A First Look at References From The Dark To Surface Web World

A First Look at References from the Dark to Surface Web World
MAHDIEH ZABIHIMAYVAN and DEREK DORAN, Wright State University
Tor is one of the most well-known networks that protects the identity of both content providers and their clients against any tracking
or tracing on the Internet. So far, most research attention has been focused on investigating the security and privacy concerns of
Tor and characterizing the topic or hyperlink structure of its hidden services. However, there is still lack of knowledge about the
information leakage attributed to the linking from Tor hidden services to the surface Web. This work addresses this gap by presenting
a broad evaluation of the network of referencing from Tor to surface Web and investigates to what extent Tor hidden services are
arXiv:1911.07814v1 [cs.SI] 18 Nov 2019
vulnerable against this type of information leakage. The analyses also consider how linking to surface websites can change the overall
hyperlink structure of Tor hidden services. They also provide reports regarding the type of information and services provided by
Tor domains. Results recover the dark-to-surface network as a single massive connected component where over 90% of Tor hidden
services have at least one link to the surface world despite their interest in being isolated from surface Web tracking. We identify that
Tor directories have closest proximity to all other Web resources and significantly contribute to both communication and information
dissemination through the network which emphasizes on the main application of Tor as information provider to the public. Our study
is the product of crawling near 2 million pages from 23,145 onion seed addresses, over a three-month period.
CCS Concepts: •Security and privacy → Security services; •Networks → Network properties; •Information systems → Deep
web;
Additional Key Words and Phrases: Tor, Anonymity network, Information leakage, Dark Web
ACM Reference format:

Mahdieh Zabihimayvan and Derek Doran. 2018. A First Look at References from the Dark to Surface Web World. 1, 1, Article 1
(January 2018), 15 pages.
DOI: 10.1145/1122445.1122456
1 INTRODUCTION
Anonymity networks prevent traffic analysis and network activity monitoring by complicating any possible tracking
or tracing of users identity on the Web. The “Dark Web” defines a class of anonymity networks that require unique
application layer protocols and authorization schemes to access the Internet. Tor [26] has emerged as the most popular
dark nets in contrast to many other dark networks such as I2P [12], Riffle [17], and Freenet[13]. It provides anonymous
communication for both senders and receivers using an encryption scheme similar to onion routing [14]. Tor hidden
services, also called Tor domains, further provide privacy for users who run Internet services on Tor. Tor clients can
directly access it using a Tor Web browser that provides their anonymity while browsing the Internet. In addition to the
direct way, users can utilize Tor proxies such as tor2web that alleviates connection with no need to install the Tor Web
browser. In this way, client types the hostname of onion address in a regular Web browser and replace ‘.onion’ with
Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not
made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components
of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to
redistribute to lists, requires prior specific permission and/or a fee. Request permissions from permissions@acm.org.
© 2018 ACM. Manuscript submitted to ACM
Manuscript submitted to ACM 1

2 Zabihimayvan and Doran
‘.tor2web.io’. Then, tor2web, as a “middleman” between the client and the hidden server, retrieves the requested content
from dark Web and forwards it to the client. However, if the requested page has any hyperlink to surface/regular
websites, their addresses will not be rewritten by the Tor proxy. Hence, the Web browser used by the client can observe
the identity of client and bypass the anonymization mechanism.
Investigating the security and privacy threats on Tor has been attracted significant attention [20] [6] [5] [11] [2] [23] [24].
Information leakage is a privacy threat that attributes to the connections onion domains have with the surface Web [25].
There are two third-parties that can take advantage of this information leakage: (1) destination domains on the surface
Web. As client traffic can be monitored by the Web browser, the destination domain is able to observe the identity
of the Tor user. A related work reports that Google, Facebook, and Twitter can respectively observe 13.20%, 1.03%,
and 0.88% of the traffic towards Tor hidden services [25]. (2) A malicious hidden service simply links to a surface
website, both controlled by the same attacker, and monitors the traffic of users who visit this surface website using
Tor proxies. The rise in the number of hyperlinks from dark domains to surface websites consequently increases the
probability of information leakage in both scenarios.
In spite of recent efforts to discover privacy concerns triggered by linking from Tor to surface Web [25] and to
study the reference network of hidden services in Tor [4] [10] [15] [29], there has been no study on characterizing the
network of references from dark to surface Web. Such an investigation can reveal to what extent the Tor network is
vulnerable against the information leakage caused by referring to surface websites and could give hints on how to
improve the design of Tor hidden services to avoid such threats. To this end, we conduct a micro-level investigation on
network of references from dark domains to surface websites using well-known network measurements and consider
how the network generated by the dark-to-surface references differs with the linking pattern of Tor hidden services.
We scrutinize results regarding the type of content and information provided by Tor services.
Our findings reveal that, in contrast to the hyperlink structure of Tor domains, the dark-to-surface reference network
is a small world where most resources participate in a single massive connected component with a small number
of isolated Tor domains. Investigation on neighbourhood diversity of Tor domains indicates only a few Tor hidden
services are immune against information leakage caused by linking to surface Web while over 90% contain at least
one link to the surface. Moreover, in spite of the fact that dark domains intend to remain isolated, linking to surface
raises their tendency to cluster. We also evaluate the types of services Tor domains provide and find that popular Tor
directories have the maximum proximity to Web resources and significantly contribute to both communication and
information dissemination through the dark-to-surface network. A few domains with other types of services including
news, forums, pornography, and multimedia have also significant role in propagating information through the network.
Analysis on the degree distribution shows popular surface websites such as GitHub, Twitter, and Facebook also receive
large number of references from dark domains which indicate that they are popular even among Tor services.
This paper is organized as follows: Section 2 discusses related work on characterizing the Tor network as well as
studies conducted on Tor security issues. Section 3 presents the description and basic statistics of data used in the
analyses. Section 4 investigates linking process of Tor services to dark/surface resources and presents the evaluation
results. Section 5 analyzes the reference view of Tor services using well-known network metrics. Finally, Section 6
summarizes the main conclusions and discusses the future work.
