Culture

Business websites

.com

Brand protection

Online stores

Hosting

Data privacy

Policy-making

Registrars

Investing & reporting

Internet Basics Series

How to

People

Cybersecurity

Web trends

Tech news

Security

COVID-19

Technology detection

domains

Software

WordPress

TLDs

GDPR

Loura Kruger-Zwart

Despite feeling like the behind-the-scenes web is inaccessible to most, you’ll be pleased to know that the internet is not magic: there’s a reason and explanation for everything, and while technical, it’s not always as complicated as it might seem. One thing that brings the hypercomplex aura of the internet back down to earth is the quirky, low-tech side of what makes it work—there really are some things computers and algorithms just cannot do. 

Let’s consider randomness: as human beings, with complex thought patterns and a penchant for unpredictability, we can be random. We could pick a number between 1 and 1,000 for no reason besides it feeling ‘random,’ and follow that up with another entirely random number, so that even we ourselves don’t know which choice we’ll make next. That said, humans are not flawless randomizers, as we can quickly descend into creating patterns or memorable combinations. Computers, on the other hand, cannot be random—it is genuinely impossible. They can simulate randomness, of course, like an online dice roller or random number generator does, and it can seem more or less random to us as the receiver of information. 

This randomness-aversion also appears in other ways. When was the last time you felt your Spotify playlist was well and truly ‘shuffled’?  While it’s true that the platform’s ‘automix’ features give preference to similar sounding songs and your recent listening history, some songs will never come up because there is often no ‘true shuffle’ on algorithm-based platforms like Spotify. This is called psuedorandomness, and yes, for the most part, it is ‘random enough’ for the purposes we need on the user-end. But the computer will always know what comes next: the sequence of results is always calculated, always predetermined. 

Why is randomness important for security?

For low-stakes things like song play orders or random number generators, the lack of true randomness is not a big deal. As long as it seems random to us as humans, the mission has been accomplished.

The real issue arises when considering (online) security and computer to computer (and other M2M) communication. Much of our online experience is encrypted: consider the padlock in your browser bar, indicating SSL status, or how much time you spend ‘logged in’ on social media, email, or e-commerce sites. And much of our online experience must be encrypted to keep us safe as we share personal data like contact information, photographs, payment details, and other confidential kinds of records. Online security is based on keys, which rely on randomness and undecipherability to ensure unpredictability—if a computer and malicious actor can predict or decipher the key, it cannot be secure. Strong, unique numbers are crucial for this, as they become the secure encryption keys for wifi passwords, SSH and SSL certificates, and more.

Let’s take a look at the data: the Secure Hash Algorithm (SHA) in SSL certificates refers to cryptographic hash functions used in the digital signatures (keys) of these certificates. The functions are essential for ensuring data integrity and authenticity in SSL/TLS communications. In essence, generating an SHA hash involves processing the input data—like a prime or truly random number—through a series of mathematical operations—like multiplying by another prime or random number—to produce an output that uniquely, securely represents the original input. Figure 1 shows the four more-used SHA types for .com domains in our database.


So, if humans are not effective randomizers, and computers cannot be random, how does online security work? This is where the low-tech internet shines: it utilizes the true randomness of the outside world and the physical things around us to ‘seed’ randomness. An excellent example of this is IT management services company Cloudflare and their lava lamps. Referring to their lamp wall, cryptographer Nick Sullivan explains that it's the photographing of the lava bubbles, the room’s light ambience, (white) noise levels, and a number of other—completely offline—factors that form the basis for solid internet encryption capabilities. Their branch in London uses a ‘chaotic pendulum,’ and the Singapore office tracks the decay of radioactive isotopes to derive randomness for encryption keys. Digital security companies use multiple sources and layers to introduce randomness in their security.  

The mentioned examples are physical sources of entropy, which means they produce randomness in a physically observable manner. Other sources of entropy are just as useful. Thermal noise can be tracked to harness randomness from the hums and jitters in electronic circuits, and Quantum Random Number Generators (QRNGs) are devices that leverage quantum phenomena, such as the behavior of photons, to produce truly random numbers. When operating systems collect entropy from various sources (like mouse movements, keyboard timings, or system events) this is called Software-Based Randomness, which relates to the randomness that can be generated by human-device interaction. User-generated entropy is also a popular contribution to encryption, as Tom Scott explains: personal computers can use the milliseconds between clicks, or smartphones can use movement and tilt data to generate randomness. 

