Pith. sign in

REVIEW 5 major objections 7 minor 42 references

Snorkeling in dark waters: A longitudinal surface exploration of unique Tor Hidden Services (Extended Version)

T0 review · 5 major / 7 minor · reviewed 2026-08-16 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read An eight-month crawl of Tor hidden services finds that about 82% of landing pages are mirrors—exact or near-exact copies—so ignoring duplicates misreads the dark web's size, shape, and content mix.

desk verdict A mirror-aware Tor measurement with a real contribution and a selection-bias problem in the headline percentages; the core idea is sound but the abstract overclaims. read the letter →

arxiv 2504.16836 v1 pith:O7ZHIPZL submitted 2025-04-23 cs.CR

Alfonso Rodriguez Barredo-Valenzuela , Sergio Pastrana Portillo , Guillermo Suarez-Tangil This is my paper · ORCID
classification cs.CR
keywords Tornetworkmeasurementhiddenservicesmirrordetectiondarkwebcontentanalysisonioncybercrimecrawling
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper reports an eight-month crawl of Tor hidden services, carried out by a crawler named Mimir, and argues that about 82% of the landing pages it reached are mirrors—exact or near-exact copies of other pages. It claims that earlier large-scale Tor measurements that ignored these duplicates misread both the topology of the dark web and the distribution of content. To support that, the paper combines a systematic seeding method (keywords derived from underground-forum discussions, fed into Tor search engines), a hybrid hash algorithm for detecting mirrors, and a logistic-regression classifier for content categories. The mirror-aware view changes the picture: counterfeit and pornographic sites dominate among unique pages, and categories like hacking fall in the rankings once copies are removed. A case study on child-abuse material illustrates the practical payoff, detecting 159 unique sites and 505 pages including mirrors, which were reported to law enforcement.

What carries the argument

The load-bearing mechanism is a two-stage mirror-detection pipeline. MD5 catches exact duplicates; for non-identical pages, a fuzzy hash (CTPH) compares full HTML, and when languages differ only the HTML tag structure is compared, with a weighted similarity score (0.7 on content, 0.3 on structure) and a 0.9 threshold for declaring a mirror. Around this sits a shallow breadth-first crawler that follows only external .onion links from landing pages, an automatic seeding stage that derives TF-IDF keywords from underground surface-forum titles and queries Tor search engines, and a logistic-regression content classifier trained on balanced categories from the labeled Duta-10K dataset. The paper validates the classifier on a held-out set (86% accuracy) and benchmarks the mirror detector against MinHash and SimHash, reporting higher precision (0.99 versus 0.40–0.61) because those methods repeatedly match one page to many representatives.

What would settle it

Run the same Mimir crawler and mirror detector starting from seeds built from non-deviant topics (for example news, email, or privacy) or from an independent random sample of live onion addresses; if the mirror share falls well below 82%, the headline figure is an artifact of deviant-focused seeding rather than a property of Tor as a whole.

Watch

Extended reading notes

Core claim

The central discovery is that replicated content is the norm rather than the exception in the Tor hidden-service ecosystem as reached by this crawl. Of 24,911 landing pages collected, 20,790 (about 83%) were detected as mirrors, leaving 4,008 unique onion sites; slightly more than half of the mirrors are exact MD5 matches, and the rest differ only in small ways such as language, prices, or cryptocurrency wallet addresses. From this the paper concludes that any content- or topology-driven measurement of the dark web that does not filter mirrors gives a distorted view. Concretely, without mirror filtering, hacking appears as a top category; after filtering, counterfeit is the largest category and porn and crypto move up. The classifier puts 38% of unique sites in explicitly cybercrime-related categories (Counterfeit, Drugs, Hacking, Locked), but 74.4% of all pages including mirrors fall into those categories, indicating that cybercrime operators mirror their services far more than other operators do.

