The dark web is dying
It lost to convenience. A tour through Tor, hidden services, and why the underground moved somewhere easier.
Over its 42 days of existence, Gonzo Labs has prided itself in being your eyes on the Internet’s happenings. And while you may have not thought you could get even more value out of your current subscription, I have figured out a way to do it. In addition to the regularly scheduled piece, the adjacent readings, and the pretty pictures in each post, you will now also get a roundup of things that have popped up on my radar.
Recent Happenings
Vegetable and fruit AI slop emerged as a potential replacement to Italian brainrot. Based on how often they appear on my feed, they might be losing the race. It seems like we will not be getting vegetable slop theme parties.
Iran has been actively engaging in meme warfare. Surprisingly, they went for LEGOs instead of Studio Ghibli. Either way, the White House is definitely not unprepared for this.
A huge marketplace for scam services and potentially even human trafficking (as per WIRED) seems to be operating with no repercussions on Telegram. The market is easy to find, although it’s hard to verify what products actually get traction. We will continue to monitor the situation.
Now, back to our regularly scheduled programming.
I’ve been referencing Tor and the dArK w3b throughout my posts without ever dedicating a piece to it. This is that piece. What it is, who made it, what’s on it, and why it’s fading.
When you use the Internet everyday, you are using the “surface web” or the “clear web.” These are essentially all the websites that are indexed and discoverable by Google. Throughout the years, websites like Facebook and Instagram began to host more and more Internet content. Companies also began hosting their own Intranet networks. This content is typically not easily accessed externally. If you want to find an Instagram post, Google will not help you much. While I don’t like the name, these portions of the Internet which are not externally accessible, have been dubbed the “deep web.” Both the surface web and the deep web operate largely with the same underlying protocols.
The “dark web” is slightly different. People take the “dark web” to generally mean Tor hidden services (or Onion services) which are accessible through a Tor browser. Tor stands for The Onion Router because the onion analogy inspired the design of the protocol. Just like other Internet protocols, Tor came out of a military research lab.
When I say protocol, what I mean is a set of rules. Safari, Firefox, Chrome, etc. all follow a set of rules that allow them to get the content of websites. When you visit a website, it’s like you are sending a letter. You put the letter into the mail with a given address. The post office routes this letter to the destination. It’s delivered. They write a letter back with their response. The post office routes the letter… you get the point. This is how you get a website. We have protocols to send letters, packages, freight, etc. Other countries follow similar rules and so we are able to send mail internationally as well. We have protocols that let us transmit information both in the physical and the digital world.
How Tor works, roughly
The problem is that if you are doing something that requires privacy, such as sharing private state secrets or accessing nsfw pony cartoons, you may not want the post office to know that you are sending a letter to “ponyland xxx.” Tor to the rescue. To follow the Tor protocol, what you would do is:
Put your letter addressed to ponyland xxx in an envelope addressed to Alice (she’ll be the last recipient before ponyland).
Then you will put your envelope addressed to Alice in an envelope addressed to Bob.
And then you put everything into an outermost envelope addressed to Charlie (the first stop).
So, your letter is first sent to Charlie. Charlie knows you sent them a letter and Charlie knows to then send the letter to Bob. Bob opens the letter from Charlie and sees that it is a letter for Alice. Alice opens the letter and sees that it is a letter for ponyland xxx and sends it. In this way:
Charlie knows you sent them a letter and that the next destination was Bob.
Bob knows they received a letter from Charlie and that the next destination was Alice.
Alice knows they received a letter from Bob and that the next destination was ponyland xxx.
Ponyland only knows that Alice sent them a letter, and they return a response.
No single relay knows both who you are and where the letter is going. Charlie knows you but not the destination, Alice knows the destination but not you, Bob is in the middle and knows neither end. The response travels back through the same chain in reverse.
This idea of envelopes that you peel out is what makes this The Onion Routing protocol. Even though I left a lot of technicalities, what you need to remember is that: done well, Tor is the most private way we have to browse the Internet.
How is this different from a VPN? A VPN is like using FedEx instead of USPS––FedEx doesn’t tell the post office where your letter is going, but FedEx itself knows everything: who you are and where you’re sending mail. With Tor, no single party has both pieces.
