Directory
Dark Web and Underground collects research, journalism, and tools that relate to hidden services and anonymous publishing. Whistleblowing and anonymous publishing covers secure drop systems and submission platforms. Tor and hidden services holds the software, directories, and explanation pages around the Tor network. Dark web research and studies and dark web news and analysis gather academic work, reports, and reporting on how these networks are used. Breach and leak research lists data breach checkers and disclosure trackers, and deep web resources and discovery covers guides to what sits beyond indexed pages. Archives and historical records, dark web search and directories, and underground communities and forums make up the remaining topics. Several entries here are news archives or academic projects rather than services you sign up for, so weigh each one by who published it and when.
This arXiv paper by Dirk Lewandowski and Philipp Mayr provides a critical review of Bergman's 2001 study on the Deep Web. It introduces the concept of the Academic Invisible Web, defined as databases and collections relevant to academia but not searchable by general-purpose internet search engines, and reviews approaches for indexing it. The authors question Bergman's size estimate and suggest collaboration.
Aftenposten AS instructions for submitting documents securely through its verified SecureDrop service.
Aftonbladet instructions for submitting documents securely through its verified SecureDrop service.
Ahmia is a search engine for services on the Tor network. It indexes hidden services, which require the Tor browser bundle to access, and states that abuse material is not allowed and is removed from the index. The project is developed as free and open source software, with a crawler, an index and a search website.
Official Rust implementation of Tor with developer documentation and project tracking.
A tool for checking whether an email address appears in the Ashley Madison breach data. The site states about 36 million accounts were compromised, including some duplicate email addresses, and advises changing passwords. It also notes that Ashley Madison did not validate account email addresses.
News archive covering dark-web leaks, criminal forums, takedowns and ransomware activity.
Bloomberg Industry Group accepts confidential news tips through SecureDrop, described as a secure communication platform designed to protect anonymity. Bloomberg Industry Group controls the server, which stores submitted information in encrypted form. The page advises against using home, office or employer networks and devices, recommending public wifi and devices the source controls. Signal and postal mail are listed as alternative methods.
Bloomberg News accepts confidential news tips through email, Signal, postal mail and SecureDrop. A Signal number is provided for encrypted end-to-end communication, and postal mail can be sent from a public mailbox without a return address. The page advises that email is not encrypted and recommends Tor Browser for whistleblowing-related activity.
Official Tor service distributing bridge relay addresses to users facing network blocking.
CBC SecureDrop is a method for securely and anonymously contacting CBC and its investigative journalists. It establishes an anonymous online connection and allows sending encrypted messages or documents. Access requires Tor Browser, with a pass-phrase serving as the user-name to check for replies; the pass-phrase cannot be retrieved once the user leaves the site.
Official Tor archive providing recent and historical network descriptors for reproducible research.
A page publishing statistics about the current Tor directory consensus and authority votes, including valid-after time, signatures, known flags, flag thresholds, the number of relays voted about, IPv6 statistics, consensus methods, recommended versions and consensus parameters. The page states that it is abbreviated and a detailed version with a relay info table is available.
Official source repository for the Tor network daemon and core protocol implementation.
CRATOR is a proposed dark web crawler described in an arXiv paper. It is designed to extract pages that handle security protocols such as captchas, using seed URL lists, link analysis and scanning to discover content, with user-agent rotation and proxy usage for anonymity. The authors report evaluation using coverage, performance and robustness metrics, and suggest threat intelligence, cybersecurity and online investigation applications.
Reporting and explainers on dark-web activity, leak sites and underground cybercrime.
Analyst posts on deep- and dark-web activity, threat actors and underground communities.
Dagbladet instructions for submitting documents securely through its verified SecureDrop service.
Dark-web intelligence company publishing monitoring, ransomware and underground-ecosystem analysis.
This arXiv paper proposes an end-to-end scalable architecture for early identification of new Tor sites and daily analysis of their content. It is built on an open source big data stack including Kubernetes, Kafka, Kubeflow and MinIO, discovering onion addresses across several sources, downloading HTML from Tor, deduplicating with MinHash LSH and categorizing with BERTopic modeling. In 93 days it identified 80,049 onion services and characterized 90% of them.
Narrative podcast documenting breaches, underground actors, darknet cases and security investigations.
A blog from DarkOwl whose analysts publish insights on darknet intelligence, threat detection and cybersecurity trends. Posts include a darknet marketplace snapshot series and articles on breach data and ransomware. The blog states it offers news, research and resources for enterprises and security professionals.
Open-source interface and API project for searching indexed onion content.
DARPA Memex is a program seeking to develop next-generation search technologies for discovering, organizing and presenting domain-specific content. It aims to extend search beyond a centralized model to the deep web and nontraditional content. The program initially plans to address fighting human trafficking. It is specifically not interested in deanonymizing servers, attributing identity to IP addresses, or accessing non-public information.