These methods highlight the importance of both physical and digital randomness in maintaining security protocols across the internet. Each method has both strengths and weaknesses, and it’s often a combination of these techniques that get employed to ensure high-quality randomness. These low-tech solutions solve incredibly high-tech problems, and help us understand how the internet works just a little better. ‘Low-tech’ should not imply that the solutions are simple or effortless, but rather that they are graspable for those outside the industry, too.


Low-tech solutions for high-tech problems

Barcelona, ES: this solar internet project is a solar-powered website and magazine, created by Belgian author Kris de Decker. It focuses on and explores the sustainability of technology, reduction of (power) consumption, and prioritization of low-tech solutions to socially constructed high-tech problems. Its solar base is in Spain, where the good weather helps to keep it online, but the site gives its visitors the heads-up that it may be down when the weather has been bad. Take a look at the website to learn about dithered images, technological sustainability, using history to inform our futures. 

This article is part of the Modern Internet series, where we dive into today's digital culture and the online landscape. Check out Internet Nostalgia, for a head start on finding great spaces to hang out online, or GenAI Transparency to learn about maintaining the Living Internet. Keep an eye out for our upcoming piece on the rise of mini-games where they're least expected, and later, the consequences of digital hoarding.

Tech

Everything to do with the internet is entirely technical, complex, and shrouded in esoteric jargon—right? Sometimes it seems like you have to be an expert to understand what’s happening out there. While there are plenty of ultramodern things about the web, the low-tech internet is what helps keep us safe on our digital escapades. Read on and dive into the high-tech (security) problems solved with 'low-tech' solutions.

How the low-tech internet tackles high-tech threats

Navigating the digital landscape is hard enough, let alone introducing the drama and politics of domain names. Throw in nasty behavior and some lawsuits, and you’ve got an introduction to the world of cybersquatting.

Going beyond just simple domain registration, cybersquatting is a complex and evolving practice in the digital landscape. At its core, it involves the bad faith use or registration of domain names, often with the intent to deprive rightful owners or profit from others' trademarks. This practice has expanded to include username- and handle-squatting across online and social media platforms, extending its reach beyond just domain names.

Digital troublemakers have developed a range of techniques and forms of cybersquatting over the years. The traditional form, domain squatting, involves the registration of domain names similar to established brands or trademarks—the registration of netflix-movies.com would be an example. The practice has evolved to include username and handle squatting on social media, meaning that bad actors claim the names resembling known brands or public personalities. Typosquatting, another common technique, involves registering domains with common misspellings of popular websites—think netflux.com or netfllix.com. You can see these in action in Figure 1: there are many ways to manipulate a domain name for cybersquatting purposes.  

Internationalized Domain Name (IDN) cybersquatting utilizes visually similar characters from different scripts to create deceptive domains—netflíx.com looks just like the true domain until you notice the accent on the ‘i’. In Figure 2 we see several real examples of IDN cybersquatting, extracted from the Dataprovider.com database.

The motivations behind cybersquatting are primarily financial or malicious. Many cybersquatters attempt to sell domains to trademark owners at inflated prices, seeking financial gain, while others use these domains for more nefarious purposes, like phishing, scams, malware distribution, or just redirecting to competitor websites. In some cases, cybersquatting is used for political leverage: individuals register domains related to political figures or movements, as seen with cases from Australian senators to US presidential tickets, for negative consequences. These activities create a complex and often problematic ecosystem, affecting businesses, individuals, and the overall integrity of the internet.

Cybersquatting extends across various languages, exploits different top-level domains—like by registering netflix.jp before the company itself can—and employs sophisticated techniques to bypass traditional safeguards. It is absolutely not limited by language or geography. The introduction of new generic TLDs (like netflix.film) has added another layer of complexity to the cybersquatting landscape, both in terms of new opportunities for squatters and new challenges for brand protection. While most cybersquatting is profit-driven, there are non-commercial forms such as cybergriping, where individuals register domain names to criticize or parody organizations: ex-South Park writer Tony Morton is (in)famous for creating spoof websites and using humor to combat hate. However, this raises questions about the balance between free speech and name or brand protection.

