The Internet Iceberg Is Upside Down

Leer en español →

By Jesús · Cloud Security & Incident Response · Explainer paper · 15 min read

You have almost certainly seen it. A photo of an iceberg sliced into bands, with white text. At the top, the harmless stuff: YouTube, Wikipedia, Facebook. As you go down, things get darker: Tor, black markets, “Tesla’s books”. And at the very bottom, where no light reaches, the Marianas Web, “The Fog” and a mysterious Primarch System that, legend has it, controls the entire internet.

For more than a decade that image has done the rounds on forums, in YouTube videos with ominous music and in after-dinner conversations that start with “have you ever been in there?”. Plenty of people still believe the internet has basements, that you have to go down to find what is forbidden, and that the deeper you go, the more dangerous it gets.

All of it is false. And not because someone drew it badly: the iceberg was designed to deceive.

In this paper I do three things. First, an autopsy of the hoax: where it comes from, how it is built and why it worked so well. Second, I turn the metaphor upside down with the real architecture of the network in hand. And third, I draw the map the iceberg never showed you: the alternative networks that actually exist, who uses them and why they are going to matter much more in the years ahead.

1. Autopsy of a hoax

A meme with no birth certificate

There is no link to the original post, and there never will be. 4chan threads delete themselves within hours or days, so the exact birth of the Deep Web iceberg was lost in the very place it was born. Tradition places it on the paranormal board /x/ around 2010–2011. The digital-culture encyclopaedia Know Your Meme records that the oldest known example of an “iceberg meme” was uploaded to Imgur on 31 May 2011, and warns that it probably predates that.

Context matters. In February 2011 Silk Road opened, the first big black market reachable through Tor. The press was starting to talk about the “hidden internet” without really understanding it, and thousands of curious people were turning up on forums asking how to get in. It was the perfect breeding ground for a legend.

The first version had none of the colourful icons that circulate today. It was a realistic photo of an iceberg, with a navy-blue background, white text and dividing lines drawn by hand in MS Paint. If you want to find that grainy image, search Google Images for, literally: “deep web iceberg level 8 primarch system original”.

The eight levels, one by one

The clever part of the chart is how it hands out the truth. I have taken it apart level by level:

Bait and hook: the tactic

Look at the right-hand column and you will see the pattern. It is a classic disinformation technique, and one we know well in cybersecurity, because it is exactly what a good phishing email does.

• The bait (top levels). Real, verifiable information: Tor, I2P, Silk Road, databases that Google does not index. A reader who knows a little recognises the names and thinks “right, this is serious”.
• The hook (bottom levels). Once trust is won, science fiction creeps in, in ever larger doses: mandatory quantum computing, conspiracies, a system that controls everything, and pseudo-scientific jargon that sounds like a physics paper.

Nobody ever published a note saying it was a joke, because that would have ruined it. And the joke was this: 4chan culture at the time lived on gatekeeping (keeping newcomers out) and on collaborative mythology, the famous creepypastas. When someone turned up asking “how do I get into the Marianas Web?” or “where do I download the algorithm to get past The Fog?”, the regulars knew instantly that they had no idea about computing and had swallowed the meme whole.

The iceberg was a newbie trap dressed up as a technical infographic. It was not political or state disinformation. It was trolling. But it worked so well that it ended up in documentaries, school lessons and newspaper headlines, and it still shapes how many people understand online security today.

2. The iceberg that is true

There is one internet iceberg I love, and it is the exact opposite. On Reddit’s r/IcebergCharts community circulates the so-called Gigantic Internet Iceberg, a huge chart that is not about secret networks but about forgotten things: dead websites, deleted videos, lost games, oddities from the early forums, mysteries nobody has solved because the server holding the answer was switched off in 2004.

Its brilliance is that it shows the real mystery of the internet is not protected by military-grade encryption. It is buried by time, indifference and dead servers. To reach the bottom of that iceberg you do not need Tor. You need patience and the Internet Archive’s Wayback Machine.