Load-bearing premise

The crawled subset is representative of the Tor network as a whole: seeds come from underground-forum keywords queried in Tor search engines, and only landing pages are crawled, so the mirror rate and cybercrime share could be inflated if heavily mirrored sites such as counterfeit shops are overrepresented in that sampling path.

Editorial extensions

If this is right

  • Prior large-scale Tor measurements that ignore mirrors misstate both topology and content distribution; mirror filtering changes category rankings, e.g., hacking is not second-most prevalent once duplicates are removed.
  • Mirror-aware analysis lets investigators focus deeper inspection on unique sites: only 5.8% of counterfeit-classified sites and 10% of hacking-classified sites need in-depth review.
  • Because cybercrime operators mirror heavily (81.32% of detected mirrors fall in cybercrime-related categories), mirror detection can help track services that survive takedowns through replicas, as in the child-abuse case where 159 unique sites were detected and some remained operative years later.
  • Systematic keyword seeding from underground forums covers all sites reachable from manual seeds and adds about 81.85% more coverage, suggesting that the method scales beyond hand-crafted seed lists.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The mirror-aware view suggests a standard practice for future dark-web measurement: report both raw and unique-site statistics, since the gap between them is itself a signal of how aggressively content is replicated.
  • The same seeding-plus-mirror-detection recipe could be applied to other anonymous or decentralized networks without central indexes, where duplicate content may inflate apparent ecosystem size.
  • A testable extension is a mirror-churn study: re-crawling the same unique sites over time to measure how quickly replicas appear and disappear would turn this static snapshot into a dynamic model of mirroring behavior.
  • If the mirror rate stayed near 82% under neutral seeding, mirroring would be a structural property of Tor; if it dropped sharply, prior category-prevalence results would only be wrong for deviant-focused crawls, not for Tor in general.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 7 minor

Summary. The paper presents Mimir, a crawler for Tor hidden services, and uses it to collect landing pages from 24,911 accessible .onion sites over an eight-month period. The authors propose a mirror-detection heuristic combining MD5 exact matching with CTPH fuzzy hashing, using a weighted score over HTML content and structure, and report that roughly 82--83% of crawled landing pages are mirrors. They also train a logistic-regression content classifier on the Duta-10K dataset and report that 74.4% of pages relate to cybercrime (Counterfeit, Drugs, Hacking, Locked). A case study identifies 159--165 sites distributing child abuse material, with a subset still online at the time of writing. The central claim is that prior large-scale Tor measurements, which ignore mirrors, give a biased picture of Dark Web topology and content prevalence.

Significance. If the headline numbers were robust, the paper would make a valuable contribution: it would be one of the first mirror-aware longitudinal measurements of Tor, with a systematic seeding methodology and a plausible argument that mirror duplication distorts category-prevalence estimates. The strengths include the scale of the crawl, the explicit attempt to validate mirror detection on 408 manually checked sites, the benchmark against MinHash and SimHash, and the ethically careful handling of illegal content with reporting to law enforcement. However, the significance is conditional because the main quantitative claims rest on a deviant-focused, shallow crawl whose representativeness is not established, and because several numbers in the paper are internally inconsistent. The methodology is a useful advance, but the paper currently overstates the generality of its 82% mirror and 74.4% cybercrime figures.

