Directory
Explore Dark Web Research & Studies resources in Dark Web & Underground.
CRATOR is a proposed dark web crawler described in an arXiv paper. It is designed to extract pages that handle security protocols such as captchas, using seed URL lists, link analysis and scanning to discover content, with user-agent rotation and proxy usage for anonymity. The authors report evaluation using coverage, performance and robustness metrics, and suggest threat intelligence, cybersecurity and online investigation applications.
This arXiv paper proposes an end-to-end scalable architecture for early identification of new Tor sites and daily analysis of their content. It is built on an open source big data stack including Kubernetes, Kafka, Kubeflow and MinIO, discovering onion addresses across several sources, downloading HTML from Tor, deduplicating with MinHash LSH and categorizing with BERTopic modeling. In 93 days it identified 80,049 onion services and characterized 90% of them.
DARPA Memex is a program seeking to develop next-generation search technologies for discovering, organizing and presenting domain-specific content. It aims to extend search beyond a centralized model to the deep web and nontraditional content. The program initially plans to address fighting human trafficking. It is specifically not interested in deanonymizing servers, attributing identity to IP addresses, or accessing non-public information.
Dizzy is an open-source crawling and analysis system for onion services. It implements techniques to explore, update, check, and classify onion services at scale without overwhelming the Tor network. It was deployed in April 2021 and used to analyze more than 63.3 million crawled onion webpages, focusing on domain operations, web content, cryptocurrency usage, and web graph.
Europol and EMCDDA report on darknet drug markets, policy implications and research evidence.
Europol assessment of online organized crime, including criminal services and dark-web developments.
This dataset maps the network layer of the Invisible Internet Project (I2P), collected using the SWARM-I2P framework, which deployed I2P routers as mapping agents. It documents over 50,000 nodes with metrics such as bandwidth, latency, and uptime, plus network traffic records and geographic distribution. Node identifiers were anonymized. Data is available in CSV and TXT formats on Zenodo, with mapping scripts on GitHub.
An arXiv paper presenting a large-scale analysis of the Tor network using a crawler called Mimir, which collects and visits linked content. The authors report a dataset of pages from more than 25k sites and examine network topology, replicated content and content types.
A working paper by John Schriner that focuses on how researchers monitor the Dark Web. It defines onion services and Tor and discusses tools for monitoring and securing onion services.
Study of whether website fingerprinting can distinguish and identify Tor onion-service traffic.
An arXiv paper measuring onion website discovery and Tor users' interests with honeypots. The authors deployed honeypot onion websites in March–April 2025 and seeded links via three channels to observe interaction events. They report that human users almost without exception originated from Ahmia.fi, and that the CSAM-themed honeypot drew markedly higher engagement than the others.
RAND study of illicit online markets and the operational lessons they present for public policy.
An arXiv paper presenting a longitudinal analysis of the dark web cybercrime ecosystem. The authors analyze 25,065 websites using 11,403,638 HTML snapshots collected over six years, applying a topic-modeling framework with domain-specific embeddings, density-based clustering and temporal aggregation. The analysis identifies 55 thematic clusters and measures topic prevalence and lifecycle at the website level.
Public-health research measuring harmful-content availability and searches on the Tor network.
A Tor Project page that summarizes resources the project provides for research on improving Tor design, monitoring the Tor network, and studying attacks and defenses for anonymous communication systems. It points researchers to data collection, analysis guidance and measurement and attack tools.
UNODC report on darknet-enabled cybercrime threats and policy responses in Southeast Asia.
Details from each project's website. Open a listing for its full overview.
