The Mariana Web Is a Hoax. Here's What the Dark Web Really Looks Like (2026 Data)

The Mariana Web Is a Hoax. Here's What the Dark Web Really Looks Like

Somewhere below the dark web, the story goes, there's a deeper layer. It's called the Mariana web, after the deepest trench in the ocean. You can't reach it with Tor. You need a quantum computer and something called a "polymeric falcighol derivation". Down there are the Vatican's secret archives, the location of Atlantis, and whatever else you'd expect a conspiracy theory to hold.

None of it exists. The Mariana web started as a joke drawn on an iceberg, grew through image boards and YouTube, and eventually found its way into security sales pitches. It's worth tracing properly, though, because the myth hangs on real questions: what is the "dark web", how big is it, who uses it, and how does anyone get caught on it?

This piece first traces the Mariana web forensically: where it came from, how it mutated, and why each of its technical claims fails. Then it swaps the myth for data: live Tor Metrics telemetry, peer-reviewed studies, official law-enforcement records, and a defender's view of what "dark web monitoring" should mean.

Key takeaways

• The Mariana web comes from an iceberg "infographic". The canonical copy, "Another Infographic of the Ocean", was uploaded to Imgur on 1 September 2012, according to media scholar Robert W. Gehl. It's a troll, and its deepest level ends on a slur-laden punchline.
• "Polymeric falcighol derivation" returns zero results in Crossref's index of scholarly works and in arXiv. It isn't a real algorithm.
• There are no "levels" below Tor, I2P or Hyphanet. They're overlay networks that run on top of the ordinary internet.
• As of 23 September 2026, Tor Metrics counts about 9,450 relays and about 648,000 unique v3 onion addresses. That's a tiny number next to the 401.6 million registered domain names Verisign counted in Q2 2026.
• Most dark-web operators who got caught were undone by ordinary mistakes: a personal Gmail address, a Hotmail address in a welcome email, a laptop seized while unlocked. Exotic cryptanalysis played no part.

---

Part 1: Autopsy of a hoax

The ocean metaphor came first

The Mariana web borrows its imagery from a legitimate idea. In 2001, Michael K. Bergman published "The Deep Web: Surfacing Hidden Value" in the Journal of Electronic Publishing. He argued that search engines trawl only the surface of the web, while most content sits in databases that crawlers can't reach. His numbers were dramatic for the time: public information on the deep web was "400 to 550 times larger than the commonly defined World Wide Web", holding 7,500 terabytes against the surface web's 19 terabytes.

Bergman's deep web was dull in the best sense: searchable databases, dynamic pages, content behind query forms. But as Gehl notes, it set up the ocean as the metaphor for hidden information, with boats skimming the surface and submarines in the depths. Everything that followed made that metaphor spooky.

From iceberg joke to five-level "infographic" (2011–2012)

The iceberg format arrived first. Know Your Meme traces the earliest known iceberg parody of the internet to an Imgur upload dated 31 May 2011. Popular sites sat above the waterline and "deep web" content sat below. By 12 June 2012, a Redditor was posting a copy to r/4chan and asking what the "Hidden Wiki" on it was, so the images were clearly circulating on 4chan by then.

The Mariana web's own birth certificate is harder to pin down. Researcher Robert W. Gehl's chapter "On the Cultural Power of the 'Marianas Web' Meme" dates the canonical graphic, titled "Another Infographic of the Ocean...", to an Imgur upload on 1 September 2012. It laid out five levels:

• Level 1, the "Common Web".
• Level 2, with "Google locked results" and "FTP servers".
• Level 3, with "sex tapes", "hackers" and "Mathmatics [sic] research".
• Level 4, the "Charter Web", promising "Personal Records", "Banned Books" and, behind a "Closed Shell System", "Tesla Experiment Plans" and the "Location of Atlantis".
• Level 5, the Mariana web itself, whose caption is an insult aimed at the reader. Gehl flags that line as a textbook trolling marker.

The graphic also claimed that "80% of the Internet exists below this line", then quietly hedged that this meant "80% of the information that effects [sic] you directly". Circulating versions of the chart also attach a pseudo-technical entry requirement to the bottom tier, a "polymeric falcighol derivation", explained in a caption that's now quoted everywhere:

"…you need to solve quantum mechanics in order to view this on even the normal web, let alone closed servers. Quantum Computation exists, and the government powers have them. So be careful what you do here."