major comments (5)
  1. [§II-B, §III-A, §V-A] The headline mirror rate and cybercrime share are computed over a sample that is explicitly biased toward deviant content, so they cannot be generalized to the Tor network as a whole. Seeds are obtained by querying Tor search engines with TF-IDF keywords extracted from underground surface forums, plus a small OSINT set, and the crawler visits only landing pages and follows external .onion links. Section V-A acknowledges a coverage limitation, but the abstract and §III-D/E present the 82--83% mirror rate and 74.4% cybercrime share as properties of the Dark Web. A neutral-seed comparison, a statistical correction for the sampling design, or a consistent reframing of the claims as sample-specific is needed before these percentages can support the paper's conclusions about prior work being biased.
  2. [§III-D, Table III, Table VIII] Several central quantitative statements are internally inconsistent. Section III-D reports 24,911 sites, 20,790 mirrors, 4,008 unique sites and 113 surface links, but 20,790/24,911 is 83.5%, whereas the abstract and introduction say '≈82%' and the conclusion says 83%. Table III is not clearly formatted and does not reconcile the seed, site, mirror, and unreachable counts. Table VIII lists 1,571 unique cybercrime sites and 16,840 mirror cybercrime sites, which sum to 18,411, not the reported 18,474, and the corresponding percentages do not match the stated totals. These inconsistencies directly affect the paper's central quantitative claims and must be corrected.
  3. [§II-C, §III-D, Table VI] The mirror-detection validation is incomplete and partly circular. The weights Wc=0.7 and Ws=0.3 and the 0.9 similarity threshold are described as empirically tuned to detect mirrors, and the benchmark in Table VI is built from 1,000 'real unique-mirror pairs' and 1,000 non-mirror pairs, but the text does not specify how the ground truth for those pairs was obtained independently of the algorithm. Manual validation in §III-D covers only pages with at least one mirror (408 sites), not non-mirror pages, so false negatives are not measured. As a result, the reported 97--99% precision does not establish that the 0.9 threshold and the chosen weights correctly separate mirrors from non-mirrors across the whole dataset. An independent ground-truth set with both positive and negative pairs is needed.
  4. [§II-E, §III-E, Table VIII] The 74.4% cybercrime figure is not well supported. The classifier is trained on only 11 categories with up to 200 samples each from Duta-10K, applied only to English sites, and includes 'Locked' (sites closed by authorities) as a cybercrime category, which conflates takedowns with criminal content. The text itself notes the figures are a lower bound, but the abstract and §V-B state the 74.4% as a factual property of the dataset. The paper should report confidence intervals for the classification-based prevalence estimates, state the denominator explicitly (unique vs. all sites, English vs. all languages), and discuss how classifier error propagates to the aggregate percentage.
  5. [§IV, §V-B] The child-abuse case-study numbers are inconsistent. Section IV reports 180 pages found, 165 confirmed unique sites (91.66% accuracy), and then says examining mirrors increased detection to 505 pages, described as a '306% increase'. Section V-B reports 159 unique sites and 505 mirrors. The ratios do not work: 505/180 is about 2.8, not a 306% increase, and 159 differs from 165 without explanation. Since the case study is presented as a concrete contribution and is cited in the abstract and conclusions, these figures need to be reconciled.
minor comments (7)
  1. [Table VII] The table title reads 'Duplication Algorithms Benchmark' but the table compares machine-learning classifiers; it should be titled 'Classification Benchmark' or similar.
  2. [Table III] The table layout is difficult to parse; the row 'Base 4,121 6,816' appears to mix seeds and sites, and the total 39,095 is not derived from the surrounding numbers in an obvious way.
  3. [§III-D] The sentence 'We manually analyze English pages with at least one mirror (450 and 53.38% in total)' is unclear: 53.38% of what total? The subsequent removal of 43 sites from 450 would leave 407, but the text says 408 sites were validated; please clarify.
  4. [§III-D] The text states the algorithm detects '801 mirrors (355 identified with CTPH and 424 with MD5)', but 355 + 424 = 779; one of these numbers is incorrect.
  5. [§V-B] The sentence about hacking pages being inflated 'by ≈2,966%' is not supported by the data presented in Table VIII or Figure 6; the basis for this percentage should be explained or removed.
  6. [§IV] The decimal separator is used inconsistently ('91,66%' in §IV, '91.66%' in §V-B); please standardize to the journal's convention.
  7. [Table XI] The row for [6] reads '[6] [1]', which appears to be a formatting artifact; the row should be cleaned up.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the mirror-rate and content-prevalence results are grounded in externally labeled data and a manually validated detector.