You can use Tor to browse regular websites, as well as “hidden services.” Hidden services are websites that hide their own address the same way you hide yours. Neither side knows where the other actually is. Hidden services are what you use if you’re setting up sketchy websites so the police don’t come after you as an operator. And you use a Tor browser to access them so you evade the law as a consumer.
What goes on the Tor network, anyway
Tor’s privacy affordances made it an ideal candidate to host sites where illegal happenings took place. After a series of failed attempts on the clear web, more tech savvy users saw Tor as a viable alternative to evade law enforcement. And then, with Bitcoin’s arrival, people saw that they had a way to privately host websites, privately navigate to said websites, and a (seemingly) private way to transact online: so people began selling drugs.
If Telegram is the Wallet City of Kowloon, Tor hidden services are underground tunnels, like the ones used in the Vietnam War: large networks of websites that are hard to find, some of which have links to others, but a lot which are isolated from each other.
Whenever I used to describe my PhD work to people, more often than not people thought of weapons and hitmen, sometimes drugs. In reality, it’s just mostly about drugs. I’d venture and guess that drugs are the primary use case, followed by illegal digital goods/services (e.g., stolen data, hacking or spam services, etc.), and lastly unregulated media, mainly porn and gore.
This isn’t to say other stuff doesn’t exist; weapons and CSAM are both there. But a few things keep the dark web from becoming the lawless free-for-all people imagine. There’s the technical hump, first to access the sites and then to pay for things. There’s the clear web alternative. Most people don’t actually need Tor to find unregulated porn, fake IDs, or counterfeit goods. There’s the police, who run a major bust every couple of years and pursue the more extreme stuff aggressively enough that most sites have rules against it (better to piss off one federal agency than five). And there’s the common fear that the sketchy website you’re trying to buy drugs from is also going to give your computer a ~virus~.
It is important to mention that the Tor network has important benign uses. It allows people that really need privacy (e.g., dissidents, journalists in conflictive zones, etc.) a way to navigate the Internet. It also allows people to circumvent censorship. Unfortunately, while Tor helps hide the content you are browsing from prying eyes like your Internet service provider, it does not hide the fact that you are using Tor. The fact that “you have something to hide” in itself can attract scrutiny from law enforcement. Also, a lot of the Internet becomes less usable when you use privacy-preserving technologies; you may get infinite CAPTCHAs just trying to reach Google. This has ultimately prevented this tool from flourishing.
All of this has resulted in a network that––all things considered––is not very big. A recent paper found only ~25k unique sites. A quick skim of /r/onions reveals little activity and the same handful of websites that are worth visiting. Circa 2015 era, there were about 20ish darkweb markets operating at a given point in time. By the 2020s, you’d be pressed to find 5.
In 2026, the dark web seems to be dying.
Tor requires a dedicated browser that doesn’t run on your phone, loads slowly, and breaks on half the sites you try to reach. Many online guides will tell you to not even open it unless you are using a separate operating system. Paying for things in a private way has also gotten harder, even with cryptocurrencies, because so many crypto exchanges have implemented rules that require you to verify your identity. All of this makes it a major hassle. In a world that is increasingly mobile-first and short-attention-spanned, VPNs and Telegram are winning.
Usability alone doesn’t explain it, though. In recent projects involving the misuse of AI, both to generate deepfake pornography and to generate malware, I had little luck finding leads in the dark web. It turns out the clear web was permissive enough. The enforcement pressure that pushed illicit activity onto Tor in the first place has slackened, or at least become inconsistent enough that operators are willing to take the bet. Why offer deepfake services on the darkweb when you can do it on Fiverr? Why go to Tor for illegal goods and services when you can go to Telegram?
What’s left on Tor is what can’t be tolerated anywhere else. Which these days is not much.
Adjacent Reading
Jardine et al. “The potential harms of the Tor anonymity network cluster disproportionately in free countries.”
Leonidou et al. “A Qualitative Analysis of Illicit Arms Trafficking on Darknet Marketplaces”
Soska and Christin. “Measuring the Longitudinal Evolution of the Online Anonymous Marketplace Ecosystem”
Crazy viet cong reference! Superb read with great energy