Hypothetical: while underwriting a 120-person accounting firm, the monitoring report turns up 40 email and password pairs on the firm's domain in infostealer logs offered for sale, two of them dated the previous month. The underwriter asks whether those accounts were reset and whether email requires a second factor. The firm checks the two recent accounts and finds one belongs to a partner who works from his personal computer. The file goes back with a written subjectivity on access from unmanaged devices.
dark web, darknet, darknet markets, Tor hidden services, onion sites
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.