full rationale

The paper's two headline numbers are measurements, not derived predictions. The mirror detector uses MD5 and CTPH with weights (Ws=0.3, Wc=0.7) and a 0.9 threshold that were 'established by empirical evaluation of the effectiveness of the algorithm to detect mirrors' (Sections II-C and III-D). This tuning sets an operating point, but the reported 82-83% mirror rate is the resulting statistic over the crawled dataset, not a parameter fitted to equal that rate. The authors provide independent grounding: manual validation of 408 sites gives 97% precision (Section III-D), and a benchmark against MinHash and SimHash reports precision 0.99 and recall 0.99 for Mimir (Table VI). No equation in the paper reduces the mirror rate to the detector weights by construction. The content classifier is trained on the external Duta-10K labeled dataset [2], so the 74.4% cybercrime share is an application of an independent model, not a fit to the crawled pages being counted. The seeding process intentionally targets deviant content via underground-forum keywords (Section II-B), and the paper explicitly frames the resulting 74.4% as showing 'that Mimir focuses on cybercrime' (Section V-B); whether that statistic is representative of Tor as a whole is a coverage/representativeness limitation acknowledged in Section V-A, not a circular input-output equivalence. The only self-citations (e.g., CrimeBB [30]) are used as a data source for keyword extraction, not as a uniqueness theorem or as a premise that forbids alternative explanations. Thus no load-bearing circular step is present.

Assumptions & free parameters 5 free parameters · 6 assumptions · 2 invented entities

The central measurements rest on a small number of hand-tuned or domain-specific premises. The most important are the mirror similarity weights and threshold, which directly set the 82% figure, and the assumption that a shallow, deviant-seeded crawl represents the wider Tor ecosystem. No new physical or mathematical entities are introduced.

free parameters (5)
  • Mirror similarity weights Wc, Ws = Wc=0.7, Ws=0.3
    Set by empirical evaluation of mirror detection effectiveness (Section III-D); directly controls which pages count as mirrors and thus the headline 82% mirror rate.
  • Mirror similarity threshold = 0.9
    Empirically identified (Section III-D); pages with CTPH-weighted similarity at or above 0.9 are declared mirrors.
  • Classifier category sample cap = 200 per category
    Experimentally established to balance the DUTA-10K training set (Sections II-E and III-E).
  • Crawl retry limit = 5 attempts
    Design choice to handle Tor volatility (Section II-B).
  • Keyword selection for seeds = not specified numerically
    Seeds are derived from TF-IDF keywords over an underground forum corpus; the exact keyword list and selection thresholds are not disclosed (Section II-B).
assumptions (6)
  • domain assumption Landing pages and their outbound .onion links are sufficient to represent Tor network topology and content prevalence.
    The crawler deliberately performs shallow crawling at depth 1 and builds the network graph from landing-page links only (Sections II-B and II-D); this excludes subpages and login-gated content.
  • domain assumption DUTA-10K category labels from 2017 remain valid for content crawled in 2021-22.
    The classifier is trained on labels and raw HTML from DUTA-10K, collected in 2017 (Sections II-E and III-E); category drift over four years is not assessed.
  • domain assumption Underground forum vocabulary is a relevant source for discovering deviant Tor content.
    Seeds are generated from TF-IDF keywords extracted from underground forum titles (Section II-B); if the corpus is not representative, the crawl is biased.
  • ad hoc to paper CTPH similarity of 0.9 with the chosen weights is a valid mirror relation across the entire dataset.
    The threshold and weights are fixed by the authors' empirical evaluation (Section III-D) and applied globally without per-site calibration.
  • domain assumption HTTP 200 responses indicate a live site and five attempts are enough to classify unreachable sites.
    Used to decide reachability in the crawl (Section II-B).
  • domain assumption Languages can be reliably detected by the langdetect library.
    Language is used in mirror detection and to restrict classification to English pages (Sections II-B and II-E).
invented entities (2)
  • Mimir crawler
    purpose: Automated breadth-first collection of Tor hidden service landing pages.
    The crawler is described but not released; its behavior is only evidenced through the paper's reported results.
  • HTML rendering validation tool
    purpose: Render crawled HTML text without media for manual mirror and CSAM validation.
    Used for the 408-site validation and the CSAM confirmation; not released, so its output cannot be independently checked.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Snorkeling in dark waters: A longitudinal surface exploration of unique Tor Hidden Services (Extended Version)." pith.science (2026). https://pith.science/paper/O7ZHIPZL