At Dataprovider.com, we developed our own system to identify cybersquatting for the top 100,000 websites, based on the traffic they receive and a few other indicators.

Take a look at the number of cybersquatting domains we detect for each of the ten target domains in Figure 3. According to our data, nearly 2,400 domains targeted the main domain of the US based airline United in September 2024, while YouTube.com and 3m.com were targeted by 1,040 and 1,014 cybersquatters, respectively. We also see three major adult sites among the top 10: explicit links are popular targets for cybersquatters because they attract large volumes of traffic, making mistyped or similar domains highly profitable through ads, affiliate links, or redirects. Additionally, adult sites generally face weaker brand protection, allowing cybersquatters to exploit misspelled URLs and monetize them with less resistance from site owners.

Understanding cybersquatting means understanding the domain ecosystem. Key players include ICANN (the Internet Corporation for Assigned Names and Numbers), which governs the domain name system globally, registries that manage top-level domains, and registrars that facilitate the registration of domain names. This ecosystem establishes the backdrop against which cybersquatting occurs. and the foundation on which it can be combatted. 

Legal proceedings, often through the UN’s World Intellectual Property Organization (WIPO), have become a common recourse for companies and individuals fighting cybersquatting. Recent high-profile cases illustrate the complexity of these battles: Canva recently secured 174 domain names through legal proceedings, demonstrating the scale of cybersquatting targeting major brands. Conversely, the case of GigPig highlights the potential for abuse of anti-cybersquatting measures, with the company being accused of reverse domain hijacking. These cases underscore the intricate nature of cybersquatting disputes and the challenges in fairly resolving them.

New elements of brand protection have emerged in response to the threat of (commercial) cybersquatting. Preemptive domain ‘warehousing’ is a common response to these kinds of threats: companies register as many domain variations as they can think of to protect their brand. This proactive approach, while effective, contributes to the saturation of the internet's domain space.

Besides proactive domain management, AI and machine-learning tracking technologies are being developed to help detect cybersquatting. Digital tools and databases—like what we've developed at Dataprovider.com—are solid resources for monitoring particular domain names and identifying cybersquatting attempts. Many businesses implement redirection networks and systems that redirect traffic from similar domains to the legitimate website. There are now more ways to try and mitigate the issue, but it's what happens after the fact that remains an issue. On the legal front, companies and policymakers are utilizing existing laws and pushing for new legislation to address emerging forms of cybersquatting—but it remains a murky and complicated realm. 

As the internet continues to evolve, so too will the challenges and solutions related to cybersquatting. We can expect to see enhanced tracking technologies emerge, offering more sophisticated tools to identify and prevent cybersquatting attempts in real-time. The legal landscape is likely to expand, with the development of more comprehensive international legal frameworks to address cybersquatting across jurisdictions. Maintaining the delicate balance between robust brand protection measures for business, while preserving the principles of fair use and free speech in the digital space, promises to remain a hard task. With the growing popularity of emoji domains and TLD developments, we'll never be rid of the risk, but it's not impossible to keep on top of it. This digital ecosystem challenge will requite ongoing vigilance, technological innovation, and legal adaptations to address its evolving nature and impact on businesses, individuals, and the integrity of the internet as a whole.

Brand Protection

Bad manners, grudges, and name-calling… sounds like playground antics, but this is the online world of cybersquatting. Including domain squatting and typosquatting, this illicit digital activity is usually for malicious, political, or financial gain but is a popular stunt among satirists too. Read on to learn more about cybersquatting and the efforts to combat it.

What is cybersquatting? Preventing domain hijacking and brand misuse

Veronika Vilgis

Cyber insecurity bears huge economic risks, demanding policies and guidelines to safeguard against this increasing threat. Business websites are an easy target, especially those of small and medium-sized companies that may not have the necessary sources and knowledge to keep on top of security measures. However, the security of a business website is a vital element of a company's credibility and survival. Poor security can lead to inequity, giving bigger companies an advantage over small ones, according to Forbes. Below, we look at a select number of countries and check the security measures in place on national business and e-commerce websites. We’ll reveal that many are woefully unprepared against cyber threats. This lax security endangers sensitive information and undermines consumer trust and business continuity. 