That line carries the whole mythology: some secret technology exists, the government has it, and you don't.

A forensic note: popular retellings say "it came from 4chan". The documentary record doesn't fully support that. The earliest dated copies sit on Imgur. One widely cited Skeptics Stack Exchange answer dropped its own 4chan attribution after it couldn't find supporting evidence. Some amateur trackers claim sightings as early as late 2011, but we couldn't verify a dated copy older than Gehl's September 2012 reference.

Mutations: eight levels (2014 onward)

Hoaxes mutate as they spread. A later chart, "Levels of the Deep Web", was uploaded to Imgur on 10 January 2014, and the Internet Archive captured it four days later. Expanded versions stretched the iceberg to eight levels. Gehl reads the meme's staying power as an answer to "post-truth" anxiety: if the internet is layered and infinite, the truth must be down there somewhere.

The YouTube amplifier

Image boards gave the myth its start and YouTube made it big. A YouTube search for "marianas web" on 26 September 2026 surfaced these videos, among others:

Those five videos alone have about 9.2 million views. Several frame the Mariana web as unproven rather than fictional, and that hedge is how the myth survives. In October 2018, a Skeptics Stack Exchange question quoted The Infographics Show video saying "there is no concrete evidence that clearly proves or disproves its existence."

By 2025 the myth had crossed into fiction. The Marianas Web, a science-fiction horror film directed by Marco Calvise, was released in the Philippines on 15 October 2025.

When the joke reaches the security industry

A hoax that stays on image boards is harmless. This one escaped. In December 2015, Violet Blue wrote in Engadget that she had heard first-hand of infosec clients asking for threat-intelligence packages to include the Mariana web. She called the graphic "an epic troll that people have interpreted as fact." Gehl traces the same thinking into consumer "dark web scan" marketing that uses the iceberg model to sell fear.

That's the practical reason to debunk it. Buyers who believe in the Mariana web will pay for coverage of a place that doesn't exist.

---

Part 2: Why every Mariana claim fails technically

"You need a quantum computer to access it"

Networks don't gate access by what kind of processor you own. To reach any service, whether on the clearnet, Tor, I2P or Hyphanet, you need three things: a route to it, the protocol it speaks, and any keys it requires. A quantum computer adds none of those.

The real relationship between quantum computing and the dark web runs the opposite way from the myth. Quantum computers are a potential threat to the public-key cryptography that anonymity networks rely on, not a key to hidden layers. Tor's v3 onion services use ed25519 and curve25519, both classical elliptic-curve schemes. That's why NIST finalised its first three post-quantum encryption standards in August 2024, "designed to withstand the attack of a quantum computer." If quantum computing touches the dark web at all, the likely effect is to weaken it.

"Polymeric falcighol derivation"

On 26 September 2026 we queried the Crossref scholarly index and arXiv for "falcighol". Both returned zero results. The term appears in no paper, patent family or standard we could find. It lives only in meme text, Urban Dictionary-style entries and wikis that repeat them. RationalWiki files it under "quantum woo", and Gehl uses the same frame.

"Levels" and "closed shell systems"

The internet has layers in the protocol sense: physical, link, IP, transport, application. It has no layers in the depth sense. Tor's own documentation describes onion services as "an overlay network on top of TCP/IP". I2P and Hyphanet are overlays too. Each one is a different set of rules for sending packets over the same cables. None of them sits "below" another, and nothing sits below all of them. As Gehl puts it after years of participant observation on dark-web social networks, there are "no layers 'deeper' than Tor (or Freenet, or I2P)." "Closed Shell System" is not a term of art in networking or operating systems. It's decoration.

Private networks do exist (intranets, air-gapped and classified systems), but they're separate from the internet, not deeper, and you get in with authorisation, not a secret algorithm.

"80% of the internet is down there"

The 80% figure is a garbled echo of Bergman's deep-web estimate, which was about databases and dynamic pages. It was never about hidden criminal layers. The actual dark web is small. As of 23 September 2026, Tor Metrics estimated about 648,000 unique v3 onion addresses. Verisign counted 401.6 million registered domain names at the end of Q2 2026. Even taken at face value, the onion address count is under 0.2% of that. It's also generous to the dark web, because many onion addresses aren't websites at all (more on that below).