@misc{pith2026250416836,
  author       = {Pith},
  title        = {Pith review of: Snorkeling in dark waters: A longitudinal surface exploration of unique Tor Hidden Services (Extended Version)},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/O7ZHIPZL}},
  note         = {Machine review of arXiv:2504.16836}
}
read the original abstract

The Onion Router (Tor) is a controversial network whose utility is constantly under scrutiny. On the one hand, it allows for anonymous interaction and cooperation of users seeking untraceable navigation on the Internet. This freedom also attracts criminals who aim to thwart law enforcement investigations, e.g., trading illegal products or services such as drugs or weapons. Tor allows delivering content without revealing the actual hosting address, by means of .onion (or hidden) services. Different from regular domains, these services can not be resolved by traditional name services, are not indexed by regular search engines, and they frequently change. This generates uncertainty about the extent and size of the Tor network and the type of content offered. In this work, we present a large-scale analysis of the Tor Network. We leverage our crawler, dubbed Mimir, which automatically collects and visits content linked within the pages to collect a dataset of pages from more than 25k sites. We analyze the topology of the Tor Network, including its depth and reachability from the surface web. We define a set of heuristics to detect the presence of replicated content (mirrors) and show that most of the analyzed content in the Dark Web (82% approx.) is a replica of other content. Also, we train a custom Machine Learning classifier to understand the type of content the hidden services offer. Overall, our study provides new insights into the Tor network, highlighting the importance of initial seeding for focus on specific topics, and optimize the crawling process. We show that previous work on large-scale Tor measurements does not consider the presence of mirrors, which biases their understanding of the Dark Web topology and the distribution of content.

Figures

Figures reproduced from arXiv: 2504.16836 by the authors.

Figure 1
Figure 1. Overview of the methodology followed for our study. [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. Dynamic workload algorithm example with 4 [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. Workflow of the mirror detection algorithm. The [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: Content classification pipeline. nature of the ground truth, we limit the content analysis to only English sites. In total, we removed 2,314 samples (26.8%) and retained 6,321 samples (73.2%). The training process of the content classifier is divided into three tasks a…
Figure 5
Figure 5. Figure 5: Minor modifications in the HTML of mirrored pages. [PITH_FULL_IMAGE:figures/full_fig_p008_5.png]
Figure 6
Figure 6. Figure 6: Histogram representing the distribution of sites per [PITH_FULL_IMAGE:figures/full_fig_p009_6.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

42 extracted references · 34 canonical work pages

  1. [1]

    Classifying illegal activities on tor network based on web textual contents,

    M. W. Al Nabki, E. Fidalgo, E. Alegre, and I. de Paz, “Classifying illegal activities on tor network based on web textual contents,” in Proceedings of the 15th Conference of the European Chapter of the Association for Computational Linguistics: V olume 1, Long Papers . Valencia, Spain: Association for Computational Linguistics, Apr. 2017, pp. 35–43. [Onli...

    work page 2017

  2. [2]

    Torank: Identifying the most influential suspicious domains in the tor network,

    M. W. Al-Nabki, E. Fidalgo, E. Alegre, and L. Fern ´andez-Robles, “Torank: Identifying the most influential suspicious domains in the tor network,” Expert Systems with Applications , vol. 123, pp. 212–226, 2019

    work page 2019

  3. [3]

    The Power Of Simplicity: Why Simple Linear Models Outperform Complex Machine Learning Techniques -- Case Of Breast Cancer Diagnosis

