## The Iceberg Analogy is Broken When discussing the internet, the "iceberg" analogy is often used: the visible tip is the Surface Web, the submerged mass is the Deep Web, and the dark abyss at the very bottom is the Dark Web. While visually appealing, this analogy often confuses two entirely different concepts: indexability and accessibility. ## The Deep Web: Unindexed, Not Illicit The Deep Web is simply any part of the internet that standard search engines (like Google or Bing) cannot index. This isn't inherently malicious or secretive. If you log into your online banking portal, your inbox, or a corporate intranet, you are on the Deep Web. It accounts for the vast majority of the internet's data. It is hidden behind paywalls, login screens, or dynamic database queries. Search engine crawlers are designed to follow public links, so they bounce off these barriers. ## The Dark Web: Intentionally Obfuscated The Dark Web, however, is a tiny fraction of the Deep Web that has been intentionally hidden using overlay networks. You cannot access it with a standard browser like Chrome or Safari. Access requires specialized software, most commonly the Tor Browser (The Onion Router) or I2P (Invisible Internet Project). These networks encrypt traffic in multiple layers and route it through a series of randomized nodes across the globe. This obfuscates both the location of the user and the location of the server hosting the website. Dark Web domains don't end in `.com` or `.org`; on Tor, they end in `.onion`. ## Why the Distinction Matters for CTI For a Threat Intelligence team, precision in terminology matters because collection methodologies differ drastically. Monitoring the Deep Web involves building authenticated scrapers for private forums or connecting to secure APIs. Monitoring the Dark Web requires maintaining a secure, anonymous footprint on Tor, bypassing anti-bot challenges designed to keep automated scrapers out, and navigating a volatile landscape where `.onion` sites frequently change addresses or go offline. At Aarvi, our engine handles both, but we categorize them distinctly. When we alert you to a credential leak, it is vital to know if it was found in an open (but unindexed) Pastebin dump or being actively traded on a locked-down Russian-language Dark Web marketplace.