Manuscript submitted to ACM

A First Look at References from the Dark to Surface Web World 3
2 RELATED WORK
Previous research on Tor can be categorized into two classes: (1) work which has focused on Tor relay network,
understanding the security, privacy, and topological properties of Tor network; and (2) studies on characterizing
different types of information and services hosted on Tor.
Towards understanding Tor security and privacy issues, Mohaisen et al. studied the possibility of observing Tor
requests at global DNS infrastructure that could threaten the private location of servers hosting Tor services, and
name/onion address of Tor domains [21]. McCoy et al. tried to answer how Tor is (mis-)used and what clients and
routers contribute to this usage [20]. They also proposed some remedies to improve the implementation of Tor network.
Focusing on privacy of Tor hidden services, Biryukov et al. analyzed the traffic of services to evaluate their vulnerability
against deanonymizing and take down attacks [6]. They demonstrated how current flaws in design and implementation
of Tor hidden services can help attackers find the popularity of a hidden service, harvest its descriptor in a short time, and
find its guard relay. They further proposed a large-scale attacking technique to disclose the IP address of notable number
of Tor hidden services over one year. All the proposed techniques are evaluated over Silk Road, DuckDuckGo search
engine, a case of a botnet that utilizes Tor hidden services as command/control channels. Biryukov and Pustogarov
indicated how using bitcoin over Tor can help man-in-the-middle attacks to fully observe information transmitted
between Tor clients who use Bitcoin cryptocurrency [5]. In [11], Cambiaso et al. presented an exhaustive investigation
on different types of security concerns over Tor network. Based on purpose of the attack, various threats are categorized
into client-side, server-side, and network attacks. Bauer et al. investigated how flaws in Tor routing optimization
approach can cause end-to-end traffic analysis attack [2]. They evaluated the proposed attacks on PlanetLab and propose
solutions to mitigate the severity of the threats. Sanatinia and Noubir demonstrated a man-in-the-middle attack on
Tor hidden services that is mounted by an attacker who knows the private key of a hidden service [23]. In another
work, Sanatinia et al. investigated the longevity of Tor hidden services with respect to the privacy of Tor users and
services [24]. They indicated how it is possible to estimate the lifetime of hidden services with fairly high accuracy
using a small percent of Tor HSDir relays.
The topological properties of Tor, at physical and logical levels, are only beginning to be studied. Xu et al. quantitatively
evaluated the structure of four terrorist and criminal related networks, one of which is from Tor [27]. Sanchez-Rola et
al. conducted a broader structural analysis over 7,257 Tor domains [25]. They find a surprising relation between Tor
and the surface Web: there are more links from Tor domains to the surface Web than to other Tor domains. Bernaschi
et al. presented a characterization study on topology of Tor network graph and investigated the persistence of hidden
services and their hyperlinks [4]. All analyses are conducted over three different snapshots of Tor captured during a
five-month period. They also compared Tor with other social networks and surface Web graphs using well-known
metrics. In another similar work [3], Bernaschi et al. investigated measurements to evaluate and characterize Tor hidden
services data and topology of their network. They provided a critical discussion on possible data collection techniques
for dark Web and conducted analyses on the relationship between Tor English content and its topology. Focusing on
deployment and mirroring of Tor hidden services, Burda et al. provided an extensive investigation on redundancy of Tor
services across time and space [10]. Similarly, Griffith et al. investigated the graph theoretic properties of Tor network
and compared it with previous analyses conducted on the surface Web [15]. The study considers bow-tie structure,
robustness and fragility against node removal, and the importance of reciprocal connections in the comparisons.

3 DATASET DESCRIPTION
We conducted a comprehensive multi-threaded crawl of the Tor network to collect data for this research. The crawling
strategy extracts the HTML of any Tor website reachable by a depth-first search up to depth 4 beginning from a seed list
of 23,145 onion addresses. The seed list was built by merging the list used in a recent study [25] into those achieved by
manual exploration of Reddit, Quora, Ahima, and other well-known surface Web directories during the time performing
the crawls. Although a manually collected seed list may carry the risk of missing some parts of the dark network, its
hidden nature makes it unlikely for there to ever be a single major directory of Tor Hidden services. We are confident
that this way results in a broad crawling of Tor because Reddit, Quora, Ahima, and other surface Web directories are
well-known among Tor users for providing the latest news and information about Tor and its hidden links. It suggests
that these seeds are at worst practically helpful, and at best are ideal as entry points to the world of Tor. The crawlers
are also assigned to cover all hyperlinks up to depth 4 from every entry page to make the data collection as broad as
possible.
Due to rapid changes in content and structure of Tor [25] and temporary downtime for some domains, three crawls
were repeated in June, August, and September 2019. To control the variability in the up and down time of hidden
services, the union of the Tor sites collected during the three crawls were considered for the analysis. To prevent any
access control polices, request rate limiters, and crawler blockers which may interrupt the data collection, crawlers only
request HTML and follow hyperlinks, and do not download the full content of Web pages. A total of 1,905,714 distinct
pages were captured across all crawls. To classify the crawled pages as being from the surface or from Tor, any webpage
with suffix ‘.onion’ was classified as a Tor page, while the remainder are considered to be from the surface Web.
We build a graph (presented in Figure 1) where vertices represent dark Web domains and surface websites and
a directed relation indicates a hyperlink from a dark Web domain to a dark or surface Web domain. We avoided
exploring the surface websites; thus, the graph does not contain any edges from surface Web nodes to other vertices. The
investigation considers how Tor domains link to other resources on either dark or surface Web and presents analyses
on the characteristics of this hyperlink structure conditioned by the type of service they provide.
First, we examine some basic statistics of the network indicated in Table 1. We find a sparse network with only
29,519 directed edges and 6,882 nodes 1 . Nodes colored in red in Figure 1 indicate Tor domains and their population
(3,288 nodes) is approximately equal to the number of surface websites (3,593) which are green nodes. The average
shortest path length also represents that by average, each node is reached from any other node using 4 edges.