    M. A. Arshad, S. Shahriar, and K. Anjum, “The power of sim- plicity: Why simple linear models outperform complex machine learning techniques–case of breast cancer diagnosis,” arXiv preprint arXiv:2306.02449, 2023

    work page Pith review arXiv 2023

  4. [4]

    Structure and content of the visible darknet,

    G. Avarikioti, R. Brunner, A. Kiayias, R. Wattenhofer, and D. Zin- dros, “Structure and content of the visible darknet,” arXiv preprint arXiv:1811.01348, 2018

    arXiv 2018

  5. [5]

    Phishing with a darknet: Imitation of onion services,

    F. Barr-Smith and J. Wright, “Phishing with a darknet: Imitation of onion services,” in 2020 APWG Symposium on Electronic Crime Research (eCrime). IEEE, 2020, pp. 1–13

    work page 2020

  6. [6]

    Onion under microscope: An in-depth analysis of the tor web,

    M. Bernaschi, A. Celestini, M. Cianfriglia, S. Guarino, F. Lombardi, and E. Mastrostefano, “Onion under microscope: An in-depth analysis of the tor web,” World Wide Web, pp. 1–27, 2022

    work page 2022

  7. [7]

    Spiders like onions: On the network of tor hidden services,

    M. Bernaschi, A. Celestini, S. Guarino, F. Lombardi, and E. Mastrostefano, “Spiders like onions: On the network of tor hidden services,” in The World Wide Web Conference , ser. WWW ’19. New York, NY , USA: Association for Computing Machinery, 2019, p. 105–115. [Online]. Available: https://doi.org/10.1145/3308558.3313687

    arXiv 2019

  8. [8]

    Ransomware threat actors,

    Breachsense, “Ransomware threat actors,” https://www.breachsense.io/ ransomware-gangs/, last accessed: 22-03-2023

    work page 2023

Show all 42 references
  1. [9]

    Min- wise independent permutations,

    A. Z. Broder, M. Charikar, A. M. Frieze, and M. Mitzenmacher, “Min- wise independent permutations,” in Proceedings of the thirtieth annual ACM symposium on Theory of computing , 1998, pp. 327–336

    1998

  2. [10]

    Characterizing the redundancy of darkweb .onion services,

    P. Burda, C. Boot, and L. Allodi, “Characterizing the redundancy of darkweb .onion services,” in Proceedings of the 14th International Conference on Availability, Reliability and Security , ser. ARES ’19. New York, NY , USA: Association for Computing Machinery, 2019. [Online]....

    2019

  3. [11]

    The language of legal and illegal activity on the darknet,

    L. Choshen, D. Eldad, D. Hershcovich, E. Sulem, and O. Abend, “The language of legal and illegal activity on the darknet,” arXiv preprint arXiv:1905.05543, 2019

    1905 arXiv

  4. [12]

    Selfrando: Securing the tor browser against de-anonymization exploits

    M. Conti, S. Crane, T. Frassetto, A. Homescu, G. Koppen, P. Larsen, C. Liebchen, M. Perry, and A.-R. Sadeghi, “Selfrando: Securing the tor browser against de-anonymization exploits.” Proc. Priv. Enhancing Technol., vol. 2016, no. 4, pp. 454–469, 2016. 14

    2016

  5. [13]

    Social technologies for digital wellbeing among marginalized communities,

    M. DeVito, A. Walker, J. Birnholtz, K. Ringland, K. Macapagal, A. Kraus, S. Munson, C. Liang, and H. Saksono, “Social technologies for digital wellbeing among marginalized communities,” in CSCW 2019 Companion - Conference Companion Publication of the 2019 Computer Supported Co...

    2019

  6. [14]

    Exploring and analyzing the dark web: A new alchemy,

    M. Faizan and R. A. Khan, “Exploring and analyzing the dark web: A new alchemy,” First Monday, 2019

    2019

  7. [15]

    On power-law relation- ships of the internet topology,

    M. Faloutsos, P. Faloutsos, and C. Faloutsos, “On power-law relation- ships of the internet topology,” ACM SIGCOMM computer communica- tion review, vol. 29, no. 4, pp. 251–262, 1999

    1999

  8. [16]

    Dark web,

    K. M. Finklea, “Dark web,” Congressional Research Service, Tech. Rep., 2017

    2017

  9. [17]

    Privacy, anonymity, and per- ceived risk in open collaboration: A study of tor users and wikipedians,

    A. Forte, N. Andalibi, and R. Greenstadt, “Privacy, anonymity, and per- ceived risk in open collaboration: A study of tor users and wikipedians,” in Proceedings of the 2017 ACM Conference on Computer Supported Cooperative Work and Social Computing , 2017, pp. 1800–1811

    2017

  10. [18]

    E. Hartney. (2023, May 01) Deviant behavior: Definition, causes, and types. [Online]. Available: https://www.verywellmind. com/socially-acceptable-to-socially-deviant-addictions-22243

    2023

  11. [19]

    The dark web dilemma: Tor, anonymity and online policing,

    E. Jardine, “The dark web dilemma: Tor, anonymity and online policing,” Global Commission on Internet Governance Paper Series , no. 21, 2015

    2015

  12. [20]

    Darkbert: A language model for the dark side of the internet,

    Y . Jin, E. Jang, J. Cui, J.-W. Chung, Y . Lee, and S. Shin, “Darkbert: A language model for the dark side of the internet,” arXiv preprint arXiv:2305.08596, 2023

    2023 arXiv

  13. [21]

    Extrapolating network totals from hidden-service statistics,

    G. Kadianakis and K. Loesing, “Extrapolating network totals from hidden-service statistics,” Tor Tech Report, no. 01 (001, 2015

    2015

  14. [22]

    Trust and relationship devel- opment among users in dark web child sexual exploitation and abuse networks: a literature review from a psychological and criminological perspective,

    J. A. Kloess and M. van der Bruggen, “Trust and relationship devel- opment among users in dark web child sexual exploitation and abuse networks: a literature review from a psychological and criminological perspective,” Trauma, Violence, & Abuse, p. 15248380211057274, 2021

    2021

  15. [23]

    Identifying almost identical files using context triggered piecewise hashing,

    J. Kornblum, “Identifying almost identical files using context triggered piecewise hashing,” Digital investigation, vol. 3, pp. 91–97, 2006

    2006

  16. [24]

    Examining the trends and op- erations of modern dark-web marketplaces,

    V . Labrador-Ortiga and S. Pastrana, “Examining the trends and op- erations of modern dark-web marketplaces,” in Proceedings of the 2022 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW). IEEE, 2022

    2022

  17. [25]

    Churn prediction with sequential data and deep neural networks. a comparative analysis,

    C. G. Mena, A. De Caigny, K. Coussement, K. W. De Bock, and S. Lessmann, “Churn prediction with sequential data and deep neural networks. a comparative analysis,” arXiv preprint arXiv:1909.11114 , 2019

    1909 arXiv

  18. [26]

    Evolution of dark web threat analysis and detection: A systematic approach,

    S. Nazah, S. Huda, J. Abawajy, and M. M. Hassan, “Evolution of dark web threat analysis and detection: A systematic approach,” IEEE Access, vol. 8, pp. 171 796–171 819, 2020

    2020

  19. [27]

    Ahmia — search tor hidden services

    J. Nurmi, “Ahmia — search tor hidden services.” [Online]. Available: https://ahmia.fi/

  20. [28]

    The tor dark net,

    G. H. Owenson and N. J. Savage, “The tor dark net,” 2015

    2015

  21. [29]

    Measuring ewhoring,

    S. Pastrana, A. Hutchings, D. Thomas, and J. Tapiador, “Measuring ewhoring,” in Proceedings of the Internet Measurement Conference , 2019, pp. 463–477

