Dark Web Threat Statistics: Key Insights for Cybersecurity

The dark web serves as a hub for cybercriminal activities, so understanding how it works and the threats that are associated with it can help to keep your organization secure. Some of the criminal activity that takes place on the dark web includes the sale of stolen data, trade of hacking tools, and planning of cyberattacks. These acts can all be a threat to organizations of all sizes, across all industries. 

By monitoring these statistics, organizations can gain valuable insights into emerging threats, identify vulnerabilities that may have already been exploited, and understand trends in cybercriminal behavior. This information enables them to take proactive measures to protect sensitive data, fortify defenses, and respond effectively to potential breaches.

Additionally, staying informed about dark web activities helps organizations to better assess their exposure, evaluate the effectiveness of their cybersecurity strategies, and meet regulatory requirements for risk management.

An Overview

• The dark web makes up about 6% of the total content on the internet.
• According to a 2022 survey by Statista, 92% of respondents have at least heard of the dark web, but only 21% considered themselves very familiar with it. 
• According to Chainalysis, the largest growing areas of crime on the dark web involve the sale of stolen and compromised personal information, exploits and botnets, and network or computer access.

Tor Network Statistics

The Tor browser is by far the most popular method for accessing the dark web, and this tool enables anonymous communication using a technique called onion routing; Tor itself stands for “The Onion Router”. This browser makes it possible to access hidden sites that use the .onion top-level domain. 

Two key terms to know are Bridges and Relay. 

A Relay (sometimes known as a node or a router, is a computer that is used to pass on encrypted traffic as part of the Tor network. A Bridge is a Tor Relay that is not publicly listed.

• For relay users, the country with the highest mean daily users is Germany at 1,090,506. This is followed by the United States with 441,448 mean daily users.
• For bridge users, the country with the highest mean daily users is Russia at 53,295. This is followed by Iran with 21,153 mean daily users.
• Tor is currently running around 8000 relays and 2000 bridges in their network. The vast majority of these servers run on Linux operating systems.
• Tor’s relays are able to sustain around 750 Gbit/s of traffic on average as of December 2024. 
• The Tor browser had an average of over 50,000 initial downloads per day in 2024. There are currently around 800k unique .onion addresses on the Tor network.

Dark Web Marketplace Statistics 

• As of 2023, the average selling price of launching a DDoS attack on an unprotected website for one month was $750.USD. 
• Additionally, “premium” malware attack services could sell for up to $4500 per 1,000 installs. 
• According to research by Trustwave’s SpiderLabs, the price of credit card information on the dark web can range between $10 and $50 depending on factors like the card’s region, credit limit, security, and whether other billing information like the CVV is included. 
• The same researchers found that access to bank accounts or crypto wallets can be purchased for prices ranging from around $200 to over $1000. These prices also account for factors like the account’s balance and how strong the corresponding bank’s fraud detection capabilities are. Social security numbers can even be bought on the dark web for $4 or less.
• The most recent Dark Web Price Index shows that cyber criminals selling illegal goods or services prefer to sell in bulk over individual items. 

Dark Web Trends For 2025 

• Notable dark web marketplaces that were taken down by authorities in 2024 include but are not limited to Rydox,Manson, and Hydra. These takedowns resulted in arrests for their respective administrators. 
• In their 2025 Key Forecasts Report, ZeroFox predicts that both prominent and aspiring cyber threat entities will be hindered by law enforcement activity and prevailing paranoia within their communities. 
• Kaspersky has reported a 135% increase in search interest for crypto-drainer malware on the dark web in 2024 compared to 2022. Due to demand, this type of threat is expected to become more common in the upcoming year.
• Throughout 2024, traffic on dark web marketplaces for drug sales has been declining in favor of either regular social media (Instagram, Snapchat, X) or encrypted messaging apps like Telegram or WhatsApp.
• Telegram is often used by cyber criminals as it provides encrypted communication, while being easier to access than most dark web sites. However, some sources like Kaspersky speculate that criminals may migrate back to the dark web due to the higher risk of bans on Telegram.

Understanding the dark web and its trends is a good way for organizations to avoid falling victim to the cybercriminal activities that take place there.

Some Expert Insight Resources on the dark web include:

• Dark Web Monitoring Buyers’ Guide 2025
• The Top 11 Dark Web Monitoring Solutions
• Exploring The Depths Of The Dark Web
• The Dark Web Vs The Deep Web: What’s The Difference?