---

Myth vs. fact: surface web, deep web, dark web

---

Part 3: How Tor actually works (high level)

Onion routing in one paragraph

A Tor client routes traffic through three volunteer relays (guard, middle, exit), wrapped in one encryption layer per hop. Each relay peels off its layer and learns only its neighbours: the guard knows who you are but not where you're going, and the exit knows the destination but not the sender. No single relay sees both ends. That's the core property, and the core weakness: an adversary watching both ends can try to correlate them (see Part 7).

Onion services (v3): introduction points, HSDirs and rendezvous

Onion services turn this around so the server is hidden too. Per the Tor Project's documentation and the v3 rendezvous specification:

1. Introduction points. The service builds anonymous circuits to a few relays and asks them to act as its introduction points.
2. Descriptors and HSDirs. The service signs a descriptor that lists its introduction points and uploads it to a set of hidden service directories (HSDirs), relays arranged in a distributed hash ring.
3. The address is the key. A v3 .onion address is 56 characters long because it encodes the service's full ed25519 public key. When a client fetches the descriptor, it checks the signature against that key. Tor calls this end-to-end authentication: nobody else can impersonate the address.
4. Rendezvous. The client picks a random relay as a rendezvous point, hands it a one-time secret, and sends an introduction request through one of the service's introduction points. The service then builds its own circuit to the rendezvous point, and the two circuits are joined.
5. The finished connection spans six relays: three chosen by the client (the third is the rendezvous point) and three chosen by the service.

Why v3 made the dark web harder to count, and harder to snoop on

The older v2 protocol used an 80-bit truncated SHA-1 hash of a 1024-bit RSA key. In 2013, Biryukov and colleagues collected 39,824 hidden-service descriptors in a single day "by exploiting protocol and implementation flaws in Tor". v3 (first supported in Tor 0.3.2.9 on 9 January 2018, with v2 retired from October 2021 under the Tor Project's published timeline) closed that door:

• Descriptors are signed with blinded keys that change every time period, and their positions on the HSDir hash ring are reshuffled using a random value the directory authorities generate together.
• The descriptor body can only be decrypted by someone who already knows the onion address. The spec notes this makes descriptors "unusable by entities without that knowledge (e.g. HSDirs that don't know the onion address)."

In practice, a directory relay can no longer harvest a list of onion services. That's why every modern onion count is a privacy-preserving statistical estimate, not a census.

---

Part 4: The real dark web, by the numbers (Tor Metrics, September 2026)

All figures below were retrieved from Tor Metrics' public CSV exports on 26 September 2026 (IST) and cover data through 23 September 2026.

How to read these numbers honestly:

• User counts are estimates, not headcounts. Tor Metrics derives them "by analyzing the requests induced by clients to relays and bridges". The series is volatile: it hit about 19.4 million on 2 September 2025 and swung wildly through late 2025 before settling around 3–4 million. Tor Metrics doesn't give a cause for those spikes and we don't guess one. Never quote a single day as "Tor's user base".
• Onion addresses aren't websites. Tools such as OnionShare publish a local web server "as Tor onion services", often for a single file transfer, and Owen and Savage (2015) found most onion services were short-lived. The 648,000 figure includes an unknown but large share of ephemeral or machine-to-machine endpoints.
• Traffic share. Tor Metrics doesn't publish a current "percentage of Tor traffic that goes to onion services", and the two series above aren't directly comparable, because relays count each byte at every hop. The best official estimate is still the Tor Project's 2015 figure: about 3.4% of client traffic (6.1% as seen at relays). What we can say from current data is that onion-service traffic has nearly doubled since 2022, from an annual median of 8.6 Gbit/s to 15.6 Gbit/s in 2025, while total relay throughput sits in the hundreds of Gbit/s.
• Bridges track censorship. Bridge usage is up about 70% on its 2025 median. Tor Metrics' own event log records an "Internet shutdown in Iran" from 28 February 2026 as ongoing. In a place like that, onion routing isn't the dark web. It's how people get online at all.