And the erosion is brutal. A 2024 Pew Research study found that 38% of the web pages that existed in 2013 were no longer accessible a decade later. That is the real abyssal trench: not a secret level, but a graveyard of broken links.

3. Melting the iceberg

The internet has no depth

To melt the iceberg completely, you only need to put the legend next to the real topology of the network. The two collide head-on.

Structurally, the internet is flat. It has no mystical geography and no digital ether where data drifts about. Every space on the network, however secret, is anchored to a physical infrastructure that is tangible and unforgiving:

• Ordinary computers drawing electricity in a cupboard, a house or a data centre.
• Around 600 submarine cables in service (TeleGeography counted 607 in 2026) that carry, as light, practically all intercontinental traffic: well over 99% of it.
• Standard routers moving IP packets from one point to another without knowing or caring what is inside.

A “dark” forum is a server. A server has a network card, a power supply and an owner. The idea of an unreachable underworld falls apart as soon as you understand that the network is a blind transport system. What the myth dresses up as deep caverns are, in reality, ordinary computers whose owners chose not to link them from Google, or to protect them with cryptographic keys.

The thesis: the iceberg is upside down

Here comes the beautiful part. The internet does have layers, but they are layers of abstraction, not of depth. In networking we call this the protocol stack (the TCP/IP model, the practical cousin of the famous OSI model):

1. At the very bottom, the physical layer: fibre, copper, radio, satellite.
2. Above it, the network layer (IP), which decides which way each packet goes.
3. Above that, the transport layer (TCP and UDP), which makes sure data arrives complete and in order.
4. At the very top, the application layer: the web, email, video calls… and Tor.

Anonymity networks such as Tor or I2P do not live in an underworld hidden at the physical base of the internet. They are overlay networks that run at the top of the stack. They take your traffic, encrypt it in several layers and slip it inside perfectly normal TCP/IP packets. The routers along the way only see ordinary traffic going by.

You do not go down to reach the Dark Web. You go up. It is the highest, most abstract and most encapsulated stratum of the entire network. The 2011 iceberg is not badly drawn: it is drawn upside down.

4. What is an overlay network? The envelope metaphor

Nobody needs to know the OSI model by heart to understand this. Just think about the postal service.

The ordinary internet (the clearnet) is a postcard. The postman, here the routers, can read what it says if he wants to. HTTPS improves things: it is like a letter in a sealed envelope. The postman cannot read the contents, but he can still see the sender and the recipient.

An overlay network is an armoured envelope inside an ordinary one. The postal system keeps carrying the letter as usual, unaware that inside it travel instructions for a completely different network.

Tor takes the idea to the extreme with three envelopes, one inside another. Your message is encrypted three times and bounced through three randomly chosen nodes. Each node can only open its own envelope, and inside it finds only the address of the next hop. None of the three knows both who is sending and what is being sent. Hence the name: The Onion Router, peeled layer by layer.

5. The real map: six families of networks

Forget levels 5 to 8. This is what actually exists, ordered by the layer each family operates on. None of them sits “below” the internet: they all rest on it.

5.1 The base infrastructure: the clearnet and the real Deep Web

This is the fundamental layer, physical and logical. Everything on the internet, including the most secret networks, depends on it to move information.

• Physical and link layers. Fibre-optic submarine cables, satellites, internet service providers (ISPs) and the border routers that speak BGP (Border Gateway Protocol), the protocol that large networks use to tell each other which addresses they can reach.
• Network and transport (TCP/IP and UDP). The standard system of addresses and parcels. Every device has an IP address.
• Surface Web. The HTTP/HTTPS websites indexed by Google or Bing. The public part.
• Deep Web (the real one). Everything a search engine does not index because it sits behind a login or is generated on demand: your inbox, your online banking, your company intranet, your documents in the cloud, admin panels. It is not a secret place. It is the vast majority of the internet. As far back as 2000, a classic BrightPlanet study estimated that the deep web was hundreds of times larger than the surface web. And it runs on the same old HTTPS.