We dive into the essentials of web security in this first installment of a two-part series, asking how often companies use outdated software, forget about SSL certificate implementation, and leave unnecessary ports open. We'll also touch upon the growing concern of fraudulent online stores, which not only pose a significant threat to consumers but also to established brands. In the second part, we’ll look at more advanced security measures, such as phishing prevention, security-enhancing HTTP headers and the implementation of a security.txt file. 

Ransomware is one of the most common cyber threats to organizations and can cause significant financial damage. Next to that, it negatively influences a company's reputation, consumer trust, and investor relationships. According to IBM, the global average cost of a data breach in 2023 was USD 4.45 million, a 15% increase over 3 years.

Website security plays a crucial role in reducing risks. The 2017 Equifax data breach, one of the most significant and far-reaching cybersecurity incidents to date, was due to a vulnerability in a web application framework. This breach exposed sensitive data of about 147 million consumers and had far-reaching repercussions, including lawsuits, a drop in stock price, and the resignation of its CEO.

In light of heightened political tension around the world, countries and international organizations have implemented policies or national strategies to improve cybersecurity. These strategies are often part of broader efforts to protect national infrastructure, businesses, and citizens from cyber threats.

But just how effective are these strategies, and how well are businesses implementing basic and more advanced security measures? Below we’ll focus on the basic but crucial aspects of website security. We will examine the state of business, including e-commerce websites, in 13 selected countries. 

PHP (Hypertext Preprocessor) is an open-source scripting language for web development. PHP plays a pivotal role in website management and maintenance due to its scalability, ease of use, and compatibility with numerous web servers and operating systems. New PHP releases are fully supported for two years. After the two years, support is continued only for critical security issues for an additional 12 months. Then, that version no longer is supported. 

Unsupported PHP versions can pose significant risks. They are vulnerable to exploitation by cyberattackers, leading to potential data breaches and website compromise. 

In our analysis of 13 countries, the share of business websites with unsupported PHP versions ranges from 8% to 29%. Nearly a third of Turkish, a quarter of French and a fifth of Spanish business websites are operating on PHP versions that no longer receive security updates. Norway “wins” here, ranking as the country with the lowest share (8%) of vulnerable business websites.  

For this research, we looked at unsupported PHP branches 4 to 7.4, but 8.0 is also no longer supported as of 26 November 2023, meaning that the true share per country is likely to be even higher. For website administrators, it is crucial to regularly check for new releases and ensure software is kept up-to-date. Hosting providers also have a role to play, alerting clients when older versions no longer receive security patches and assisting with migration to new releases.

SSL certificates at the basis of security

An SSL certificate provides fundamental protection for a website by ensuring that all communication with an external browser is encrypted. Obtaining one is fairly straightforward and is free for the most basic version. Therefore, there is no rationale for not having a certificate associated with a website.  

In our sample, the Czech Republic (11%) has the highest share of business websites with no SSL certificate, followed by Spain (5%). These two also have the highest share of invalid certificates, 9% and 5% respectively. Only Turkey has a larger share; here, 10% of all business websites have an invalid certificate. The overall winner for SSL protection is Indonesia, with only a 4% share of websites with either an invalid or no certificate.

Too many open ports lead to vulnerabilities

The term 'open port' refers to a network port that is configured to accept data packets. A website needs certain open ports to receive traffic. However, open ports can be a significant vulnerability if not properly managed. The more open ports there are, the higher the risk of someone sneaking in where they shouldn't. 

Figure 3 shows the median number of open ports for business websites for each country, meaning that exactly 50% of all websites fall below and 50% above that number. Norway ranks safest with a median of only two open ports. On the other end of the scale, South Africa and Chile have a median of 11 open ports, signalling a greater vulnerability among businesses in these countries. 

Similar to the safeguarding physical doors against unauthorized access, it is imperative to protect open ports against cyber criminals. This involves implementing firewalls, keeping software up to date, and only opening up ports when necessary. Open ports without proper security measures invite attackers to gain access to sensitive data, execute malicious code, or disrupt services. That is why regular monitoring and management of open ports are essential components of effective network security.

