What Is the Dark Web? A Plain-English Guide, from Checking for Leaked Data to Protecting Your Company

"So what exactly makes the dark web so dangerous?"
Many people have probably felt uneasy after seeing the term in the news or on social media. In Japan in particular, since the KADOKAWA Group ransomware incident in 2024, far more people have started to worry about "where leaked information spreads" and "whether my own or my company's information is safe." In fact, since June 2024 KADOKAWA has published updates in stages, covering everything from the system outage and the data leak to its legal response to the spread of the leaked information.

To give the conclusion first: the dark web is a highly anonymous part of the internet that is difficult to enter without dedicated software. It is often described as a breeding ground for illegal activity, but that is not the whole story. At the same time, it really is used to buy, sell and share stolen credentials, credit card details and corporate data, so neither individuals nor companies can consider themselves unaffected. CrowdStrike describes the dark web as an unindexed space that can be accessed anonymously with special browsers such as Tor, noting that while it has legitimate users such as journalists and whistleblowers, it is also a hotbed for stolen data and illegal trade.

This article covers the following four points:

• What the dark web basically means, and how it differs from the deep web
• Whether accessing it is illegal in itself, and why it is dangerous
• How to check whether your own or your company's information has leaked
• What a company should prepare

CyberCrew offers dark web monitoring tailored to your needs, from one-off spot investigations to regular monthly monitoring. Because our own white-hat hackers handle the work, investigations can start as early as the same day, and we can respond flexibly to urgent cases where you "need to check right now." Contact us for a free consultation.

What is the dark web? A plain-English explanation

The dark web may sound complicated, but once you lay it out, it is not that complex.
The first thing to grasp is that the dark web and the deep web are different things. Mixing them up makes the whole subject much harder to follow.

The difference between the surface web, the deep web and the dark web

The internet is often compared to an iceberg.
The visible part that search engines can find is the surface web. The non-public areas below the waterline, such as member pages, email and online banking, are the deep web. Within that, the area that is hard to reach without dedicated software or special configuration and is built on the premise of anonymity is the dark web.

CIS explains that the surface web is the part accessible through ordinary search engines, the deep web is the part not listed by search engines, and the dark web is a subset of the deep web that requires special software such as Tor or I2P.

In other words, your Gmail inbox or your company intranet is part of the deep web, but not the dark web. The dark web is part of the deep web, but that does not mean the entire deep web is dangerous. Grasping this difference at the outset changes how you read the news considerably. CrowdStrike also draws a clear distinction, stating that the deep web and the dark web do not mean the same thing and that the dark web is a separate space premised on anonymization technology.

How the dark web works (Tor and onion routing)

The best-known technologies behind the dark web's anonymity are Tor and onion routing. According to the Tor Project, research on this mechanism began at the US Naval Research Laboratory in the mid-1990s, and it was devised to make it harder for observers to learn who is communicating with whom. The basic idea is to pass traffic through several servers in turn, adding a layer of encryption each time, so that the origin and route are hard to trace.

To put it without jargon, rather than sending a letter as it is, you put it inside several envelopes and route it through multiple relay points. Even if someone along the way looks at it, it is hard to identify both the original sender and the final recipient at once. That is why the dark web is said to be "highly anonymous." That said, being highly anonymous and being safe are two different things. Confusing the two is dangerous.

The background and history of the dark web

The dark web was not a technology created for crime from the start.
Without knowing this, it is easy to fall into the misconception that "it's a dangerous place, so everything about it is illegal." Its actual starting point was, if anything, privacy protection and circumventing censorship.

Originally a technology developed by the US Navy

According to the Tor Project's official account, the idea of onion routing began with research at the US Naval Research Laboratory in the mid-1990s. The goal was to make it harder for observers to see "who is communicating with whom" on the internet. The Tor network was first released in 2002 and later, with support from the EFF among others, spread as a tool for privacy and censorship circumvention.

So when discussing the dark web and Tor, it is more accurate to think not of an "illegal tool" but of a technology that provides anonymity and is used for both legitimate and illegitimate purposes. Indeed, the Tor Project emphasizes uses such as getting information out of countries with heavy censorship and protecting the privacy of journalists, activists and ordinary users.

