The
dark web uses Tor to anonymize communications. Used for: selling stolen data/credentials, ransomware-as-a-service marketplaces, hacker forums, C2 infrastructure.
Threat intelligence teams monitor dark web for mentions of your organization or leaked credentials. Dark web monitoring services alert when employee credentials appear in breach dumps.