Dark Web Is No Longer Dark: How the Clear Web and Telegram Host the Underground Economy

For two decades, public and academic discourse has treated the "dark web" — the portion of the internet reachable only through anonymizing software such as Tor — as the primary habitat of illicit commerce: narcotics, stolen data, weapons, and extremist material. This paper argues that this framing is now analytically incomplete. Drawing on a synthesis of recent criminological and cybersecurity research, we show that a substantial share of the activity historically associated with the dark web has migrated to, or now operates in parallel on, two far more accessible environments: mainstream chat applications — chiefly Telegram — and the ordinary, indexable clear web. Reviewing empirical studies of Telegram criminal markets, threat-intelligence reporting on Telegram-based data leak channels, and documented cases of persistent illicit clear-web content, we propose a two-layer model that distinguishes the public-facing "storefront" (increasingly hosted on Telegram and the clear web) from the "transaction layer" (cryptocurrency and, less frequently, Tor-based escrow) in which illicit exchanges are finalized. We argue that this decoupling has material consequences for public risk, since it removes the principal technical barrier — installation of anonymizing software — that once limited casual exposure to illicit markets. The paper concludes with implications for platform governance, law enforcement prioritization, and public digital literacy.