Before we move to more advanced security measures in the second part of this 2-part analysis of business website security, let’s take a look at a more applied part of security: fake webshops. These online stores typically sell counterfeit merchandise or offer products at incredibly low prices, luring consumers to spend without ever providing the product. 

Our proprietary Trust Grade provides an indication of the level of credibility an online store possesses. The scale ranges from A to F, wherein A signifies a high level of trustworthiness. A D, E, or F rating indicates less trustworthiness, with scores of E and F almost certainly indicating a fraudulent online shopping portal. Figure 4 shows the highest percentage of dubious online stores are found in Norway (4.8%), followed by Estonia (4.6%) and Indonesia (3.2%). The countries with the lowest share among e-commerce sites are South Africa (1.3%), Chile (0.6%) and Brazil (0.2%). Interestingly, while Norway scored relatively high on other security measures, their strong economy perhaps attracts a more significant number of fraudulent web stores. 

Tracking suspicious online stores and taking them down as quickly as possible to minimize damage to consumers and brand reputation is perhaps a task for national law enforcement. Similar to scams in the physical world, consumers need protection to make the web safer for all.

In this first part on business website security in a select number of countries, we discovered important differences in the security measures implemented by business websites across the globe. Strikingly, the share of business websites that run unsupported PHP versions is relatively high. Additionally, in some countries a relatively large number of open ports on business websites suggest more could be done to tighten security. While open ports are necessary, Norway is leading the pack and shows that having the bare minimum of open ports is manageable for most businesses. On the positive side, SSL coverage is relatively high across all countries. 

In the next part, we’ll look at additional safety measures and how well these are implemented on business sites in these same 13 countries.

Download the full Global Cybersecurity Outlook 2024 (pdf) from the World Economic Forum here.

In their 2024 Global Risks Report, the World Economic Forum ranks cyber insecurity as the 4th biggest short-term threat and predicts that it remains a major risk throughout the next ten years. To be better prepared, it’s crucial to understand the current state of information security. We took a look at the state of security of websites in 13 countries around the globe, to get a more in-depth understanding of how well websites are protected. That led to some alarming and surprising results, which you'll learn about further on in this blog.

The alarming state of business website security across countries

Hylke van der Veen

Before this improvement, we simply determined whether a website had an SSL certificate or not. But we can now distinguish between three possible values for the SSL certificate: valid, invalid, and none. The introduction of these new values has resulted in a distinction being made between websites that possess an invalid certificate and those that do not possess one at all, whereas previously, these websites were grouped under the designation 'No.' 

Despite there being no difference between visiting a website with an invalid SSL certificate or no certificate at all, this information is relevant for certificate issuer organizations or hosting services looking to get more insights into their customers' security.

SSL certificates for inaccessible websites

We can now also detect certificates for websites that redirect to other websites or cannot be accessed by our spider. Despite the inability to access such websites in a browser, just attempting to go to the website can unknowingly establish a connection with the server. That is why it is always important to know whether the connection is secure.

The first figure shows that out of the 142 million websites analyzed, 63% of them had a valid certificate. Although this number is down from September 2022, when 65% of sites displayed a valid certificate, we should keep in mind that we've further enhanced our capabilities and now detect certificates on a broader range of sites. 

To make a fair comparison between September 2022 and November 2023, we only look at available websites in both graphs. We see an 8% increase from September 2022, with over 73% of available websites now being protected by a certificate. 

Figure 2 also shows that websites that our spiders cannot access are significantly less likely to be protected by a valid SSL certificate than websites that return an available response or redirect. 

This extended SSL information can be used in a wide range of cases. For example, if we compare the use of SSL certificates of generic Top Level Domains (gTLDs) to that of new generic Top Level Domains (new gTLDs), some interesting statistics emerge. 

In Figure 3, we see significantly more websites with a gTLD have a valid SSL certificate compared to websites with a new gTLD, 62% vs. 48%. But although the difference is clear, this does not offer an explanation as to where this difference comes from. To find out why gTLDs are using SSL certificates more often than new gTLDs, we need to dive deeper and look at individual TLDs. 