What brought the dark web to wider attention in Japan

One of the events that made people in Japan broadly aware of Tor and anonymous networks was the 2012 remote PC hijacking case. A NISC column also notes that "many people may have learned through this case about Tor, a mechanism that lets you access the internet anonymously."

Then, in 2018, Coincheck suffered a major incident in which NEM was illicitly transferred, and the company announced that approximately 526.3 million XEM had been sent out through unauthorized access. In 2024, the KADOKAWA Group was hit by ransomware, and the spread of the leaked information and the company's response were widely reported. Through incidents like these, it is fair to say that "anonymization technology," "leaked information" and "black markets" came to be discussed in Japan not as a distant overseas story but as a real risk.

What is traded on the dark web

The term "dark web" tends to take on a life of its own, but what matters is correctly understanding what is exchanged there and what kind of damage it leads to.
Only once that is clear does it become easier, for individuals and companies alike, to think about realistic countermeasures.

Personal information and login credentials

The most familiar category, and the one most likely to cause real harm, is personal information such as email addresses, passwords, names, addresses and phone numbers.
Especially common are cases in which IDs and passwords leaked from other companies' services are bought and sold on the dark web, and that information is then abused for unauthorized access to business systems and corporate email.
At CyberCrew, too, we conduct our investigations and monitoring with particular focus on how the circulation of such credentials becomes an entry point into companies.

The frightening part is that a leak is not "over once it happens." Leaked credentials are repurposed again and again for other attacks, such as phishing, impersonation, credential stuffing and unauthorized logins. Using the same password for work email and personal services is especially dangerous, for companies and individuals alike.

Credit card and financial information

Credit card information is another classic example of what is bought and sold on the dark web. In 2024, Kaspersky reported that stolen card data was trading on the dark web for roughly $70 to $315 per set. In 2025 it also announced that bank card details leaked via infostealers had reached around 2.3 million cards.

Such information can be misused without the cardholder noticing. In some cases, criminals test the card with small payments first and then use it for larger amounts. A card data leak is not a risk that "will sort itself out eventually"; as soon as you notice something unusual, you should contact your card issuer and proceed with suspending or replacing the card. JCB, for example, states that it monitors for suspicious use 24 hours a day, 365 days a year, and advises suspending or replacing cards when fraudulent use is suspected.

Malware, attack tools and vulnerability information

The dark web circulates not only stolen data but also the raw materials of attacks themselves. Ransomware as a Service (RaaS), for example, is a model in which ransomware developers provide code and infrastructure and operators use it to carry out attacks. Microsoft describes RaaS as a cybercrime business model in which developers and affiliates share the profits.

What makes this structure troublesome is that it lets people take part in attacks without advanced development skills. Once malware, exploits, initial access support and information on bypassing two-factor authentication are all available, the barrier to attack drops. In other words, the dark web functions not just as a place to store information but, in part, as a "procurement market" for attacks.

Illegal drugs, weapons and crime-for-hire

One reason the dark web draws so much media attention is that it serves as a venue for exchanging illegal drugs, illegal weapons, stolen data, malware and more. CIS likewise notes that illegal content and goods such as drugs, illegal weapons, malware and stolen data circulate on the dark web.

Rather than sensationalizing this more than necessary, however, it is closer to the reality to understand that "precisely because it is highly anonymous, it easily becomes a gathering point for illegal trade." For ordinary users, there is essentially no value in approaching it out of curiosity.

Corporate secrets, design drawings and customer data

For companies, the serious risk is not limited to employee credentials. Customer data, internal documents, design drawings, source code and contract information are also targeted. CrowdStrike lists leaked passwords, compromised credentials, intellectual property and confidential information as subjects of dark web monitoring. At CyberCrew, too, we investigate and monitor on the assumption that important data such as customer information and design drawings can become the subject of sales and distribution.

A common misconception here is that "only large companies are targeted." In reality, it is not unusual for small and midsize companies or a link in the supply chain to be used as a stepping stone. Even a B2B company is a full-fledged target as soon as it is seen as a route into its business partners.

