Study of whether website fingerprinting can distinguish and identify Tor onion-service traffic.
An arXiv paper measuring onion website discovery and Tor users' interests with honeypots. The authors deployed honeypot onion websites in March–April 2025 and seeded links via three channels to observe interaction events. They report that human users almost without exception originated from Ahmia.fi, and that the CSAM-themed honeypot drew markedly higher engagement than the others.
This dataset maps the network layer of the Invisible Internet Project (I2P), collected using the SWARM-I2P framework, which deployed I2P routers as mapping agents. It documents over 50,000 nodes with metrics such as bandwidth, latency, and uptime, plus network traffic records and geographic distribution. Node identifiers were anonymized. Data is available in CSV and TXT formats on Zenodo, with mapping scripts on GitHub.
Public-health research measuring harmful-content availability and searches on the Tor network.
CRATOR is a proposed dark web crawler described in an arXiv paper. It is designed to extract pages that handle security protocols such as captchas, using seed URL lists, link analysis and scanning to discover content, with user-agent rotation and proxy usage for anonymity. The authors report evaluation using coverage, performance and robustness metrics, and suggest threat intelligence, cybersecurity and online investigation applications.
This arXiv paper proposes an end-to-end scalable architecture for early identification of new Tor sites and daily analysis of their content. It is built on an open source big data stack including Kubernetes, Kafka, Kubeflow and MinIO, discovering onion addresses across several sources, downloading HTML from Tor, deduplicating with MinHash LSH and categorizing with BERTopic modeling. In 93 days it identified 80,049 onion services and characterized 90% of them.
An arXiv paper presenting a longitudinal analysis of the dark web cybercrime ecosystem. The authors analyze 25,065 websites using 11,403,638 HTML snapshots collected over six years, applying a topic-modeling framework with domain-specific embeddings, density-based clustering and temporal aggregation. The analysis identifies 55 thematic clusters and measures topic prevalence and lifecycle at the website level.
Community notes
Be the first to share how this project worked for you.
Sign in with a verified account to leave a review or join the discussion.
Sign in to reviewKeep exploring
An arXiv paper measuring onion website discovery and Tor users' interests with honeypots. The authors deployed honeypot onion websites in March–April 2025 and seeded links via three channels to observe interaction events. They report that human users almost without exception originated from Ahmia.fi, and that the CSAM-themed honeypot drew markedly higher engagement than the others.
This dataset maps the network layer of the Invisible Internet Project (I2P), collected using the SWARM-I2P framework, which deployed I2P routers as mapping agents. It documents over 50,000 nodes with metrics such as bandwidth, latency, and uptime, plus network traffic records and geographic distribution. Node identifiers were anonymized. Data is available in CSV and TXT formats on Zenodo, with mapping scripts on GitHub.
Public-health research measuring harmful-content availability and searches on the Tor network.
CRATOR is a proposed dark web crawler described in an arXiv paper. It is designed to extract pages that handle security protocols such as captchas, using seed URL lists, link analysis and scanning to discover content, with user-agent rotation and proxy usage for anonymity. The authors report evaluation using coverage, performance and robustness metrics, and suggest threat intelligence, cybersecurity and online investigation applications.
This arXiv paper proposes an end-to-end scalable architecture for early identification of new Tor sites and daily analysis of their content. It is built on an open source big data stack including Kubernetes, Kafka, Kubeflow and MinIO, discovering onion addresses across several sources, downloading HTML from Tor, deduplicating with MinHash LSH and categorizing with BERTopic modeling. In 93 days it identified 80,049 onion services and characterized 90% of them.
An arXiv paper presenting a longitudinal analysis of the dark web cybercrime ecosystem. The authors analyze 25,065 websites using 11,403,638 HTML snapshots collected over six years, applying a topic-modeling framework with domain-specific embeddings, density-based clustering and temporal aggregation. The analysis identifies 55 thematic clusters and measures topic prevalence and lifecycle at the website level.