---

Part 5: Beyond Tor: I2P and Hyphanet

• I2P (the Invisible Internet Project) uses unidirectional tunnels (separate outbound and inbound paths), bundles messages into encrypted "garlic" packets, and relies on a self-organising distributed database instead of central directory authorities. In the project's words, "Tor works towards offering high speed anonymous Internet outproxying, while I2P works towards offering a decentralized resilient network in itself."
• Hyphanet (formerly Freenet) is a distributed, encrypted data store. Nodes donate disk space to cache encrypted chunks, and rarely requested content ages out. Its friend-to-friend "darknet" mode predates the popular use of the word, the project says. Started around July 1999, it became Hyphanet in 2023, when founder Ian Clarke gave the Freenet name to a new, unrelated project.

All three are parallel overlays. None of them unlocks a secret level.

---

Part 6: What researchers found inside

Measurement studies differ in methods, dates and definitions, but their broad findings are consistent, and far less cinematic than the iceberg.

• Biryukov, Pustogarov, Thill & Weinmann (2013/2014). Collected 39,824 descriptors on 4 February 2013 by exploiting v2 flaws, which v3 later closed. Content was "rather varied", but "the most popular hidden services are related to botnets."
• Owen & Savage (2015), GCIG Paper No. 20. Ran relays for six months and saw an average of 45,000 active onion services (80,000 unique over the study). Sites classified as child abuse made up about 2% of services but received more than 80% of directory requests. The authors caution that law-enforcement crawling and denial-of-service activity could inflate those request figures.
• Soska & Christin (2015), USENIX Security. Tracked 16 anonymous marketplaces from 2013 to 2015. They found the Silk Road takedown "spawned an entire, dynamic, online anonymous marketplace ecosystem", and studied the "effect (or lack thereof)" of law-enforcement operations on the overall economy.
• Moore & Rid (2016), "Cryptopolitik and the Darknet", Survival 58(1). Found 5,205 live sites and classified 2,723 with high confidence. Coverage of the paper's results reports that 1,547 (about 57%) hosted illicit material, with drugs the single most common commodity. Their most useful finding for defenders: legitimate onion sites "almost always chose to identify their operators", while illicit ones almost never did.

In short, onion services carry a disproportionate share of illicit activity compared with the open web, but the ecosystem is small, churning and heavily policed, and it hosts legitimate services too.

---

Part 7: Takedowns, and how anonymity actually breaks

A decade of dark-market enforcement

Opsec failures: the most common way people get caught

The Silk Road case is the classic. IRS Special Agent Gary Alford testified in January 2015 that in 2013 he searched for early mentions of Silk Road dated before its launch. He found a user called "altoid" promoting it on bitcointalk.org and shroomery.org. The same user later posted a job ad asking applicants to email rossulbricht at gmail dot com. No cryptography was broken. Someone joined the dots between a pseudonym and a real name.

AlphaBay repeated the pattern. According to the civil forfeiture complaint reported by Ars Technica, the site's early welcome emails carried pimp_alex_91@hotmail.com in their headers. Canadian authorities linked that address to Alexandre Cazes, born in 1991. When Thai police arrested him, his laptop was found open, unencrypted, and logged in as "Admin", with text files listing passwords for the site and its servers.

Infiltration and takeover

In the Hansa case, investigators took over the platform itself. The Dutch NHTCU told WIRED it altered the site's code to collect more identifying information and tricked dozens of vendors into opening a beacon file that revealed their locations. Of Genesis Market, DOJ said it "falsely promised a new age of anonymity and impunity."

Follow the money

Several of the official releases above credit financial tracing: DEA "followed the money" in Silk Road, and IRS-CI is credited in AlphaBay and Hydra. In the Hydra case, IRS Criminal Investigation said its Cyber Crimes Unit "once again used their cryptocurrency tracking expertise". Blockchains are public ledgers, and an exchange account with KYC details can connect a pseudonymous wallet to a real person.

Traffic correlation: the research threat

The Tor Project openly acknowledges that an adversary who observes both ends of a circuit can try to correlate traffic. In 2013, Johnson et al. (ACM CCS) modelled realistic adversaries and found that "80% of all types of users may be deanonymized by a relatively moderate Tor-relay adversary within six months." In July 2014, the Tor Project disclosed that a group of relays had run a "relay early" traffic-confirmation attack from 30 January to 4 July 2014, and warned that anyone who operated or accessed onion services in that window should assume they were affected. Its advisory adds that "the general class of passive (statistical) traffic confirmation attacks remains unsolved."