If you checked your bank balance this morning, you have been on the Deep Web. Congratulations.

5.2 Overlay routing networks (IP level)

These networks create a parallel internet in which traditional IP addresses are replaced by cryptographic ones. Because they provide a complete IP layer, they support any kind of traffic (TCP, UDP, ICMP).

• Lokinet. Uses the LLARP protocol to route packets anonymously and with low latency, which enables things that work badly over Tor, such as voice over IP or online games. Its development is now tied to the ecosystem of the Session messaging app.
• Yggdrasil. Builds a global, end-to-end encrypted, self-organising IPv6 mesh network. Your IP address is derived from your public key, so impersonating another node means stealing its key.
• CJDNS. Yggdrasil’s spiritual predecessor. It builds an encrypted virtual IPv6 network designed to connect mesh networks, using the conventional internet as a bridge where there is no direct link. Its best-known network was Hyperboria.

5.3 Anonymity networks: the classic darknets

They operate at the application layer. Their goal is not to store huge files but to make sure that neither sender nor receiver can learn the other’s physical location.

• Tor (The Onion Router). Onion routing: traffic bounces through three nodes and one layer of encryption is removed at each hop. It is used to browse the ordinary web anonymously and to host hidden services with .onion addresses. It is run by thousands of volunteer nodes and used by millions of people.
• I2P (Invisible Internet Project). “Garlic routing”: it bundles several messages together to make traffic analysis harder and uses separate outbound and inbound tunnels. Unlike Tor, it is optimised for services inside its own network, not for reaching the ordinary web.
• Hyphanet (formerly Freenet). Distributed storage focused on extreme resistance to censorship. Files are split up, encrypted and spread across users’ disks. When you request one, the network reassembles it without the node holding each piece knowing what it contains. In 2023 it changed its name to Hyphanet; the Freenet name is now used by a new project from the same original creator.

5.4 The decentralised web (P2P hosting)

Here central servers disappear. Information does not live in one place: it is served by everyone who consumes it.

• IPFS (InterPlanetary File System). It changes the web’s question. Instead of looking for where a file is (an IP address or a domain), you look for what it is, through a unique cryptographic hash of its content. It underpins a good part of Web3.
• ZeroNet. Combines Bitcoin cryptography with BitTorrent technology: anyone who visits a site automatically becomes one of its servers. As long as a single person has it open, the site stays alive. The original project has practically stalled and lives on in community forks.
• Hypercore (formerly Dat). Protocols similar to IPFS but designed to synchronise data that changes in real time. They are used in decentralised desktop applications.

5.5 Friend-to-friend (F2F) networks: the truly closed networks

If you are looking for a “dark” network in the social sense, this is it. Installing the software is not enough: you have to be invited, by exchanging credentials with someone who is already inside.

• RetroShare. Creates a private, encrypted network made up only of your direct contacts. You exchange keys with your friends and your traffic flows only through them: forums, chats and file transfers invisible to the rest of the world.
• GNUnet. A P2P framework from the GNU project with heavy obfuscation, so that not even your provider knows which protocol you are using. It can run in open mode or in strict F2F mode.

5.6 Alternative DNS: names nobody can seize

DNS is the internet’s phone book: it translates names such as example.com into IP addresses. It is coordinated centrally (ICANN, registries, registrars), which allows a government or a court to order a domain to be taken down or seized. These alternatives try to prevent that.

• Namecoin (.bit). Born in 2011, it was the first naming system built on a blockchain. A domain is controlled only by whoever holds its private key.
• Handshake. Aims to replace the DNS root with a blockchain, so that anyone can own an entire top-level domain.
• ENS (Ethereum Name Service). .eth names registered on Ethereum. It does not replace the DNS root, but it allows names that no central authority can take away.