Figure 4 illustrates the use of SSL certificates for the 33 largest TLDs among generic (shown on top) and new generic ones. There are massive differences in the usage of SSL certificates between these TLDs; coverage ranges from 13.1% for .icu domains to 95.5% for .bond domains. This difference can largely be explained by the types of websites associated with each TLD.

For example, .bond is aimed at the financial world. It is marketed as a premium TLD for financial professionals who want to make a trustworthy impression on their clients. According to our data, business websites are already among the most protected websites, with 86.5% having a valid SSL certificate. Considering that financial businesses rely on an image of security and trustworthiness, it makes sense that so many .bond websites are protected by SSL.

At the bottom of the chart, we find the TLD .icu, which is Internet slang for “I see you”. Interestingly, both .icu and .bond are owned by the same registry, ShortDot. Our data shows over 70% of available .icu websites are low-content or placeholder websites, which could explain the low percentage of websites with a valid certificate. On the other hand, TLDs like .today and .blog, which have a high rate of SSL certificates, cater to types of websites with frequent updates and much interaction from their visitors, thus incentivizing security. 

Perhaps unsurprisingly, the original gTLDs are more in the center of the certificate distributions, with anywhere between 45% and 62% with valid certificates. These TLDs are well-established and popular, and are therefore less prone to large outliers. The reason then that original gTLDs are seemingly more secure is because the gTLD with the most valid SSL certificates is .com. By far the largest TLD, .com covers nearly half of all domains worldwide and more than 80% of all domains with a gTLD, therefore heavily influencing the number of valid SSL certificates in its group.

While general trends point towards an increase in SSL certificate adoption, the real story lies in the noticeable contrasts between domains. Certain TLDs, like .bond, demonstrate a strong commitment to security, reflecting the industry's need for trustworthiness. 

In contrast, other domains such as .icu show less inclination towards SSL certificates, often hosting content-light or placeholder sites. This exploration not only highlights the critical role of SSL certificates in web trust and security, but also vividly illustrates how the nature of a TLD can significantly shape its security profile. Established domains like .com are still at the forefront of digital trust.

In a previous blog, we discussed the basics of the TLS protocol, also known as SSL. Since then, Dataprovider.com has released an entire new product, the SSL Catalog, which adds searchable structured SSL certificate data to our database. Additionally, the SSL certificate detection methods have improved, creating even more accurate results. In this blog, we show you how SSL data can help create a more profound understanding of how secure the web is.

SSL trends: New findings on web security and SSL certificate usage

Mathijs Baas

The Dark Web is the internet's hidden alleyways, tucked away from the bustling streets of the World Wide Web that most of us are familiar with. Unlike the websites you visit every day, the Dark Web is inaccessible via standard web browsers or indexed by traditional search engines, such as Google.

The internet most people know about can be broadly divided into three distinct segments or levels: the Surface Web, the Deep Web, and the Dark Web. The Surface Web and Deep Web account for 94% of all the information on the internet, while the Dark Web is estimated to account for around 6%.

The Surface Web, also known as Clearnet or the visible web, is the portion of the internet that is readily accessible to the general public and is indexed by traditional search engines. When you search for a recipe, read news articles, or visit social media platforms, you are navigating the Surface Web. 

The Deep Web is a much bigger part of the internet, but standard search engines do not index it. This includes databases, private academic libraries, member-only websites, and personal email accounts. You are accessing the Deep Web when you log into your online banking account to check your balance or view transactions. While the term 'Deep Web' might sound mysterious, it’s largely unnoticeable, encompassing content that’s not intended for access without the appropriate authorization or credentials.

Lastly, there's the Dark Web, a small and deliberately hidden part of the internet that is not accessible through regular browsers. It requires special software, such as Tor or I2P, to access it. The Dark Web is notorious for its illegal activities. Although it’s true that illicit activities are prevalent on the Dark Web, it is also a platform where political dissidents can engage in communication in countries with oppressive regimes, or where whistleblowers can divulge information without fear of reprisal. 

The roots of the Dark Web can be traced back to the 1990s, when the U.S. Naval Research Laboratory initiated a project called 'onion routing', a technique for anonymous communication over a computer network. This project ultimately led to the creation of Tor in the mid-2000s. 