The network also includes 127 weakly connected components where the largest one contains 6,564 vertices (95%)
and the others with 28 and 13 nodes are the second and third largest connected components of this network. This
implies that the pattern Tor services use to link to surface/dark resources make almost all the nodes connected in
one single massive component. Hence, similar to other socio-technical networks [9], the formation process of this
network encourages linking to others to alleviate information dissemination through the network. The second and
third connected components contains links between bitcoin and gambling Tor services with related websites on the
surface Web which are not referred by other Tor domains.
To gain a perspective on the information provided by Tor hidden services, we employ an unsupervised content
discovery and labeling procedure that we previously proposed [29]. The process runs the content of every Tor Web
page 2 through the Latent Dirichlet Allocation (LDA) [7] and Graph-based Topic Labeling (GbTL) [18] algorithms to
1 All self-loops and multi edges have been removed from this graph.
2 where content is defined as any string outside of a markdown tag
www.luusa.org jobportal.99gi.ga www.planet-traffic.com gcardscr6zwjya2s.onion

gcardstguk366hru.onion criptocoin.gymhost.com.br users.systemli.org multi-vpn.biz manitu.de hcwyio655r2m3mvytp4krn4u3ttjggrnmlpkbykxvc3nc5u3kcuhsjid.onion
www.clixsense.com vap65fi7vo4az4dnq6qpooikg3qkakxqw2xllfsukpe5o6g3kocfsvyd.onion
press.albin.gq
www.thejetty.com.au oss7wrm7xvoub77o.onion serve.williamhill.com
www.etoy.com
linuxbierwanderung.org worketic.99gi.ga festore-dumps.ru
dannyayers.com serve.joylandcasino.com
jobportal.albinxxrvcqoq4cz.onion:8083 rliqc2nfxfocwt6q.onion
www.lugbz.org 99gi.ga microlancer.99gi.ga www.mercadobitcoin.com.br
www.karlstadunix.nu
lln.udev.org gcardsmfp2ub6bwt.onion
www.waag.org
10th.debian.or.jp worketic.albinxxrvcqoq4cz.onion:8083 adserving.unibet.com ccgoldchgewmd5kz.onion
www.belug.de www.albin.gq xdedic.biz dfasyuoatwcchfgd.onion
www.old-emerald-isle.de adlinkfly.99gi.ga 54ce5x7l4m3t2spm.onion
www.fede-ulg.org buug.de blue3237xytrz5rk.onion:8083 www.favorite-casino.com opensolution.org h2qkxasmmqdmyiov.onion hdjd6wv7hjngjhkb.onion 5nwssk6i3564lxafg5sc3ccpsaenptntxjkmcnzf6y7xb6iwrqrgb5qd.onion
www.hhlug.de
www.ivt.com.au
debian.gabrovo.com bemusic.albin.gq 5wupyyzf4tcuicun.onion
www.debian.or.jp
oclug.on.ca torgle5fj664v7pf.onion www.plus500.com
bad.debian.net buyccoq36hlj6etg.onion trump-dmps.ru castorticker.de
www.mexicalirose.com.auwww.bxlug.be
plug.phoenix.az.us albinxxrvcqoq4cz.onion
adlinkfly.albinxxrvcqoq4cz.onion:8083
debian-sv.tk krypto.99gi.ga creditlwkdnptwla.onion 34kazh42qxxm7c6cephtycncax34tqnooxu6t326mvgdf3yignapbaqd.onion
ursine.ca www.liqpaycasino.com
www.debianmexico.org
tmail.albin.gq slilpp.org
www.penguin.cz krypto.albinxxrvcqoq4cz.onion:8083 serve.eurogrand.com starcomproj.com ggqnzuk27367qpvjrkgvc7ywozpnvhpk7pjap6eyg6trhkohbnda6wqd.onion
membres.lycos.fr woocommerce.com
codebin.albin.gq gcards7xd3x5fqmy.onion
www.entropia.de www.karamba.com dlnfeuawnyh5fjlc.onion www.systemli.org uas-shop.ru
microlancer.albinxxrvcqoq4cz.onion:8083
shortme.99gi.ga gostats.com
www.aklug.org game.albin.gq www.megamoneygames.com
b5tearqs4v4nvbup.onion me6juzsbhkt5244k.onion
tgs5dkeqkg5hrjjk.onion
shortme.albinxxrvcqoq4cz.onion:8083 7244rqnvwo6bqpvw.onion
books.albin.gq 5zkfuvtrpotg2nzd.onion
beancoin.99gi.ga
press.albinxxrvcqoq4cz.onion
books.albinxxrvcqoq4cz.onion sipgate.de
etherpad.org
j7652k4sod2azfu6.onion
shopopd7gjuo5kqr.onion
www.irs.gov smstrade.de
systemli.org
fsfe.org
kowloonqle4sb2c7.onion
www.cutercounter.com
www.hostway.com
www.linuxiskolen.no
www.ubuntulinux.org
www.progeny.com www.intel.com
tui7xt7eap3stsbb.onion
djkiri5jiruhxv7u.onion
www.netapp.com
www.linux-ag.com
www.univention.de ytxlukk2plqbh2mg.onion
www.coss.fi www.linux-magazine.com wfgtmn3anjbvyebz.onion
www.ropecon.fi
minerlock.com www.hut.fi 6d7e7jfpgriqyj43.onion
ejff4qtnzhfwyahc.onion
www.linux-aktivaattori.org
www.damicon.fi
www.movial.fi
www.valinux.co.jp www.nokia.com www.bitcoinabc.org
www.netcraft.com blog.zeit.de coinatmradar.com
the.earth.li
www.ebook.de
www.uk.debian.org download.derwesten-recherche.org
upload.derwesten-recherche.org reservistenverband.de
www.amazon.de
gulfnews.com www.guardian.co.uk
www.jabber.org vpacxea7vj3dff3c.onion
httpd.apache.org
3m2tlhjsoxws2akz.onion swp-berlin.orgwww.diw.de
www.buecher.de www.soukmagazine.de
www.carlsen.de
wk6nc6liyporkjtp.onion www.opendatacity.de
www.otto-brenner-preis.de
www.linspire.com www.virustotal.com isaf.nato.int
ahde54pibrd3ddlx.onion soldatenglueck.de
augengeradeaus.net derwesten.de
www.hp.com nachtwei.de bundeswehr.de 3ug6mfk3yeumvqnv.onion
vincent.bernat.ch#using-origin-validation-in-the-datacenter www.p2k2sms.nl www.randomhouse.de
earthqfvaeuv5bla.onion review.opendev.org newiomdqqdgtblp7.onion www.softwarelivre.org www.derwesten.de aan-afghanistan.com
www.zeit.de www.lucky-lucas.com
oskuro.net
www.docker.com www.oreilly.com www.spamcop.net
www.projecthoneypot.org wardocumentaryfilms.com
words.bombast.net www.netsplit.com defense.gov freelotto.su www.aurumage.com
scons.org www.xandros.com www.bundeswehr.de
help.github.com www.linuxmall.com.br www.egopaycasino.com
docs.gurock.com bugzilla.opensuse.org esiweb.org www.derwesten-recherche.org
twitter.github.com www.dradio.de member.wmrcasino.com
cimicweb.org
wiki.derwesten-recherche.org www.5centcasino.com
cmake.org blog.zouish.org
retrofilmvault.com www.rocker-project.org www.4linux.com.br mako.yukidoke.org afghanopoly.wordpress.com books.google.de wlpinnaclesports.adsrv.eacdn.com
www.smbc-comics.com www.cncf.io
enc.com.au langui.sh kmuto.jp www.dw.de tcf.org www.spiegel.de www.online-shans.com
debconf20.debconf.org savannah.nongnu.org docs.nucleuscms.org www.alibris.co.uk www.perfectmoney.com
www.raspberrypi.org software.opensuse.orgtianon.github.io
artinvoice.hu bora.uib.no wiki.nucleuscms.org wlpinnacle.adsrv.eacdn.com
pogomr6vxxpemc35.onion.link nucleuscms.org ag-afghanistan.de www.zend.com
stat.ethz.ch www.lysator.liu.se www.stern.de
www.rust-lang.org
www.opensuse.org flathub.org member.wmr-ruletka.comwww.wmr-ruletka.com
nico.dorfbrunnen.eu cynic.cc bugzilla.mozilla.org www.debconf.org skins.nucleuscms.org
groups.io dev.nucleuscms.org
vincent.bernat.ch#build qa.debian.org 56k.be
engineering.nyu.edu
brave.com www.freexian.comwww.quaxio.com vandereecken.me www.i.ua
www.econ.uiuc.edu manpages.debian.org forum.nucleuscms.org larsjung.de member.grand-ruletka.com
www.grand-ruletka.com
www.mythic-beasts.com mltplanet.livejournal.com debdelta.debian.net
flossexperiences.wordpress.com fsf.org
www.wellingtonconventioncentre.co.nz www.casino-mustang.com
www.boca-chica-casino.com
existentialcomics.com www.scambs.gov.uk plsdrctme.com
openwrt.org afgpap57xxbir6xd.onion by5oe7gmrt3pmn7p.onion
www.net.in.tum.de dkg.fifthhorseman.net buildinfos.debian.net tanguy.ortolo.eu ttroxell.livejournal.com www.lca2010.org.nz
ukjlovmbuw25gddi.onion ejinouevsdwsjdbb.onion
www.christophsax.com ddumont.wordpress.com
debian-administration.org art.remoteshaman.com www.hrizolit.net
casino-wmz.com
pusling.com raphaelhertzog.com
blog.freesources.org blog.floopily.org
roland.entierement.nu www.ports.debian.org
www.curitiba-parana.net
www.credativ.de blog.kleine-koenig.org
www.owasp.org www.linuxfoundation.org fantana-inform.com
lists.reproducible-builds.org issues.apache.org henrich-on-debian.blogspot.com www.zcarot.com
debianjp.connpass.com blog.surgut.co.uk joeyh.name
koipond.org.uk www.jabberwocky.com arnaud.quette.fr distrosummit.org eozm6j6i4mmme2p5.onion
wiki.c2.com www.4949.de vincent.bernat.ch#fn-asset
vincent.bernat.ch#fnref-asn
vincent.bernat.ch#fnref-easy www.robster.org.uk dtavn4vwaaib4ebh.onion linux.bytesex.org www.diamond777.org www.hrizolit.com www.1russianbrides.com
mateusbellomo.wordpress.com eeblrw5eh2is36az.onion
sequoia-pgp.org
src.fedoraproject.org www.mysql.com mld-olaeb.info member.ruletka-vulkan.com www.casino-wmz.com
www.uib.no teythoon.cryptobitch.de arthurmde.me
sathieu.wordpress.com
www.earth.li
tretkowski.de current.workingdirectory.net journal.wjsullivan.net
albionahoti.com
gsocdebian.wordpress.com patreon.com
www.advogato.org jonathancarter.org
www.hanskalabs.net 2v2kdt6x2xqcxams.onion
www.mrlovenstein.com debianmed.blogspot.com breakingmalware.com
lintian.debian.org www.joachim-breitner.de
vincent.bernat.ch saltpack.org
shop.lego.com larjona.wordpress.com beets.radbox.org rswwpapessp3xxpw.onion www.web-date.co.uk
subsole.org dktrkranz.wordpress.com monopoly.ms
www.host-tracker.com u76xgym22s4adf55.onion
blog.ayous.orgframasoft.org www.sourceguru.netuberspot.github.io www.vbulletin.com
www.science-community.org
vincent.bernat.ch#fn-end www.ibm.com www.simonrichter.eu
www.esaurito.net www.cisco.com 2ljaiqrixmmzbda3.onion www.wumingfoundation.com ilmanifesto.info verschwoerhaus.de
www.infodrom.org
k1024.org blog.legoktm.com
vincent.bernat.ch#configuring-junos
vincent.bernat.ch#using-third-party-tools
hub.cosmos.network people.skolelinux.org darwinsys.com err.no java.debian.net sky-fraud.ru commitstrip.com www.bigmir.net
blog.taz.net.au damog.net buildinfo.debian.net vincent.bernat.ch#logging
ekaia.org copyninja.info
spwhitton.name guadec.org costela.net skyfiles.me www.ippolita.net
cavallette.noblogs.org www.piwigo.org nr1.h.apk.li www.diamond777-casino.org
member.diamond777-casino.org
meccashop.net bip32jp.github.io
lists.opensuse.org honk.sigxcpu.org
www.milliways.fr
advogato.org www.pylint.org
mirrorlynx.livejournal.com
debblog.philkern.de
diziet.dreamwidth.org gsoc.sitedethib.comsylvestre.ledru.info lists.r-forge.r-project.org
matrix-team.pages.debian.net
MrGreen.ws www.dirittiglobali.it
24ilmagazine.ilsole24ore.com www.emiliocarnevali.it mecca.bazar lkxwfeqbfxm3zsan.onion
xsunblog.blogspot.com
piotr.galiszewski.pl
blog.tenstral.net efail.de
www.spectranaut.cc 0x1f1f.wordpress.com
www.freevec.org
blog.mycre.ws tracker.debian.org bestvalid.cx www.ilfoglio.it
alpinelinux.org eferdman.github.io
www.donarmstrong.com
www.sorced.com
stringpiggy.hpd.io
log.cyconet.org:443 paul.luon.net jonnylamb.com
wiki.hands.com matthope.net
bird.network.cz
blog.mister-muffin.de
sfconservancy.org blog.snow-crash.org bbs.cybervalley.org
blog.ilmanifesto.it wiki.freifunk.net
shackspace.de
blog.apk.li sm2v5hypdns3cfvn.onion coinb.in
6zuezcgelrmq3e7i.onion
blog.golang.org tech.michaelaltfield.net
q-funk.blogspot.com git.kernel.org mbanck.livejournal.com redis.io www.infoaut.org isync.sf.net apk.li smbhax.com
nm.debian.org
vincent.bernat.ch#fn-extension bzed.de
eu.pool.sks-keyservers.net
www.squid-cache.org blog.debconf.org www.itp.tuwien.ac.at
www.lupin.org.uk www.netfort.gr.jp www.douglasadams.com
fkbjngvraoici6k7.onion attivissimo.blogspot.com
www.6xukrlqedfabdjrb.onion kevinandkell.com
dilbert.com meccadumps.net
www.packet.com sam.zoy.org www.lunarbaboon.com
blog.koipond.org.uk
www.mhatta.org
ean.schu.es debtags.debian.org
gwolf.org map10.freifunk-ulm.demap.freifunk-ulm.de ccoin.cash
www.hastexo.com
www.iuculano.it man7.org shadura.megonzo.dicp.de
blogs.igalia.com ilmucchio.it
keinpfusch.net warninloo4pa3lgn.onion
build.opensuse.org ramblingfoo.blogspot.com
ral-arturo.org gag.com nion.modprobe.de
blog.shadura.mewww.internetsociety.org
bisco.org
www.debianslashrules.orgsunweavers.net blog.calhariz.com
localhost:4000 minkush.me cascadia.debian.net cobertura.github.io exploit.noblogs.org firenze.ninux.orgwiki.ninux.org xsblfop7lo3e3kfy.onion
sz2mhzudf323grkc.onion
mones.livejournal.com blog.pault.ag swvist.github.io blog.andrew.net.au traf.apk.lisarahburrini.com
pca.st dropbear.xyz
screenshots.debian.net
blog.cryptographyengineering.com
josephbisch.com siamezzze.github.iomdzlog.alcor.net siqueira.tech rsip22.github.iotheppitak.livejournal.com
mesutcaneng.blogspot.com www.swarmshop.ws
vral2uljb3ndhhxr.onion durdomawilnbtbai.onion alicegrove.com dublinbus.ie noscamkvuy26vhn7.onion
git.savannah.nongnu.org
diaspora.sceal.ie baltazarstudios.com GOLDENDUMPS.CC fresh 4nui7tpgyeqsdr7f.onion 5fjpscvkcuohek7b.onion
www.mailpile.is blog.venthur.detdi.github.io richardhartmann.de
deb.freexian.com
teejeejee.livejournal.com www.braincells.comopenpgp-conf.org fboudra.free.fr
schuldei.blogspot.com
www.roeckx.be
www.aigarius.com buildd.debian.org uqxc5rgqum7ihsey.onion
tpez4zz5a4civ6ew.onion
www.ilmanifesto.it
gocvv.co
www.globalist.ch ox5qegyjnakjw7qk.onion acme.com www.simplemachines.org
liorkaplan.wordpress.com grml.org nthykier.wordpress.com le-gall.net techno-viking.com ynvs3km32u33agwq.onion www.linuxday.it ovuh2lidkmfewmrn.onion
wxvi3b47c5ir2gmh.onion 4j36f3bgzweytunu.onion www.createaforum.com
charles.plessy.org stackoverflow.com
www.juniper.net web.dodds.net www.spinics.netjamessan.com bcwpy5wca456u7tz.onion www.frrm.de GOLDENDUMPS.BAZAR
ncommander.blogspot.com www.mattb.net.nz home-sorina.blogspot.com noisey.vice.com map11.freifunk-ulm.de GOLDEN03.ORG
appaji.livejournal.com
opensuse.org www.pushbullet.com
vincent.bernat.ch#tests arnaudr.io