Is accessing the dark web illegal? Is it dangerous?

This is the question we hear most often on this topic.
Leaving the conclusion vague would invite misunderstanding, so let us set it out clearly.

[Conclusion] In Japan, access itself is not illegal

At the very least, what Japan's Unauthorized Computer Access Act directly prohibits is wrongfully storing another person's identification codes and unauthorized access itself. The text of the law contains no provision that uniformly prohibits the act of viewing sites reachable via Tor in itself. In other words, it cannot be said that accessing the dark web is in itself immediately illegal. This is as far as can be read from the text of the law.

That does not mean you can relax, however. Acquiring, spreading or trading illegal data, accessing systems without authorization, and acts that amount to aiding a crime are a different matter. KADOKAWA, too, has announced warnings, legal action and criminal complaints against those who spread its leaked information. Access itself and what you do beyond it need to be considered separately.

Three reasons it is still dangerous

The first is the risk of malware infection. Links and downloads on the dark web should be considered far more dangerous than those on the ordinary web. CrowdStrike also explains that the dark web carries a high risk not only of illegal activity but also of fraud and malware.

The second is the risk of getting caught up in crime or fraud. High anonymity does not mean safety; precisely because anonymity is high, you cannot trust who the other party really is. With fraud, stolen data, fake markets and malware distribution all mixed together, it is easy to brush up against danger even if you intend "just to look."

The third is the risk of becoming a subject of surveillance or investigation. Breaking Tor's anonymization itself is not easy, but a NISC column also mentions cases and research in which investigative agencies have tracked down anonymous users through technical and operational methods. The idea that being anonymous keeps you unscathed is a dangerous one.

Japanese cases of actual harm and enforcement

One of the cases that made the dangers of anonymous networks widely known in Japan was the 2012 remote PC hijacking case. NISC's official column cites, as one of the factors that made the investigation difficult, the fact that the perpetrator used Tor to hide the originating IP address.

As a recent corporate case, the KADOKAWA Group ransomware incident in 2024 is easy to understand. The company has disclosed in stages everything from the data leak and the attackers' claim of responsibility to its warnings against spreading the leaked information and the progress of its legal action. What this shows is that the problem of the dark web and leak sites does not "end with a look"; it ties directly to business continuity, brand damage and legal response.

Why companies cannot stay uninvolved with the dark web

From here on, the perspective is for people responsible for security at companies.
Dark web threats need to be seen not as "stories about strange places" outside the company, but as risks that enter your company from the outside, via employee credentials and business partners.

Employees' IDs and passwords are being sold without their knowledge

Attackers do not necessarily try to break through your firewall or EDR head-on. Often it is faster to use employee IDs and passwords leaked from other companies' services as a foothold. At CyberCrew, too, we conduct our investigations and monitoring with particular focus on how credentials originating from such external services become an entry point into companies. In particular, when a leaked password is being reused, the damage may spread to other accounts and business systems as well.

Accounts belonging to executives or holding administrator privileges are especially likely to be targeted. It is not unusual for an attacker to get into just one email account, one VPN or one admin panel and spread laterally from there. As long as credentials are leaking outside the company's perimeter defenses, looking only inside the company is not enough.

The typical path from leak to unauthorized access

The typical flow is leak → sale on the dark web → buyer attempts login → unauthorized access → secondary damage. CyberCrew, too, explains that by monitoring the "sold on the dark web" stage of this flow, we minimize the impact. CrowdStrike likewise emphasizes the importance of detecting exposed credentials and confidential information early so that attackers do not get a head start on abusing them.

What makes this flow frightening is that it can happen even when the initial leak did not originate with your company. External services used by individuals, contractors, the supply chain, old accounts, reused passwords: precisely because you cannot know where an attacker will come in, the circulation of data after a leak must also be monitored.

The reality of roughly one billion records leaking every day

At CyberCrew, we believe continuous monitoring is essential, not only because the sheer volume of information leaking onto the dark web is enormous, but also because forums and posting venues keep shifting day by day.
That is also why there is information that tools alone cannot keep up with.
To keep continuous track of only the information directly relevant to your company, you need to account for even this pace of change.