The primary objective of Tor was to safeguard the online communications of U.S. intelligence. However, once it was released to the public, the broader community began to recognize its potential for ensuring privacy and resisting censorship. As internet use increased, people started to worry about privacy, surveillance and censorship, which led to Tor becoming more popular. 

By the 2010s, with the emergence of marketplaces like Silk Road, the Dark Web started to gain notoriety as a hub for illicit activities. Although these marketplaces brought attention and controversy to the Dark Web, they also ignited the broader debate regarding internet freedom, privacy, and the challenges of digital governance.

Until you see how Tor works, the onion in the Tor name might seem like an odd choice. The onion represents the concept of working in layers. All traffic in Tor is relayed and encrypted three times as it travels over the Tor network. The data is passed through several of the thousands of Tor relays. There’s no single relay that knows where the data originally came from or where it is going. You can compare it to passing a secret note through a group of people, with each person adding a new layer of code to keep the message hidden.

With Tor, internet traffic is routed and encrypted multiple times, which makes it difficult to track activities or locations. Despite Tor's association with accessing the hidden parts of the internet, such as the Dark Web, it can also be used for regular browsing.

Privacy on the Dark Web: The good & the bad

The concept of privacy is a fundamental characteristic of the Dark Web, and it is one of the primary reasons why individuals and organizations may choose to operate there. The Dark Web is distinguished from other parts of the internet by its unique combination of secrecy, anonymity and association with both legal and illegal activities. The illegal aspect of the Dark Web often prevails when people are referring to it. The origin for that negative sentiment can partly be found in the marketplaces on the Dark Web. 

Marketplaces are places that facilitate trade and communication in a shielded environment. Users can buy, sell and exchange goods and services with a heightened sense of anonymity. Common illegal goods and services on offer include, for example, illicit drugs, stolen data, malware and hacking services, firearms and counterfeit identity documents or money. In 2022, you could buy valid US credit card information for as little as $17 or a New York driver's license for around $70.

Some marketplaces have gained notoriety, the most notable of which being AlphaBay and Silk Road. Silk Road, which debuted in 2011, was a pioneer in the underground digital bazaar scene, offering a diverse range of products, ranging from illicit drugs to counterfeit currency. Its user-friendly interface and reliance on Bitcoin as an anonymous payment method made it a massive hit among Dark Web users. However, its prominence also made it a prime target for law enforcement, leading to its eventual closure in 2013. 

AlphaBay quickly filled the void left behind by Silk Road and expanded the range of illicit activity. These marketplaces, while providing a glimpse into the Dark Web's hidden economy, also highlight the seemingly endless cat-and-mouse game between cybercriminals and global law enforcement agencies. AlphaBay was shut down in 2017 by law enforcement. 
In 2021 it was relaunched. But at the beginning of 2023, the owner seemingly disappeared. Due to the way security was set up, the site was basically rendered unusable and it died a slow death. That Illicit activity is lucrative is not a surprise. A prime example of that is Hydra. In 2022, that marketplace was shut down by German and U.S. authorities. At that time, it was the highest-grossing Dark Web marketplace, with an estimated revenue of €1.23 billion.

The Dark Web is rife with illicit activities and potential dangers, but it also serves as a sanctuary for whistleblowers and those evading political repression. Nevertheless, its reputation is primarily shaped by the trade in illegal goods, services and stolen data. It's important to recognize the dual nature of the Dark Web and remain vigilant about personal and organizational cybersecurity measures. To safeguard against data leaks and the potential dissemination of sensitive information on the Dark Web, businesses should adopt comprehensive cybersecurity strategies. 

You probably have heard of the term “Dark Web” before. And although the Dark Web may seem like something out of a mystery novel, it is real and is a big part of the internet. Let's look at what it is, how it works, and how it differs from conventional web.

What is the Dark Web and how does it work?

Gijs Barends

Security.txt is an internet draft standard for websites to define their security policies. It’s a simple text file that provides the necessary contact information for security researchers to report vulnerabilities they’ve discovered on your website. Yet, it's surprising how few organizations are taking advantage of this convenient cybersecurity tool.

