Grey web vs dark web vs deep web.

Every explainer draws the same picture: a surface web on top, a deep web underneath, a dark web at the bottom, depth standing in for danger. It is memorable and it is misleading, because these are not layers of one stack. They are three unrelated reasons a page is not in front of you, and the reasons behave differently.

Deep web content is blocked by permission. Dark web content is blocked by routing. Grey web content, gray web in American usage, is blocked by time. Once you sort them that way the practical questions answer themselves, including the one that actually matters in an investigation: can I still go and get it.

The surface web belongs in the picture too, and not as the top of a pyramid. It is simply the part nothing blocks. The grey web is what the surface web leaves behind: pages that were on it, were indexed, and are not there any more.

The deep web is everything a search engine cannot index because it would need to be somebody first. Your medical records, a company intranet, the contents of a database that only answers a form submission. By volume it dwarfs everything else on the web, and almost all of it is entirely mundane.

It is also the source of most of the confusion in this area, because popular coverage uses "deep web" and "dark web" interchangeably. They are not close. Logging into a webmail account puts you on the deep web. That is the whole of the mystery.

Most people arriving at this question are really asking about two of the three, so it is worth settling before the grey web enters the picture. The deep web is everything a search engine cannot index because access needs a credential: online banking, a corporate intranet, a database that only answers a form. It is the bulk of the web by volume and it is almost entirely ordinary.

The dark web is a far smaller set of services reachable only through an anonymity network such as Tor. Popular coverage swaps the two words freely, which is where the folklore comes from. They are not close relatives. Logging into webmail puts you on the deep web; that is the whole of the mystery.

The grey web is neither, and it is the one no depth diagram has a place for, because it is not a place at all. It is the surface web after the fact.

The dark web is the set of services that are only reachable through an anonymity network, Tor above all. Being hard to find is the design goal rather than a side effect, and the population is small: a few tens of thousands of live services at any time, against billions of ordinary pages.

It matters to threat intelligence out of proportion to its size, because leak sites, ransomware blogs and some criminal markets live there. But it is not where most of the conversation happens. Attribution, recruitment, bragging, tooling talk and the early stages of a fraud campaign mostly take place on the open web, in public communities, in the clear. And then get deleted.

Grey web content asked nothing of you when it was published. No credential, no client, no invitation. It sat in a public thread and search engines indexed it. Then the author deleted it, or a moderator removed it, or the community went private, or the platform closed its API and ended the ability to enumerate what exists.

This is the only one of the three where the blocker is not a door you can open. Credentials recover deep web content. A Tor client reaches dark web content. Nothing at all reaches grey web content, because there is nothing left at the address. The only thing that survives is a copy someone took while it was visible, which is what makes grey web data a fundamentally different asset from the other two.

It is also the fastest-moving of the three. On a sample of Reddit comments we recaptured seven days after collecting them, roughly one in twenty had already left public view, most removed by moderation rather than by their author. That is a first measurement on a small sample, and we are still consolidating it, but a weekly attrition rate in that range means the grey web grows continuously and silently.

Sort by the failure you can least afford. If you need what an organisation holds internally, that is a legal process question, not a collection question. If you need leak site postings and market listings, you need dark web monitoring, and there are competent vendors for it.

If you need to know what a person or a community said before they cleaned up, no amount of dark web tooling helps, and neither does a live platform search: the query you run today returns what survives today and stays silent about the rest. That is the specific gap grey web intelligence fills, by collecting at publication time so that a deletion becomes a dated event rather than an absence.

The practical difference is easiest to see rather than argue about. Try user lookup on an account that has scrubbed itself, or deleted post search on a thread that no longer renders on Reddit. No account needed.