Looking for new stats about the Dark Web?
This is a complete list of up-to-date Dark Web statistics for 2021.
On this page, you will find hand-picked stats by our threat intelligence experts about:
- Most Commonly Used Languages on the Dark Web
- Most Prolific Ransomware Groups
- Dark Web Server Technology
- Dark Net Web Technologies
- Number of Open Ports
- How many Onions are live on the Dark Web right now?
- Average Ransomware demands per Industry
- Number of Ransomware Attacks Happening Right Now
So, let’s take a look at these statistics in more detail.
———
Most Commonly Used Languages on the Dark Web
Below you can see the most commonly used non-English languages today, compared to 2018.
Although English is by far the most dominant language on the dark web the language distribution across the rest of the domains has remained surprisingly stable since we began indexing in 2018.
This suggests that despite growth in recent year, the content and individuals using dark net platforms has remained the same.
- English accounts for 98% of language on the Dark Web
- Russian is second with 1%
Most active Ransomware groups
Who are the most prolific Ransomware organisations on the Dark Web? How many victims are each group targeting and who is the largest Ransomware organisation?
Ransomware activity is dominated by a small number of groups, with the top 3 below accounting for approximately 44% of all victims.
Some of these organisations operate in a surprisingly business-like way, with call centres, helplines and ‘buy-one-get-one-free’ offers all part of the operation in what must seem like a galling experience for the victims looking to get their data removed from the Dark Web.
The victims range in size from smaller SMEs to global enterprise level organisations. These groups are not picky. If they can find a vulnerability and exploit it, they will do so.
Note: These figures represent the latest snapshot of ransomware activity on the Dark Web. Hackers are actively engaged at all times and our tools detect new victims on a daily and weekly basis.
Dark Web server technology
Our indexing technology allows us to collect highly granular data about the Dark Web domains we find.
Here we are able to see the predominant server technologies powering the Dark Web.
This tells us that Nginx, the popular free and open-source software released by Igor Sysoev in 2004, accounts for a whopping 91% of all Dark Web server technology. Nginx is an incredibly popular reverse proxy so it is no wonder it has a significant market share as the front for most websites on the internet and Dark web.
Some way behind Nginx at 8% we have Apache, with the rest of the pack making up the remaining 1%
Dark Net web technologies
We also look at the different tools and techniques used in the process of communication between different devices over the dark net.
Analysing this data lets us see not only which versions are out there, but how potentially vulnerable some of these systems actually are.
Over 95% of the Dark Web is powered by PHP, making it the most popular web framework by a long way.
From collecting web technology information like this we can gain insights into the most popular frameworks and their versions as well as understanding how up to date or not some of these websites actually are.
Number of open Ports
As we explore the microcosm of the Dark Web our tools log the number, type, and ID of the open ports we find.
This allows us to glean a surprising amount of information about the servers used to exploit organisations via hacking, data theft and ransomware attacks.
For example, our most recent data tells us that Port 80 accounts for 96% of those discovered on the Dark Web.
Number of Dark Web domains
How many domains are live on the Dark Web right now?
There are over 100,000 .onion domains live on the Dark Web right now. For a live feed of current stats visit our homepage here and check out our carousel for our live Dark Web threat tracking stats.
It’s important to note that new domains pop and shut down all the time as hackers and ransomware groups spin up new sites to carry out their attacks.
This graph shows how our indexing tools are beginning to plateau as our total coverage of the dark web increases over time.
Top Ransomware stats 2021
Ransomware attacks are on rise in 2021 and we predict that this activity will continue to grow.
Indeed, Ransomware represents criminality on a truly industrial scale with hackers targeting larger and more sophisticated organisations all the time.
The Healthcare Sector is one of the most heavily exposed with approximately 24% of all of attacks targeting healthcare organisations.
Indeed the biggest ever attack (WannaCry in 2017) badly affected the UK’s NHS (National Health Service), costing it almost £92 million. Worse still, the chaos caused by the attack shut down IT systems for days which almost certainly cost lives.
According to Cyence, the total loss caused by WannaCry was close to $4 billion worldwide.
Average cost of Ransomware
Whilst the numbers above are pretty eye-watering it is worth pointing out that the average ransomware demands are more modest.
Indeed, the average ransomware demand for an organisation is $233,217.00. However, the average cost of remediating a ransomware attack is much higher at $761,106
It’s worth noting that this figure doesn’t consider the costs associated with the average downtime caused by a ransomware attack, which currently stands at 19 working days.
Ransomware attacks happening now
On average there are 4000 Ransomware attacks worldwide each day.
This works out at an average of an attack every 11 seconds.
The most common form of Ransomware attacks occur via email, with 1 in 3000 emails passing through security filters containing some form of malware, such as Ransomware.
Want to know more?
We’ve created a helpful guide to the dark web.
So if you are looking for more information on:
- The Dark Web basics
- Where did the Dark Web come from?
- What’s driving the growth of the Dark Web?
- What activities take place on the Dark Web?
- Which Dark Web threats can impact my organisation?
- How to protect organisations from Dark Web activity?
- What does Dark Web Monitoring do?
Then this guide will provide you with all of the answers you need: