An arXiv paper measuring onion website discovery and Tor users' interests with honeypots. The authors deployed honeypot onion websites in March–April 2025 and seeded links via three channels to observe interaction events. They report that human users almost without exception originated from Ahmia.fi, and that the CSAM-themed honeypot drew markedly higher engagement than the others.
An arXiv paper presenting a longitudinal analysis of the dark web cybercrime ecosystem. The authors analyze 25,065 websites using 11,403,638 HTML snapshots collected over six years, applying a topic-modeling framework with domain-specific embeddings, density-based clustering and temporal aggregation. The analysis identifies 55 thematic clusters and measures topic prevalence and lifecycle at the website level.
Dizzy is an open-source crawling and analysis system for onion services. It implements techniques to explore, update, check, and classify onion services at scale without overwhelming the Tor network. It was deployed in April 2021 and used to analyze more than 63.3 million crawled onion webpages, focusing on domain operations, web content, cryptocurrency usage, and web graph.
An arXiv paper presenting a large-scale analysis of the Tor network using a crawler called Mimir, which collects and visits linked content. The authors report a dataset of pages from more than 25k sites and examine network topology, replicated content and content types.
A working paper by John Schriner that focuses on how researchers monitor the Dark Web. It defines onion services and Tor and discusses tools for monitoring and securing onion services.
This dataset maps the network layer of the Invisible Internet Project (I2P), collected using the SWARM-I2P framework, which deployed I2P routers as mapping agents. It documents over 50,000 nodes with metrics such as bandwidth, latency, and uptime, plus network traffic records and geographic distribution. Node identifiers were anonymized. Data is available in CSV and TXT formats on Zenodo, with mapping scripts on GitHub.
Public-health research measuring harmful-content availability and searches on the Tor network.
Community notes
Be the first to share how this project worked for you.
Sign in with a verified account to leave a review or join the discussion.
Sign in to reviewKeep exploring
An arXiv paper presenting a longitudinal analysis of the dark web cybercrime ecosystem. The authors analyze 25,065 websites using 11,403,638 HTML snapshots collected over six years, applying a topic-modeling framework with domain-specific embeddings, density-based clustering and temporal aggregation. The analysis identifies 55 thematic clusters and measures topic prevalence and lifecycle at the website level.
Dizzy is an open-source crawling and analysis system for onion services. It implements techniques to explore, update, check, and classify onion services at scale without overwhelming the Tor network. It was deployed in April 2021 and used to analyze more than 63.3 million crawled onion webpages, focusing on domain operations, web content, cryptocurrency usage, and web graph.
An arXiv paper presenting a large-scale analysis of the Tor network using a crawler called Mimir, which collects and visits linked content. The authors report a dataset of pages from more than 25k sites and examine network topology, replicated content and content types.
A working paper by John Schriner that focuses on how researchers monitor the Dark Web. It defines onion services and Tor and discusses tools for monitoring and securing onion services.
This dataset maps the network layer of the Invisible Internet Project (I2P), collected using the SWARM-I2P framework, which deployed I2P routers as mapping agents. It documents over 50,000 nodes with metrics such as bandwidth, latency, and uptime, plus network traffic records and geographic distribution. Node identifiers were anonymized. Data is available in CSV and TXT formats on Zenodo, with mapping scripts on GitHub.
Public-health research measuring harmful-content availability and searches on the Tor network.