The exact figures vary depending on how each source measures them, but at the very least, people responsible for security at companies should take as a given that "large volumes of leaked information circulate continuously" and that "a single check is not the end of it." This is why you should not take comfort in a one-off search alone.

If a leak goes unnoticed and is left unaddressed, it could develop into secondary damage or claims for compensation. The first priority is to check whether your company's information has leaked and to monitor regularly.

CyberCrew offers dark web monitoring tailored to your needs, from one-off spot investigations to regular monthly monitoring. Because our own white-hat hackers handle the work, investigations can start as early as the same day, and we can respond flexibly to urgent cases where you "need to check right now." Contact us for a free consultation.

How to check whether your company's information has leaked onto the dark web

Broadly speaking, checking happens in two stages.
First, cover what you can check for free, and then decide whether your company needs to dig deeper. Outdated information from older articles tends to creep in here, so we will lay this out in terms of methods you can use today.

How to check for free now that Google's "dark web report" has ended

The first thing to note is that Google's "dark web report" has already been discontinued. It used to be known as a way for individuals to check, but the feature can no longer be newly used.

So now you need to rethink "what to check with." As a free starting point, it is realistic to first check whether your email address has been involved in a leak, and then also check whether personal information appears in search results. The former suits checking credentials and past leaks, while the latter suits checking what is publicly exposed, so their roles differ slightly.

An easy-to-use entry point for this is ALIENGATE. With ALIENGATE, you can run a quick leak check simply by entering an email address on the official site. It is an easy entry point when you first want to find out, for free, "whether our company's information or business email addresses are circulating," and it is designed as a clear first path for companies to try.

That said, this needs to be understood separately. What is available for free is mainly the quick check; if you want to look at more detailed leak information, run continuous monitoring or operate at the organization level, a paid plan with additional features is the premise.

As an alternative to Google's feature, the mechanism for checking personal information in search results also remains useful. In other words, the realistic flow in practice today is to first check for leaks with a service such as ALIENGATE, and then, as needed, also check exposure in Google search results.

Why corporate needs and tool-only investigations have limits

Free tools are useful if you are only checking a single personal email address.
For companies, though, it is a different story. Once you try to cover the company domain, executives' email addresses, multiple brand names, subsidiary names, customer data, intellectual property, past credentials and related forums, a simple search cannot keep up. CrowdStrike also explains that dark web monitoring is an operation that continuously gathers raw intelligence and tracks organization names, corporate email addresses and the like in near real time.

What makes it even harder is that dark web posting venues and markets move around. CyberCrew's service page also explains that because "a forum that existed until yesterday has moved somewhere else today," tool-only investigations can miss important information. What matters in a corporate investigation is not a one-off search but continuing to track the changes.

How this differs from dark web monitoring by a specialist provider

Roughly speaking, the difference between free tools and specialist providers comes down to scope, accuracy and continuity. Free tools are handy for checking "whether this email address was included in a known leak," but they are not enough to monitor an entire company. Monitoring by a specialist provider continuously watches corporate domains, multiple keywords, related forums, chats, markets, leak sites and more, and goes as far as assessing what it finds.

An easy option to consider in between is ALIENGATE. ALIENGATE is built so that, starting from a quick email leak check, it connects readily, as needed, to leak monitoring, external asset management, vulnerability scanning, and investigation and response management. It is easy to position as an option that fills the gap between a company's initial check and full-scale continuous operations, and it is a good fit for cases where "we want to check first, but also keep the next stage of operations in view."

In particular, when a free one-off check still leaves you uneasy but you cannot yet judge whether a large-scale investigation setup is necessary, a service like this that can be expanded step by step is practical to use. The fact that the free quick check and deeper monitoring and operations can be clearly separated also makes the adoption decision easier.

CyberCrew's dark web monitoring has white-hat hackers check even the "truly dangerous information" that tools cannot fully capture, and covers everything from spot investigations to regular monitoring. If you feel you have reached the limit of checking on your own, it is more practical to judge not by "whether you can search" but by "whether you can build a setup that does not miss things."