The lesson isn't that "Tor is broken". It raises the cost of surveillance a great deal, but it isn't magic. The court records never mention quantum super-weapons. They're full of human error, seized servers and ledgers.

---

Part 8: The legitimate dark web

The same technology protects people doing nothing wrong, many of whom have a lot to lose.

• Facebook launched an onion service in October 2014. By April 2016 it said more than one million people were using it over Tor in a month, up from about 525,000 in June 2015.
• The BBC made its international news site available as a Tor onion service on 23 October 2019, including BBC Arabic, Persian and Russian. It cited attempts by countries including China, Iran and Vietnam to block its news.
• The New York Times launched an onion service on 27 October 2017 and shut it down in an update dated 4 March 2025, pointing readers in blocked regions to WhatsApp and Telegram. Onion sites are one circumvention tool among several, not a permanent fixture.
• SecureDrop, an open-source whistleblower submission system built on onion services, is run by newsrooms including Der Spiegel, the Financial Times, CBC, Bloomberg News and Forbes, according to its public directory.
• OnionShare lets anyone share files or host a temporary site directly from their own computer as an onion service, with end-to-end encryption and no third-party server.
• Bridges keep people online during shutdowns. See Tor Metrics' log of the 2026 Iran shutdown.

Moore and Rid's observation is worth repeating: legitimate onion operators usually identify themselves. They use onion services for security and reach, not to avoid accountability.

---

Part 9: For defenders: dark web monitoring without the mythology

Security teams have real reasons to watch these ecosystems: staff credentials in infostealer dumps, access brokers listing your VPN, leak sites naming your suppliers. Here's how to do it legally and usefully.

1. Know the legal boundaries first

The U.S. Department of Justice's Cybersecurity Unit published Legal Considerations when Gathering Online Cyber Threat Intelligence and Purchasing Data from Illicit Sources (Version 1.0, February 2020). Its core distinctions are worth building into policy even outside the U.S.:

• Passively collecting intelligence from forums you access through their intended means is very different from gaining access through unauthorised means, such as stolen credentials or exploits.
• Impersonating real people or officials, or soliciting or assisting criminal activity (even to build credibility), can create exposure, including aiding-and-abetting or conspiracy liability.
• Buying stolen data, even your own, carries legal, ethical and practical risks: you may fund criminals, get scammed, or receive booby-trapped files.

Write that into rules of engagement, involve counsel, and keep analysts off personal devices and accounts. Our OSINT for Beginners 2026: A Legal, Ethics-First Methodology covers the same principles for open-source work.

2. Monitor the right things

• Brand and domain abuse: look-alike domains, phishing kits and executive impersonation. Most of this happens on the clear web and messaging platforms.
• Credential and session exposure: employee and customer credentials in breach corpora and infostealer logs. Genesis Market is a warning here. It sold cookies and device fingerprints alongside passwords, which let buyers impersonate a victim's session, so password resets alone don't fix the problem. Revoke sessions and tokens too.
• Initial-access and data-leak listings that name your organisation, subsidiaries or key suppliers.
• Leak-site claims: treat a ransomware leak-site listing as an unverified claim until incident response confirms it. Extortion claims can be inaccurate or inflated.

3. What credential-leak monitoring looks like, conceptually

Good credential monitoring checks for compromise without spreading secrets further:

• k-Anonymity lookups. Have I Been Pwned's Pwned Passwords API (2018) lets you check a password by sending only the first 5 characters of its SHA-1 hash. The service returns every matching suffix and your side does the comparison, so the full hash never leaves your system.
• Blocklists at the point of password creation. NIST SP 800-63B-4 requires verifiers to "compare the prospective secret against a blocklist that contains known commonly used, expected, or compromised passwords."
• Domain-scoped breach alerts for accounts on the email domains you own, routed into identity workflows: forced reset, session revocation, MFA re-enrolment.
• Evidence handling: store hashes and metadata, not plaintext dumps, and set retention limits.

4. Red flags when buying "dark web monitoring"

• The vendor mentions "Mariana web", "levels 5–8" or "quantum access". Walk away.
• They claim to "see the whole dark web". v3 onion services can't be enumerated from the directory layer, so full coverage isn't possible.
• They can't explain their collection methods and legal basis, or say they "buy back" data as standard practice.
• Every alert is urgent and none are verified. Ask for true-positive rates and the evidence behind them.