We looked at 38.7 million business and e-commerce websites globally. Among these, only 209,000 have a security.txt file implemented. That is less than 1% of the total (Figure 1). 

If we look at which country has the largest share of business and e-commerce websites with an implemented security.txt file, the Czech Republic and Slovakia have the largest share with 7% and 5% respectively. Except for China, the top 10 are composed entirely of European countries, with a strong presence of all four Nordic countries. Overall however, these percentages are rather small, meaning that all countries could do better at implementing policies to encourage businesses to adopt security.txt.

Security.txt enables businesses to take charge of their cybersecurity narrative. By directing researchers to the proper reporting channels, businesses prevent the potential chaos that may ensue if vulnerabilities were publicly disclosed without giving the organization a chance to fix them. By being proactive with a security.txt file, businesses can control the disclosure process. Doing this, they ensure they're part of the solution rather than just recipients of bad news.

While security.txt is not a silver bullet solution, it is indeed a significant first step in establishing a responsible vulnerability disclosure process. Let's understand why.

Security.txt lists the right contact information for security issues

The file provides a straightforward method for security researchers to contact the correct people about potential security risks. They often spend as much time trying to report the vulnerability as they do finding it, which is a deterrent for many. With the security.txt file, the process becomes easier, incentivizing more researchers to proactively report threats.

Implementing security.txt is relatively straightforward. The file should be placed under the /.well-known/ directory, making it accessible via https://[yourwebsite]/.well-known/security.txt. The information usually contained in this file includes contact details, typically an email, a link to a public key for securely communicating with the organization, and a link to the organization's security policy (Figure 3).

There are a few important points to consider when creating a security.txt file. It is important to ensure the contact details are up-to-date and accurate, for incorrect or obsolete information defeats the purpose of the file. Including a public key enables  researchers to send sensitive information securely, while a link to the security policy helps researchers to understand your organization's stance and practices concerning security.

The first step in solving a problem is acknowledging it. By implementing a security.txt file, businesses not only acknowledge potential vulnerabilities in their systems but also take an active role in mitigating them. Despite its ease of implementation and clear benefits, it remains underutilized. Policy makers, domain registries and registrars as well as local website administrators can all help to raise awareness and promote the use of security.txt for creating a safer, more secure web for all.

As we tread further into the digital age, security continues to be an ever-increasing concern. Websites, especially, are being continually threatened by potential cyber threats. However, the web community is not without its protective shields; one such unsung guardian is the 'security.txt' file.

Security.txt: the web's unsung guardian

Ports were invented to reroute different processes. For example, surfing the web always uses port 80 and port 443, port 25 is used for sending emails. Currently, there are 65,535 ports. They make network connections efficient because they let your computer know what to do with the data. 

Cyber criminals can exploit open ports to gain access by sending malicious traffic through them with the intention to take control or steal sensitive information. This is sometimes compared to a thief that checks every door of a house to see if one hasn’t been locked. Out of the more than 60,000 ports, only a few that are actively used should be kept open. 

We do port scans for our clients with the intention to improve security. We check ports that are commonly used in popular applications like MySQL, PostgreSQL or Remote Desktop. From that data we can see that the majority of sites (61%) have fewer than six open ports. However, the data also suggests that there are around 2.4 million domains worldwide that have more than 80 open ports. Among these, 23% are business or eCommerce sites. 

What can you do to protect open ports? One way to address them, is by implementing firewalls. These can be either software, like a program you install on your computer, or hardware. Next, you should determine how many ports you have opened and whether all of these need to be open. Closing ports is like shutting the door on cyber criminals, so it’s important to regularly monitor and evaluate your website’s open ports.  

Domain registrars and registries could also use this kind of data to prevent security breaks and hacks into their users' websites. By checking and warning their clients if a firewall isn't configured right and informing them of the number of open ports, you can help them tackle this issue.

Ports are virtual openings where network connections start and end. All communication that happens over the internet is exchanged via ports. Most processes, like e-mail, always use the same port number (#25 in this case). To be connected to the internet, you need at least several ports to be open. But open too many ports, and you can open up security risks. Keep reading to discover how the number of ports tells you something about the security and trustworthiness of a website.

Follow us

Questions?