A recent research paper, “Below the Surface: Exploring the Deep Web”, by the forward-thinking threat research team at Trend Micro, explored a part of the Internet so anonymous that it serves as an online platform for drug dealing, identity and account sales, and even assassin hire.

The Deep Web by definition is any Internet content that cannot be indexed by Surface Web search engines like Google. It includes dynamic web pages, blocked sites, unlinked sites, private sites, non-HTML/-contextual/-scripted content, and limited-access networks. These limited-access networks cover the resources and services that wouldn’t normally be accessible with a standard network configuration, which means they provide interesting possibilities for malicious actors to conduct their nefarious activities either partially or completely undetected by law enforcers.

“The whole allure of the Deep Web lies in the anonymity it provides the people that engage in it. But Trend Micro decided to do some digging and so for over two years our research team has done extensive exploration of the Deep Web, collecting and analysing its contents and keeping tabs on ongoing activities. So far, our researchers have collected over 38 million events that account for 576 000 URLs, 244 000 of which bear actual HTML content,” says Ihab Moawad, Vice President MMEA and CIS at Trend Micro.

Ihab Moawad, Vice President MMEA and CIS at Trend Micro

Moawad goes on to say that the best way to understand the Deep Web is to picture it as a subterranean mining operation, in terms of scale, volatility and access. There are parts of the Deep Web that are inaccessible via traditional means, making it a ‘digital safe haven’ for cybercriminals or anyone looking for a place to trade illegal goods and services.

Surface Web vs. Dark Web vs. Deep Web

The Surface Web and the Deep Web will always and inevitably be discussed in unison, as they are the exact opposite of each other. The Surface Web – sometimes called the “clearnet” - is the part of the Internet that conventional search engines can index and standard web browsers can access without the need for special software and configurations.

In addition to the Surface Web and the Deep Web, there is the Dark Web and though it sounds much like the Deep Web, the two are distinctly different. The Dark Web is a part of the Deep Web that relies on darknets or networks where connections are made between trusted peers. Some examples of Dark Web systems include TOR, Freenet or the Invisible Internet Project.

“Keeping with the mining tunnel metaphor, the Dark Web would be the deeper parts of the Deep Web that require highly specialised tools or equipment to access. It lies deeper underground and site owners have more reason to keep their content hidden,” Moawad explains.

What and who?

Activities on the Deep Web range from the sale of drugs and illegal contraband to the launching of cybercriminal operations, identity theft, doxing of high-profile personalities, firearm trade and even the hiring of contract killers.

Trend Micro researchers point out that upon reading their latest report, people may believe that the vast majority of sites on the Deep Web are dedicated to the sale of illegal drugs and weapons, but this is untrue. There is also a sizeable chunk of the Deep Web dedicated to more mundane topics like personal or political blogs, news sites, discussion forums, religious sites and even radio stations. Similar to sites found on the Surface Web, these types of sites cater for individuals hoping to talk to or connect with like-minded people – albeit anonymously.

“We cannot say with certainty who resides in the Deep Web as the level of anonymity it affords users makes it challenging for even the best security researchers to profile them. The only way that our researchers can attempt to gauge the composition of its user base is by examining site content and popularity,” says Moawad.

There are various reasons why people would want to remain anonymous or set up sites that can’t be traced back to physical location or entity. People who want to shield their activity from government surveillance may require darknets. There are also those who may want to share vast amounts of insider information with journalists, without leaving a paper trail. In addition to these reasons, dissidents in restrictive regimes may need anonymity so they can safely let the world know what is happening their country.

And then of course there are those who enjoy the anonymity of the Deep Web to cover up their illegal activity, like the plotting of an assassination of a high-profile target or the sale of illegal documents like passports and credit cards.

Devious details

According to Trend Micro’s researchers, the level of anonymity offered by the Deep Web makes people who participate in it more inclined to engage in illegal activities. Indeed the kinds of transactions that take place within it, as well as the nature of the goods and services that are predominantly traded, paint a chilling picture of what people would do if the concealment of their identities was guaranteed.

“In contrast to the cybercriminal underground, the activities in the Deep Web have more apparent and drastic effects on the real world. Many of the malicious tools and services sold in the cybercriminal underground can be used to gain profit; those peddled in the Deep Web – assassination services, for example – serve a much more sinister purpose.

“Users need to ensure that they place their trust in a security vendor that can protect them. While most users will not find a use for the Deep Web, security vendors must still be able to protect their customers from the cybercriminal activities happening within it. Therefore Trend Micro and our forward-looking threat research team will continue to monitor these online territories,” says Moawad.

Will the Deep Web ever dry up?

The secretive nature of the Deep Web makes it impossible to determine the amount of pages and content at any given time or to provide a comprehensive picture of everything that exists within it. According to Trend Micro’s researchers, it is so untraceable that no one can say with certainty that they’ve fully explored its depths.

“Although increased public awareness may lead to the increased use of or interest in the Dark Web and other sites for similar purposes in the Deep Web, users currently don’t have enough reason to migrate their Internet browsing to specialised anonymising software, “ says Moawad.

“However, I don’t see the Deep Web going anywhere, anytime soon. As long as it continues to offer the level of anonymity it does, it will remain extremely challenging for law enforcers to catch perpetrators, and cybercriminals will continue to take advantage of the shadows the Deep Web casts over their illegal activities.”