---

FAQ

Is the Mariana web real? No. It started as a trolling "infographic". The canonical version was uploaded to Imgur in September 2012, and it later spread through expanded charts and YouTube videos. It has no technical basis, and its "polymeric falcighol derivation" doesn't appear in any scholarly index.

What's the difference between the deep web and the dark web? The deep web is anything search engines don't index: email, banking, paywalled and logged-in content. The dark web is the small set of services reachable only through anonymity overlays such as Tor onion services, I2P or Hyphanet.

How big is the dark web in 2026? Tor Metrics estimated about 648,000 unique v3 onion addresses on 23 September 2026, many of them ephemeral or non-web endpoints, carried by about 9,450 volunteer relays. For comparison, there were 401.6 million registered domain names in Q2 2026.

Is using Tor illegal? In most countries, no. The BBC and Facebook have run official onion sites, and newsrooms use Tor-based SecureDrop. Some governments block Tor, which is why bridges exist. Check your local law.

How do people get caught on the dark web? In the major cases, mostly through opsec mistakes (personal email addresses tied to pseudonyms, unlocked devices), undercover takeovers and cryptocurrency tracing. Traffic correlation is a real research threat, but human error dominates the court records.

Do quantum computers let you access hidden parts of the internet? No. Network access depends on routes, protocols and keys, not processor type. Quantum computing matters to the dark web mainly as a future threat to its cryptography, which is why post-quantum standards exist.

Should my company pay for dark web monitoring? Yes, if it's scoped to your real exposure (credentials, sessions, brand, access listings, leak-site claims), collected lawfully, and backed by verifiable evidence. Be sceptical of anyone promising "full dark web coverage".

---

Closing: the myth to watch next

The Mariana web lasted because it answered a feeling rather than a fact: the sense that the truth is always one layer deeper. The real dark web is smaller, more measurable and more human. Its operators are caught by their own habits, its best-documented legitimate users include newsrooms and people under censorship, and its size fits in a CSV file anyone can download.

At AndraxPentester we spend most of our research time on the next frontier of that same problem: how trust, identity and hidden instructions work in the agentic era, where AI agents act on text they can't verify. If that interests you, start with our MCP security guide.