Response flow when a leak is discovered

Even if a check shows a hit, there is no need to panic more than necessary.
What matters is to look at what leaked and act in order of priority. Doing nothing is the most dangerous option.

Immediate actions by type of leaked information

First, if a password has leaked, you should change every account where that password is reused, not just the affected account. Pwned Passwords makes clear that reusing leaked passwords is dangerous. Google also advises that if you suspect suspicious account activity, you should check Recent security events and Your devices and turn on 2-Step Verification.

If an email address has leaked, assume phishing and impersonation, and prioritize two-step verification, reviewing login history and disconnecting suspicious devices. For credit card information, contact the card issuer early and discuss suspending or replacing the card. JCB also provides guidance on temporarily suspending and replacing cards when fraudulent use is suspected. For addresses and phone numbers, you should raise your guard against scam calls, SMS and impersonation contacts.

Steps to prevent secondary damage (unauthorized access and compensation claims)

What is more frightening than the leak itself is the secondary damage that follows.
Left unaddressed, credentials can lead to unauthorized logins, email account takeovers, ransomware intrusions, harm to customers and lateral spread within the company. CrowdStrike also explains that leaked credentials are easily repurposed for follow-on attacks such as credential stuffing.

In the end, early response is what works best. Password changes, MFA, log review, card suspension, notifying the people concerned and, where necessary, coordinating with legal, PR and the CSIRT. The faster this initial response, the smaller the damage. Waiting in the hope that "someone will delete it" is dangerous.

Dark web countermeasures companies should take

Corporate countermeasures cannot rely on software alone or on rules alone.
The basic approach is to combine three things: authentication, education and monitoring.

Rigorous password management and multi-factor authentication

One of the most effective basic measures is banning password reuse and using multi-factor authentication. Google's security guidance also recommends two-step verification and passkeys. In a world where leaks have already happened, it is better to assume that the very premise of protecting accounts "with passwords alone" is shaky.

Rather than leaving it to individual employees, it is important to design operations that include deploying a password manager, standardizing MFA and cleaning up the accounts of departed employees. It only becomes meaningful once it is actually implemented, not just written into rules.

Phishing countermeasures and security education

Leaked credentials become even more dangerous when combined with phishing. CrowdStrike cites phishing, malware and keylogging among the sources of leaked information on the dark web. Employee education, targeted email drills, vigilance toward suspicious URLs and well-established reporting routes all tie into dark web countermeasures.

The people who think "I'll be fine" are often the most likely to fall for these attacks, so rather than ending with an annual training session, it is more effective to keep up short, ongoing awareness efforts. Technical measures alone will not stop leaks.

Continuous dark web monitoring

Dark web countermeasures do not end with a single search.
CrowdStrike defines dark web monitoring as "continuously searching for and tracking an organization's information," and explains that it continuously monitors corporate email addresses, company names and the like. CyberCrew, too, offers spot investigations and regular monitoring as separate services.

Spot investigations suit an initial check when a leak is suspected. Regular monitoring, on the other hand, is better suited to following day-to-day changes and new posts. The realistic way to decide which you need is by the importance of the information assets and the business impact if they leak.

To run continuous monitoring in practice, it is important to be able to handle not only discovery but also the subsequent response in one continuous flow. For example, a system like ALIENGATE, which handles leak monitoring along with external asset management, vulnerability scanning, and investigation and response management in a single flow, makes it easier to move beyond one-off checks into continuous operations.

Furthermore, a mechanism that lets you run on-demand vulnerability scans at the right moments against the websites, web applications, servers and development environments your company manages makes it easier to act concretely not only on checking for leaks but on "how to close the holes that exist right now." If you are considering continuous monitoring, it is important that checking and remediation are not disconnected.

Why you need white-hat hackers, not just tools

Tools are convenient, but the dark web keeps changing its very structure. Forums relocating, shifting phrasing, slang, misreadings of context, duplicate data, posts of unknown authenticity: these are hard to capture through automation alone. At CyberCrew, we place importance on having white-hat hackers assess information from an attacker's perspective so that genuinely concerning information is not missed.