eduardo.macan.eng.br www.openfoam.comlenovopress.com
asylum.madhouse-project.org cran.r-project.org
blog.lordsutch.com noone.org xerakko.livejournal.com
blog.halon.org.uk
gasuleg.github.io
vyrxto4jsgoxvilf.onion shn3x3whdm5tuut4.onion GOLDENSHOP.CC nora.biz 3ld7ttejt76spqxv.onion
ubuntuhandbook.org vincent.bernat.ch#fnref-name www.gusnan.se
isdebianreproducibleyet.com
np237.livejournal.com vincent.bernat.ch#fnref-enforce
mixinet.net www.economist.com To authedmine.com
tiago.acaia.ca
djangoproject.comram.tianon.xyz blog.sergiodj.net
www.researchut.com jajajasalu2.github.io tx5jnankdevk7a5o.onion ou2ylc33khae47o7.onion
3z5hecjnsec2s2e7.onion ax52mmrlw2by5x6q.onion
www.sciencedirect.com ghostbar.co
www.bebt.de dev.mysql.com www.valigiablu.it forms.gle x75u3ou7uq7criva.onion
vince-debian.blogspot.com
meta.libera.cc
www.arthurbdiniz.com robertmh.wordpress.com
sandrotosi.blogspot.com
blog.daniel-baumann.ch docs.frrouting.org
www.hermann-uwe.de udd.debian.org 6f6ejaiiixypfqaf.onion www.firenze.ninux.org www.tt-rss.org
lists.infradead.org shieldofachilles.in gravityboy.livejournal.com
balintreczey.hu
rpki-validator.ripe.net abhijithpa.me
crispygoth.livejournal.com
www.cs.unb.ca
layer-acht.org
www.sommitrealweird.co.uk ftp-master.debian.orgalexandreviau.net qqvyib4j3fz66nuc.onionmelamarcia.nessungrandenemico.org
www.rockit.itwww.liberainformatica.it www.firenze.linux.it
www.php.net
kwn6i5jng6bsow5z.onion
nfoe6h2jobdngfmw.onion
www.smfads.com
www.jpr62.com
getfedora.org sim590.github.io
www.news.software.coop mitya57.me
vincent.bernat.ch#fnref-asset
foolcontrol.org tor.hermetix.org www.survival.it 1DOLLARDUMPS.COM evzjqrswt66tm2yg.onion
www.hopnroll.com.br dr.jones.dkphls.com.br shnatsel.blogspot.com blog.daionet.gr.jp
www.golden-gryphon.com dirk.eddelbuettel.com questionablecontent.net gogs.io aef6y4766z656q6a.onion
www.quantlib.org
latenightlinux.com
xana.scru.org alerios-en.blogspot.com piware.de
sandyleo26.wordpress.com lljrzrimek6if67j.onion www.bestblog.de
n7jzk5wpel4tdog2.onion www.ismalltits.com www.snapchat.com bwpufahfcgxq3abt.onion
gambaru.de www.gag.com
lobste.rs log.cyconet.org blog.azizaj.com
tests.reproducible-builds.org
mentors.debian.net gl3n4wtekbfaubye.onion motherboard.vice.com e64qidckaxijfm6l.onion
apkx44pmf7fyd63e.onion rubyeagle.com wiki.jungs.wtf
rak.ac entropia.de survex.com
www.mailvelope.com goofying-with-debian.blogspot.com ramcq.net
daniel-lange.com glandium.org
blog.james.rcpt.to cmgvqnxjoiqthvrc.onion
kyk55bof3hzdiwrm.onion mrstat5e6loaqgjg.onion dbei.gov.ie www.accenture.com fofzj37ck6pto3gi.onion xdsa5xcrrrxxxolc.onion?action=yith-woocompare-remove-product&id=3255
tauware.blogspot.com
www.perezmeyer.blogspot.com tookmund.com
xmpp-team.pages.debian.net vincent.bernat.ch#fn-easy
bnolet.me www.ilpost.it www.femjoyhunter.com tsbdyibo2dk7ahuv.onion
andreeleidenfrost.blogspot.com
esaurito.net www.jelmer.ukwww.schmehl.info blog.zobel.ftbfs.de feedproxy.google.com www.perunaltracitta.org locusmag.com
www.alpinelinux.org blog.aurel32.net sjoerd.luon.net
activelow.net pci-ids.ucw.cz swvist.github.com offlineimap.org a5jajbt66y46s7wb.onion xdsa5xcrrrxxxolc.onion?action=yith-woocompare-remove-product&id=2376
caninosloucos.org notes.secretsauce.net
mjr.towers.org.uk
cateee.blogspot.com blog.jak-linux.org
gitlab.onelab.info anarc.at mq7h2mboehyekxnv.onion 2dwr24vsifikiv7e.onion
y3fy7vcf2yewlert.onion
www.fastly.com wiki.debconf.org grmontesino.blogspot.com
blog.odyx.org
blog.brlink.eu www.chiark.greenend.org.uk
freevec.org
forum.freecadweb.org
danielstender.com attivissimo.blogspot.it www.chg.gov.ie
www.die-welt.net
gabriellacoleman.org skitterman.wordpress.com blog.alteholz.eu
www.credativ.us ktqxbqrhg5ai2c7f.onion fsai.ie youngiwu62nzxna5.onion
kkremitzki.github.io
smurf-debian.livejournal.com
www.xkcd.com noah.meyerhans.us feeding.cloud.geek.nz www.giovannimascellani.eu dangel.im
dwgsoc09blog.blogspot.com
slackydeb.blogspot.com opencall.sciencegallery.com
www.irishtimes.com international.sciencegallery.com
www.diodes.comsdcc.sourceforge.net jeremy.bicha.net
www.licquia.org 2ddjd7xsni7pefcx.onionwww.hellion.org.uk cascardo.eti.br
ondrejcertik.blogspot.com pleroma.bortzmeyer.fr
bcbm4y7yusdxthg3.onion www.ftvhunter.com chat.jungs.wtf frw7qhmvlthvpinz.onion
thedevilspanties.com