---

References

1. Bergman, M. K. (2001). "White Paper: The Deep Web: Surfacing Hidden Value." Journal of Electronic Publishing 7(1). https://quod.lib.umich.edu/j/jep/3336451.0007.104?view=text;rgn=main
2. Gehl, R. W. (2019). "On the Cultural Power of the 'Marianas Web' Meme." In D. Arditi & J. Miller (Eds.), The Dialectic of Digital Culture (pp. 115–132). Lexington Books. https://doi.org/10.5771/9781498589871 (author's preprint: https://works.hcommons.org/records/t9m0v-fy310)
3. Know Your Meme. "Iceberg Charts." https://knowyourmeme.com/memes/iceberg-charts
4. Skeptics Stack Exchange. "Is there any evidence of a secret level of deeply-hidden web-pages called 'Marianas Web'?" (2018). https://skeptics.stackexchange.com/questions/42621/is-there-any-evidence-of-a-secret-level-of-deeply-hidden-web-pages-called-maria
5. Internet Archive capture of "Levels of the Deep Web" (Imgur), 14 Jan 2014. https://web.archive.org/web/20140114151219/http://imgur.com:80/mEVm4hm
6. Blue, V. (18 Dec 2015). "The myth of Mariana's Web, the darkest corner of the internet." Engadget. https://www.engadget.com/2015-12-18-the-myth-of-marianas-web-the-darkest-corner-of-the-internet.html
7. RationalWiki (mirror). "Polymeric falcighol derivation." https://a.osmarks.net/content/rationalwiki_en_all_maxi_2021-03/A/Polymeric_falcighol_derivation
8. Crossref API query for "falcighol" (0 results, 26 Sep 2026). https://api.crossref.org/works?query=falcighol&rows=3
9. arXiv API query for "falcighol" (0 results, 26 Sep 2026). https://export.arxiv.org/api/query?search_query=all:falcighol&max_results=5
10. The Infographics Show (9 Jun 2018). "Marianas Web - The Scariest Part Of The Internet." YouTube. https://www.youtube.com/watch?v=4h-0utowC5E
11. FING (31 Jan 2022). "UNSOLVED MYSTERY OF THE MARIANA WEB." YouTube. https://www.youtube.com/watch?v=uadwG6rYCYI
12. Jaydone History (15 May 2025). "Every Layer of the Internet Explained." YouTube. https://www.youtube.com/watch?v=drDc01L_BsU
13. Alchemy Explainer (9 Nov 2024). "Every Level of Internet Explained in 7 Minutes." YouTube. https://www.youtube.com/watch?v=xZ329Sgp9u4
14. Takedownman (24 Jun 2015). "The Hidden Internet- Marianas web." YouTube. https://www.youtube.com/watch?v=FEojOrVzBrk
15. Wikipedia. "The Marianas Web" (2025 film). https://en.wikipedia.org/wiki/The_Marianas_Web
16. NIST (Aug 2024). "NIST Releases First 3 Finalized Post-Quantum Encryption Standards." https://www.nist.gov/news-events/news/2024/08/nist-releases-first-3-finalized-post-quantum-encryption-standards
17. Verisign. "The DNIB Quarterly Report Q2 2026." https://www.dnib.com/
18. Tor Project. "How do Onion Services work?" https://community.torproject.org/onion-services/overview/
19. Tor Project. Rendezvous Specification v3: overview and protocol overview. https://spec.torproject.org/rend-spec/overview.html and https://spec.torproject.org/rend-spec/protocol-overview.html
20. Tor Project blog (2 Jul 2020). "Onion Service version 2 deprecation timeline." https://blog.torproject.org/v2-deprecation-timeline/
21. Tor Project blog (26 Feb 2015). "Some statistics about onions." https://blog.torproject.org/some-statistics-about-onions/
22. Tor Metrics CSV exports (retrieved 26 Sep 2026): relays and bridges https://metrics.torproject.org/networksize.csv · relay users https://metrics.torproject.org/userstats-relay-country.csv · bridge users https://metrics.torproject.org/userstats-bridge-country.csv · v3 onions https://metrics.torproject.org/hidserv-dir-v3-onions-seen.csv · v3 onion traffic https://metrics.torproject.org/hidserv-rend-v3-relayed-cells.csv · bandwidth https://metrics.torproject.org/bandwidth.csv
23. Tor Metrics. "Users" (methodology and events log). https://metrics.torproject.org/userstats-relay-country.html
24. Tor Metrics. "Onion Services" (traffic methodology). https://metrics.torproject.org/hidserv-rend-v3-relayed-cells.html
25. OnionShare documentation. "How OnionShare Works." https://docs.onionshare.org/2.6/en/features.html
26. I2P. "Intro." https://geti2p.net/en/about/intro
27. Hyphanet. "About." https://www.hyphanet.org/pages/about.html
28. Biryukov, A., Pustogarov, I., Thill, F., & Weinmann, R.-P. "Content and popularity analysis of Tor hidden services." arXiv:1308.6768. https://arxiv.org/abs/1308.6768
29. Owen, G., & Savage, N. (30 Sep 2015). The Tor Dark Net. GCIG Paper No. 20, CIGI. https://www.cigionline.org/publications/tor-dark-net/