    2019

  22. [30]

    Crimebb: Enabling cybercrime research on underground forums at scale,

    S. Pastrana, D. R. Thomas, A. Hutchings, and R. Clayton, “Crimebb: Enabling cybercrime research on underground forums at scale,” in Proceedings of the 2018 World Wide Web Conference , 2018, pp. 1845– 1854

    2018

  23. [31]

    icop: Automatically identifying new child abuse media in p2p networks,

    C. Peersman, C. Schulze, A. Rashid, M. Brennan, and C. Fischer, “icop: Automatically identifying new child abuse media in p2p networks,” in 2014 IEEE Security and Privacy Workshops , 2014, pp. 124–131

    2014

  24. [32]

    Comparison of naive bayes, random forest, decision tree, support vector machines, and logistic regression classifiers for text reviews classification,

    T. Pranckevi ˇcius and V . Marcinkevi ˇcius, “Comparison of naive bayes, random forest, decision tree, support vector machines, and logistic regression classifiers for text reviews classification,” Baltic Journal of Modern Computing , vol. 5, no. 2, p. 221, 2017

    2017

  25. [33]

    T. Project. (2023, Feb,27) Tor research safety board. [Online]. Available: https://research.torproject.org/safetyboard/

    2023

  26. [34]

    The md5 message-digest algorithm,

    R. Rivest, “The md5 message-digest algorithm,” Tech. Rep., 1992

    1992

  27. [35]

    Language detection library for java,

    N. Shuyo, “Language detection library for java,” 2010. [Online]. Available: http://code.google.com/p/language-detection/

    2010

  28. [36]

    Measuring the longitudinal evolution of the online anonymous marketplace ecosystem,

    K. Soska and N. Christin, “Measuring the longitudinal evolution of the online anonymous marketplace ecosystem,” in 24th USENIX Security Symposium (USENIX Security 15) , 2015, pp. 33–48

    2015

  29. [37]

    Thwarting obfuscated malware via differential fault analysis,

    G. Suarez-Tangil, J. E. Tapiador, F. Lombardi, and R. Di Pietro, “Thwarting obfuscated malware via differential fault analysis,” Com- puter, vol. 47, no. 6, pp. 24–31, 2014

    2014

  30. [38]

    Torch search – search the dark net,

    TorSearch, “Torch search – search the dark net,” https://torchsearch. wordpress.com/, 2019, last accessed: 19-05-2022

    2019

  31. [39]

    Plug and prey? measuring the commoditization of cybercrime via online anonymous markets,

    R. Van Wegberg, S. Tajalizadehkhoob, K. Soska, U. Akyazi, C. H. Ganan, B. Klievink, N. Christin, and M. Van Eeten, “Plug and prey? measuring the commoditization of cybercrime via online anonymous markets,” in 27th USENIX security symposium (USENIX security 18) , 2018, pp. 1009–1026

    2018

  32. [40]

    Visitor — search engine for the dark-web,

    VisiTor, “Visitor — search engine for the dark-web,” http://uzowkytjk4da724giztttfly4rugfnbqkexecotfp5wjc2uhpykrpryd. onion/search/?q=, 2022, last accessed: 19-05-2022

    2022

  33. [41]

    A comprehensive and long-term evaluation of tor v3 onion services,

    C. Wang, J. Luo, Z. Ling, L. Luo, and X. Fu, “A comprehensive and long-term evaluation of tor v3 onion services,” in Proceedings of the 42nd IEEE International Conference on Computer Communications (INFOCOM). IEEE, 2023

    2023

  34. [42]

    A broad evaluation of the tor english content ecosystem,

    M. Zabihimayvan, R. Sadeghi, D. Doran, and M. Allahyari, “A broad evaluation of the tor english content ecosystem,” in Proceedings of the 10th ACM Conference on Web Science , 2019, pp. 333–342

    2019

Pith tools

Reviewed August 16, 2026 · model on record in the stance chip above.