Companies in particular have to judge not so much "whether it was out there" as "how dangerous it is" and "how far the impact reaches." That is where the value of human investigation lies.

CyberCrew's dark web monitoring and ALIENGATE

CyberCrew provides dark web monitoring in which white-hat hackers investigate and monitor leaked information on the dark web. Covering executives' passwords, corporate domains, customer information, related forums and more, we handle everything from spot investigations to regular monitoring, making it well suited to companies that want to continuously understand "how far information related to us is circulating."

Within that, ALIENGATE offers a form that is easier to put into operation. ALIENGATE is designed so that, starting from a quick email leak check, it can handle leak monitoring, external asset management, vulnerability scanning, and investigation and response management in a single flow. Its distinguishing feature is that it connects easily beyond simply knowing "whether something leaked" to the follow-up checks, response and record-keeping.

For example, even if information related to your company is found on the dark web, that is not the end of it. You need to work out the next actions too: which assets are publicly exposed, whether there are related vulnerabilities, and in what order to address them. ALIENGATE's strength is that it makes it easy to handle this practical workflow without splitting it apart.

Of course, what is available for free is mainly the quick check. If you are looking at more detailed leak information, continuous monitoring or full-scale operations at the organization level, you need to plan on using a paid plan. Still, because it connects the initial check to the operations that follow, it is an easy-to-use path for companies moving from an initial check to continuous operations.

If you find that "since Google's notifications ended, we don't know what to go by" or "we can't judge how far we need to investigate as a company," the realistic approach is to start by defining the scope. In dark web countermeasures, building a setup that does not miss things matters even more than finding things.

Frequently asked questions about the dark web

What is the dark web?

It is a highly anonymous part of the internet that is difficult to access without dedicated software or special configuration. It needs to be considered separately from the surface web, which appears in search engines, and the deep web, which requires login.

Is it illegal just to look at the dark web?

In Japan, we find no provision that uniformly prohibits viewing it in itself. However, unauthorized access, acquiring or spreading illegal data, and involvement in crime are a different matter. We also do not recommend it from a safety standpoint.

What is sold on the dark web?

Typical examples include personal information, credentials, credit card information, malware, corporate secrets, and illegal drugs and weapons. There is also legitimate anonymous communication, but there is almost no benefit for ordinary users in going near it.

Can I check whether my company's information has leaked onto the dark web?

As an initial check that individuals can do, you can use publicly available free tools and features for checking search results. If, as a company, you want to check including your own domain and business accounts, another option is to start with a business-oriented service such as ALIENGATE. On the other hand, if you want to keep continuous track as a company, it is more realistic, in terms of scope and accuracy, to plan on professional monitoring and continuous operations.

Can information leaked onto the dark web be deleted?

In general, it is hard to expect complete deletion, because posts and copies are easily moved and duplicated. Realistically, the approach is to minimize the damage through changing credentials, suspending cards, MFA, continuous monitoring and similar measures.

What is the difference between free checks for individuals and monitoring for companies?

The difference lies in scope, accuracy and continuity. Free checks are for an individual's initial check, while corporate monitoring is for continuously tracking company domains, executives, customer data and related forums.

Summary

The dark web is not simply "the scary underside of the internet."
It is one of the areas that do not appear in search, a distinct internet space built on anonymization technologies such as Tor. It has legitimate uses, but in reality it also functions as a distribution hub for stolen credentials, card information, corporate data and attack tools.

For individuals, the first steps are checking for leaks and protecting accounts. For companies, the scope needs to extend to credential management, MFA, education and continuous dark web monitoring. What matters is not approaching it out of curiosity, but finding out early and acting early so that you and your company do not become victims.

As an entry point, a service like ALIENGATE, which lets you start with a quick email check, is also effective. Because it lets you think of the free initial check separately from the continuous monitoring and operations that follow, it is an option that both individuals and companies can easily picture adopting.

CyberCrew offers dark web monitoring tailored to your needs, from one-off spot investigations to regular monthly monitoring. Because our own white-hat hackers handle the work, investigations can start as early as the same day, and we can respond flexibly to urgent cases where you "need to check right now." Contact us for a free consultation.