www.miriamruiz.es www.technovelty.org www-public.imtbs-tsp.eu matthieu.io www.openkeychain.org sgvtcaew4bxjd7ln.onion roy.marples.name www.i3theme.com
www.danielstender.com
billblough.net aigarius.comdebianstuff.dittberner.infosyn.theti.ca
blog.fai-project.org
michael-prokop.at
vincent.bernat.ch#fn-name gnvweaoe2xzjqldu.onion blog.ganneff.de
perezmeyer.blogspot.com
mraw.org opensource.org zinosat.blogspot.com dublinbikes.ie www.themarkerhoteldublin.com parkrite.ie xdsa5xcrrrxxxolc.onion?action=yith-woocompare-remove-product&id=3269
grep.be www.meebey.net schnouki.net
hartmans.livejournal.com etbe.coker.com.au flosslinuxblog.blogspot.com
blog.shanky.xyz zgrimshell.github.io
foolab.org ito4xpoj3re4wctm.onion www.vice.com jigsaw.w3.org yeqmaf5vjpq7meyx.onion
www.russianwoman.ca
aardvarkoffnord.wordpress.com
www.corsac.net ihdhoeoovbtgutfm.onion sexyjenysmith.com uvwovfkwqmyyrtbj.onion no4oyy2c7rx3guty.onion xdsa5xcrrrxxxolc.onion?action=yith-woocompare-remove-product&id=3243
www.palfrader.org
vincent.bernat.ch#short-introduction-to-the-rpki www.marga.com.ar blog.steve.fi
www.df7cb.de twitter.bestblog.de
465rf3c2oskkqc24.onion www.alreadyhosting.comlandscape.io axhyjhpmw3dwskyi.onion
www.intel.ie udumpsx3zdy3uvdr.onion vnidbxx3zaa2ksva.onion
rcppcore.github.io
david.kalnischkies.dewww.preining.info rhonda.deb.at www.libressl.org morayallan.livejournal.com
pstorralba.blogspot.com www.kraken.com
hd37oiauf5uoz7gg.onion
joinmobilizon.org www.24log.de
moonkin.github.io www.decadent.org.uk
blog.dogguy.org
blog.cihar.com blog.beuc.net oscbw3h7wrfxqi4m.onion iwpr.net dublin.sciencegallery.com chat.jungswtfwgjwile2.onion
blog.familiekainz.at
tyszecki.org
magit.vc
blog.luke.wfemsenn.net
blog.bofh.itdput-ng.debian.net scarlettgatelymoore.com
framapiaf.org jackyf.livejournal.com
vincentsanders.blogspot.com
www.nbcphiladelphia.com
blog.sesse.net
antti-juhani.kaijanaho.fi
www.wgdd.de blog.treyssatvincent.frugw3zjsayleoamaz.onion openagenda.com www.mangoorange.com 6xukrlqedfabdjrb.onion lfnoajc2cqttvkgx.onion ridotnp5m5lp22gw.onion
golden7djzq32zh4.onion
irishrail.ie
wqlc3ny6wcbxy2r7.onion bitcoinfog.site cyberchimps.com
xdsa5xcrrrxxxolc.onion?action=yith-woocompare-add-product&id=3237
dhole.github.io sven.stormbind.net genibel.org loldebian.wordpress.com log.alexm.org git.pleroma.social f6syxyjdgzbeacry.onion gmail.com
mldolaese4gj6m7p.onion ntdik7prdzjijjdi.onion www.google.ru
www.ionos.co.uk hashman.cabonedaddy.net sfllaw.livejournal.com
rperier.blogspot.com
stratusandtheswirl.blogspot.com mlalic.blogspot.com ajt.iki.fi nwvk3svshonwqfjs.onion kjzhohqqslrw4bep.onion thehub7xbw4dc5r2.onion xdsa5xcrrrxxxolc.onion?action=yith-woocompare-add-product&id=2424
www.enricozini.org pypi.org ondemand-mp3.dradio.de nora.holiday www.24log.ru
www.histats.com
l5oqxwdzs5m2dwro.onion xdsa5xcrrrxxxolc.onion?action=yith-woocompare-add-product&id=3259
xdsa5xcrrrxxxolc.onion?action=yith-woocompare-remove-product&id=2358
kbepzad33bwjfi3mqzwu6sefv3zeanwsgdqnotius6gemsjlyckq.b32.i2p xdsa5xcrrrxxxolc.onion?action=yith-woocompare-add-product&id=2370
chrome.google.com creepymhpgibsewr.onion xdsa5xcrrrxxxolc.onion?action=yith-woocompare-add-product&id=3245
viagr4rub7dne4xk.onion xdsa5xcrrrxxxolc.onion?action=yith-woocompare-add-product&id=2442
halvener5r6kdic5.onion imh3odalu2eanx5v.onion xdsa5xcrrrxxxolc.onion?action=yith-woocompare-add-product&id=3249
rpa57xh2wfmh4y5u.onion xdsa5xcrrrxxxolc.onion?action=yith-woocompare-add-product&id=3595
hi-in.facebook.com torchic64idgja4l.onion xdsa5xcrrrxxxolc.onion?action=yith-woocompare-add-product&id=2374
www.wirex.com xdsa5xcrrrxxxolc.onion?action=yith-woocompare-add-product&id=3286
5dgg7y5viysvvrxf.onion escortsgraymsjp3.onion xdsa5xcrrrxxxolc.onion?action=yith-woocompare-add-product&id=3227
uqc5fjmchjjtx6zi.onion
goatsehvcopyc2ex.onion bitcoinfog.info www.mastercard.co.uk xdsa5xcrrrxxxolc.onion?action=yith-woocompare-add-product&id=2429
ar-ar.facebook.com www.americanexpress.com xdsa5xcrrrxxxolc.onion?action=yith-woocompare-add-product&id=2380 mdsgirls4pwlaiql.onion
sbh3znmgscj3yzgm.onion xdsa5xcrrrxxxolc.onion?action=yith-woocompare-add-product&id=3265
udnkwobywxmdv27n.onion
7w65g63fgumvpuvd.onion pchcardahvctcgnn.onion www.weusecoins.comusa.visa.com xdsa5xcrrrxxxolc.onion?action=yith-woocompare-add-product&id=3599
www.xapo.commember.winnersgoldcasino.com
pt-br.facebook.com www.nyaa.se xdsa5xcrrrxxxolc.onion?action=yith-woocompare-add-product&id=3269