30. Soska, K., & Christin, N. (2015). "Measuring the Longitudinal Evolution of the Online Anonymous Marketplace Ecosystem." USENIX Security '15. https://www.usenix.org/conference/usenixsecurity15/technical-sessions/presentation/soska
31. Moore, D., & Rid, T. (2016). "Cryptopolitik and the Darknet." Survival 58(1). https://www.tandfonline.com/doi/full/10.1080/00396338.2016.1142085
32. TweakTown (2016). "Research reveals 57% of dark web is illicit material" (coverage of Moore & Rid). https://www.tweaktown.com/news/50165/research-reveals-57-dark-web-illicit-material/index.html
33. Johnson, A., Wacek, C., Jansen, R., Sherr, M., & Syverson, P. (2013). "Users Get Routed: Traffic Correlation on Tor by Realistic Adversaries." ACM CCS 2013. https://www.ohmygodel.com/publications/usersrouted-ccs13.pdf
34. Tor Project blog (30 Jul 2014). "Tor security advisory: 'relay early' traffic confirmation attack." https://blog.torproject.org/tor-security-advisory-relay-early-traffic-confirmation-attack/
35. U.S. Attorney's Office SDNY (25 Oct 2013). Seizure of additional Silk Road bitcoins / arrest details (archived). https://web.archive.org/web/2025/https://www.justice.gov/usao-sdny/pr/manhattan-us-attorney-announces-seizure-additional-28-million-worth-bitcoins-belonging
36. U.S. Attorney's Office SDNY (29 May 2015). "Ross Ulbricht… Sentenced… To Life In Prison" (archived). https://web.archive.org/web/2024/https://www.justice.gov/usao-sdny/pr/ross-ulbricht-aka-dread-pirate-roberts-sentenced-manhattan-federal-court-life-prison
37. AP News (21 Jan 2025). "Trump pardons founder of Silk Road website." https://apnews.com/article/donald-trump-silk-road-f7eb0d48c106ff88a33a2e459a36c583
38. Ars Technica (Jan 2015). "The incredibly simple story of how the gov't Googled Ross Ulbricht." https://arstechnica.com/tech-policy/2015/01/the-incredibly-simple-story-of-how-the-govt-googled-ross-ulbricht/
39. U.S. DOJ (20 Jul 2017). "AlphaBay, the Largest Online 'Dark Market,' Shut Down" (archived). https://web.archive.org/web/2025/https://www.justice.gov/opa/pr/alphabay-largest-online-dark-market-shut-down
40. Ars Technica (20 Jul 2017). "DOJ announces official takedown of AlphaBay, world's largest Dark Web market." https://arstechnica.com/tech-policy/2017/07/doj-announces-official-takedown-of-alphabay-worlds-largest-dark-web-market/
41. Greenberg, A. (8 Mar 2018). "Operation Bayonet: Inside the Sting That Hijacked an Entire Dark Web Drug Market." WIRED. https://www.wired.com/story/hansa-dutch-police-sting-operation/
42. U.S. DOJ (5 Apr 2022). "Justice Department Investigation Leads to Shutdown of Largest Online Darknet Marketplace" (archived). https://web.archive.org/web/2025/https://www.justice.gov/opa/pr/justice-department-investigation-leads-shutdown-largest-online-darknet-marketplace
43. U.S. DOJ (5 Apr 2023). "Criminal Marketplace Disrupted in International Cyber Operation" (archived). https://web.archive.org/web/2025/https://www.justice.gov/opa/pr/criminal-marketplace-disrupted-international-cyber-operation
44. U.S. DOJ (20 Feb 2024). "U.S. and U.K. Disrupt LockBit Ransomware Variant" (archived). https://web.archive.org/web/2025/https://www.justice.gov/opa/pr/us-and-uk-disrupt-lockbit-ransomware-variant
45. Tor Project blog (31 Oct 2014). "Facebook, hidden services, and https certs." https://blog.torproject.org/facebook-hidden-services-and-https-certs/
46. TechCrunch (22 Apr 2016). "Facebook usage over Tor passes 1M per month." https://techcrunch.com/2016/04/22/facebook-usage-over-tor-passes-1m-per-month/
47. BBC News (23 Oct 2019). "BBC News launches 'dark web' Tor mirror." https://www.bbc.com/news/technology-50150981
48. Sandvik, R. (27 Oct 2017; updated 4 Mar 2025). "The New York Times is Now Available as a Tor Onion Service." NYT Open. https://open.nytimes.com/https-open-nytimes-com-the-new-york-times-as-a-tor-onion-service-e0d0b67b7482
49. SecureDrop. Directory. https://securedrop.org/directory/
50. U.S. DOJ CCIPS Cybersecurity Unit (Feb 2020). Legal Considerations when Gathering Online Cyber Threat Intelligence and Purchasing Data from Illicit Sources, v1.0 (archived PDF). https://web.archive.org/web/2024/https://www.justice.gov/criminal-ccips/page/file/1252341/download
51. Hunt, T. (22 Feb 2018). "I've Just Launched 'Pwned Passwords' V2 With Half a Billion Passwords for Download." https://www.troyhunt.com/ive-just-launched-pwned-passwords-version-2/
52. NIST. SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management. https://pages.nist.gov/800-63-4/sp800-63b.html