6. Who uses all this, and why?

A list of protocols explains what each technology does. The interesting question is why anyone would go to so much trouble.

Journalists and dissidents. In countries where the press is censored or its readers are watched, Tor is a working tool. Outlets such as the BBC (since 2019), The New York Times and The Guardian run .onion versions of their websites so that they can be read where they are blocked. Many newsrooms receive anonymous leaks through systems that run on .onion services. And when a regime blocks Tor, bridges and disguised transports come into play.

Communities that build their own network. When it does not pay an operator to lay fibre to a village, people organise. Spain is home to one of the largest examples in the world: Guifi.net, the open, free community network born in Catalonia, which by 2017 was already connecting around 100,000 people. Guifi.net is not a darknet and does not use these anonymity protocols, but it shares their philosophy: a network built by its own users. Technologies such as CJDNS and Yggdrasil come from that same mesh idea.

The dark side, which also exists. Strong privacy attracts black markets. Silk Road (2011–2013), AlphaBay and Hydra, the huge Russian market that German police shut down in 2022, are real history. But confusing these networks with their worst use is like judging the postal service by letter bombs. The vast majority of the world’s encrypted traffic is ordinary people protecting ordinary things.

7. The horizon: the balkanisation of the internet

Ending on the technical definition of Namecoin would leave you cold, so let us look ahead.

The internet was born with the ambition of being a single global network. That ambition is cracking. It is what is known as the Splinternet, the balkanisation of the network: China with its Great Firewall, Russia with its 2019 “sovereign internet” law, Iran with its national information network. And then there are outright shutdowns. According to Access Now’s #KeepItOn coalition, there were 313 internet shutdowns in 52 countries in 2025, another record.

As governments tighten their grip on physical infrastructure and on traditional DNS, these alternative networks (overlay, P2P, F2F, decentralised naming) stop being toys for geeks. They become tools for digital survival: the way to stay informed, stay in touch and keep existing on the network when someone decides you should not.

The next time someone shows you the Marianas Web iceberg, turn it upside down. The dangerous part of the internet was never on a secret level at the bottom of the ocean. It lies in what we do not understand about the network we use every day.

Jesús is a cybersecurity engineer specialising in incident response and cloud forensics (Cloud DFIR). He is building PathSentinel, a framework for passive network traffic analysis. If this paper was useful to you, share it: the fewer people who believe in the iceberg, the better.

Sources

• Know Your Meme, Iceberg Charts (origin of the format; first documented example on Imgur, 31 May 2011). knowyourmeme.com/memes/iceberg-charts
• r/IcebergCharts, The Gigantic Internet Iceberg. reddit.com/r/IcebergCharts
• Pew Research Center (2024), When Online Content Disappears. pewresearch.org
• TeleGeography, How Many Submarine Cables Are There, Anyway? resources.telegeography.com
• TeleGeography, Do Submarine Cables Account for Over 99% of Intercontinental Data Traffic? resources.telegeography.com
• M. K. Bergman / BrightPlanet (2000), The Deep Web: Surfacing Hidden Value. doi.org/10.3998/3336451.0007.104
• Tor Project, Tor Metrics. metrics.torproject.org
• Hyphanet (formerly Freenet). hyphanet.org
• Session, Roadmap update: Pro and Lokinet (2025). token.getsession.org
• NPR (2019), BBC Launches Tor Mirror Site To Thwart Media Censorship. kpbs.org
• VICE, The Google Search That Took Down Ross Ulbricht. vice.com
• The Hacker News (2022), Germany Shuts Down Russian Hydra Darknet Market. thehackernews.com
• UOC (2017), 100.000 españoles ya se conectan a internet a través de Guifi.net (in Spanish). uoc.edu
• Access Now (2026), #KeepItOn: Internet shutdowns in 2025. accessnow.org (PDF)