Why Is the Dark Web Not Shut Down? Networks vs Websites
The dark web is not a single website with one owner or server that can be switched off. Tor supports independently operated services and relays, including legitimate uses. Authorities can investigate and seize particular services, but removing a destination is different from disabling the underlying network. Blocking access, taking over infrastructure and prosecuting people also require different evidence and produce different outcomes.

Understanding the question
The object being shut down matters
When a news story says a dark web market was closed, identify what changed: a server, a website, an operator account or an investigation. The answer is more precise than assuming the whole network was defeated or deliberately left untouched.
There is no single marketplace called the dark web
Onion services are destinations using a particular network design, not departments of one centrally managed site. The relay operators carrying network traffic and the people running destinations also perform different roles. Shutting down one service does not automatically give control over all the others.
Tor’s relay documentation explains distinctions such as guards, middle relays, exits and bridges. Onion-service connections have their own architecture rather than simply sending every request through an ordinary public-web exit. Those design details matter when assessing what a particular intervention could affect.
Different interventions solve different problems
| Subject | Direct effect | What can remain |
|---|---|---|
| Seize a service’s infrastructure | Interrupts that destination and may preserve evidence | Other independent destinations and network relays |
| Take over a platform | Changes control of a specific service | Questions about identifying individuals and proving conduct |
| Block network access | Interferes with reachability on affected networks | Infrastructure and activity in other locations |
| Prosecute an operator or vendor | Addresses alleged or proven individual conduct | Separate sites, people and later displacement |
A network also carries lawful activity
Privacy can matter for reading, publication and communication without disclosing a network address to every destination. The existence of unlawful services does not make every service or every user equivalent. A targeted case concerns specific conduct and evidence.
This does not imply that privacy tools prevent investigation or settle the legality of an activity in every jurisdiction. It explains why a request to shut everything down sweeps across a broader set of uses than the criminal site that prompted it. Technical feasibility, authority and proportionality are distinct questions.
What a targeted operation can look like
- June 20, 2017
Dutch police took over Hansa, according to the official Bayonet notice.
Control of a particular marketplace changed before its public closure.
- July 4, 2017
The same notice dates AlphaBay’s takedown.
Another destination was disrupted without a claim that every Tor service stopped.
- After the disruption
Original research examined vendor migration toward Dream Market.
Displacement can be studied separately from the success of the original seizure.
Blocking is a reachability result with a defined scope
A network operator can interfere with access without possessing the destination’s servers or identifying the people behind it. If a service still exists elsewhere, that is different from the operator restoring seized infrastructure. These possibilities explain why two reports about the same destination can describe different outcomes without necessarily contradicting each other.
When assessing a blocking report, check which networks, dates and targets were observed. A failed connection to a project’s website is not the same observation as interference with public relays or a particular onion service. Keep those categories separate before drawing a conclusion about whether the dark web was shut down.
Why new names can appear after a successful seizure
A service can close while participants look for another place to communicate or trade. That possibility does not make the closure meaningless: investigators may remove infrastructure, recover evidence or pursue particular people. It does mean that an ecosystem-level claim requires more than one disappearance.
To evaluate effectiveness, look for the outcome being measured and the observation period. The number of closed websites, recovered records and completed prosecutions are not interchangeable scores. Nor does a familiar name on a new site establish that it has the same operators.
Questions to ask when reading a shutdown headline
- What exactly was taken down, and which authority provides the account?
- Does the date describe seizure, arrest, public announcement or a later judgment?
- What technical method or evidence is actually documented, and what remains undisclosed?
- Does the story measure a specific operation or claim that all activity ended?
Questions people ask
Sources
Further reading
- Tor Project: roles of different relay types
- Onion Browser: platform limitations and connection checks
- Tor Project: how Tor Browser works
- DOJ: AlphaBay seizure, July 2017
- Official Operation Bayonet seizure notice
- Original research: vendor migration after Operation Bayonet
- OONI: measured Russian censorship in 2022, published 2023
Glossary
Terms in this guide
Continue learning