xdsa5xcrrrxxxolc.onion?action=yith-woocompare-remove-product&id=all wallst2qs75qkzzn.onion
buybestbiz.net xdsa5xcrrrxxxolc.onion?action=yith-woocompare-add-product&id=3229
irc.jungswtfwgjwile2.onion xdsa5xcrrrxxxolc.onion?action=yith-woocompare-add-product&id=2382
ijr246luczc74cgm.onion twfhclvq2u4g7wmd.onion xdsa5xcrrrxxxolc.onion?action=yith-woocompare-add-product&id=3255
xdsa5xcrrrxxxolc.onion?action=yith-woocompare-add-product&id=3277 oniongirlqkjjfc6p.onion
galaxyaonv32reim.onion wikileaks.org
ko-kr.facebook.com 44con.com
wpfr.net xdsa5xcrrrxxxolc.onion?action=yith-woocompare-add-product&id=3257
youvjbribqk2q4dg.onionwww.mastercard.us xdsa5xcrrrxxxolc.onion?action=yith-woocompare-add-product&id=3284
xdsa5xcrrrxxxolc.onion wallst4qihu6lvsa.onionvendorrkw6jben43.onion
dl.dropboxusercontent.com utvjqkyc4ejhzkwu.onion xdsa5xcrrrxxxolc.onion?action=yith-woocompare-add-product&id=2362
themes4wp.com
gc4youuhrzbp5rlm.onion njs4tmqjy64rpyji.onion
prduct52yhuu6c3f.onion xdsa5xcrrrxxxolc.onion?action=yith-woocompare-add-product&id=3273
53nr2wn3ig7fr5ij.onion
4php6mnkteaouewp.onion c3w.at
merlin4nlmrwimq5.onion n4k727nqnwkvb4g6.onion www.winnersgoldcasino.com
unteh4oc2fpl57fy.onion
upv3wvf6sikfiluy.onion circle.com
yzi57csfqno6xgwb.onion
microsoft.com notndu3rgltj5vbk.onion xdsa5xcrrrxxxolc.onion?action=yith-woocompare-add-product&id=3231 wallst52pxrtzwch.onion
wallst6gyljfu4rk.onion
dc5gee72qyaayr4d.onion xdsa5xcrrrxxxolc.onion?action=yith-woocompare-add-product&id=2452
xdsa5xcrrrxxxolc.onion?action=yith-woocompare-add-product&id=3253 www.thc.org
tw.wordpress.org ndvj2ol2viuadm6l.onion
fmivsuu2vmubsdhx.onion
foggedddxlunnaaa.onion wedopornbqnifksn.onion
kbxv2hlsy6phxalo.onion grizzlykijswtj2x.onion
parazite.net xdsa5xcrrrxxxolc.onion?action=yith-woocompare-add-product&id=3243
uqtinqynmibpoa2s.onion
xdsa5xcrrrxxxolc.onion?action=yith-woocompare-add-product&id=2372 fm4.orf.at
foggedd3mc4dr2o2.onionforums.gentoo.org
tfwh3y7tdfzljmat.onion www.konkret-magazin.de unlockdehrka3cbn.onion cex.io
korovka.cc
carson27rcopqmms.onion
fbyr455vwvkpzp5k.onionwe6p3rs2kqp3wsyr.onion www.digitalguardian.com wallst7xs4tepmvb.onion
wallst3gi4a5wtn4.onion
khxmuxltrlsfodxx.onion
wiki.gentoo.org shxdhomhggy3bjrn.onion
quematumovil.pimienta.org raratheme.com
proxy-https.ckkjdktn2elda5f2.onion
jpmgvki37zcy7o35.onion xdsa5xcrrrxxxolc.onion?action=yith-woocompare-add-product&id=2360
mppegdk6kmrr53p7.onion yec6ciqir6yukwmv.onion
bulbzddh75io4s32.onion www.sicherheitsforschung-magdeburg.de
xdsa5xcrrrxxxolc.onion?action=yith-woocompare-add-product&id=3217 n7cad27hyjaqq2hu.onion
www.nyaa.eu c6wtpvznm4pk6q5u.onion xsin4xbme24aatvk.onion
ozd72l7kltcrq34m.onion
p3lr4cdm3pv4plyj.onion www.roots-conference.org
blog.coinb.inuhiwoomhaddtjnse.onion satoshibox.com
countfe766hqe4qd.onion
www.bka.de rxyt6gfigfoberml.onion
185.174.173.92
monero.org totse2.com tghtnwsywvvhromy.onion www.infosecnews.org
www.securitybsides.org.uk
gqc3mjjp5tdbbxui.onion
crypto.cat
jm6miyk4tog63kqs.onion 2ttafocrkv7gx3op.onion
hiddentkbdm2adnz.onion msmugacbj7qycqd7.onion
forum.bytesforall.com
fwb2cosocslxnvtg.onion qb6si4svhnhlw4hv.onion mtn2fcv7yerki2op.onion
4344457357774542.onion deepintel.net 6onu2qrrdqo4cubp.onion
ygumyapuudqjnbbm.onion
yp1.pony.pp.ua theanarchistlibrary.org
nb5df7xeas3zl3sf.onion oldmagz3qkeqh2jb.onion
tinlansblog.disqus.com k54ids7luh523dbi.onion x2opbmptq7gnjsk3.onion43dckqf6x7gyuirq.onion wf4df37hrebhwzts.onion blog.deepsec.net 7efcfqiivl7fbfwm.onion
davxp63bfgazfkv7.onion
5a7ryk7pdjflogpx.onion olfr5bg4qeliapk4.onion iplists3hhmtmsgm.onion
4eiruntyxxbgfv7o.onion www.issa.org
gante6n6fjopy6sf.onion
cyruserv5hlagzhg.onion
ah5dm66duazqkz6h.onion burninetliliito5.onion www.hackinthebox.org
bugs.gentoo.org
n3z4gobkreie6whu.onion x2upvj5wcylu2kcq.onion
zqhu3ynqqbqzsq2c.onion
honeynetvg7i4lc6.onion
x4tmhtkin4kumdvl.onion kcik3srgrfwbwxi2.onion
6g2osf4l534bozmu.onion 54flq67kqr5wvjqf.onion
ntoibame4iky6xhv.onion
miqzasssqdtagqdi.onion anonix.org
mqv7qz5rn3sf5dcx.onion irvuh45m6qnkpp7o.onion
sb77t2k7dqe66npe.onion
xrwveit2nw6etj4b.onion#howitworks 5xrder5zmkqkdary.onion articleak.allalla.com
xhzm2tpsyh4tn37u.onion
wkwjr7pn7xubtpx5.onion
wevuysiyescilvc7.onion
x7yxqg5v4j6yzhti.onion 4hk4hz35gmpa6fih.onion
3m2myjbdihroaven.onion
rqc3gg6xji6jpovo.onion
jdcbespbl5j7v44x.onion ynkz7ebfkllljitiodcq52pa7fgqziomz4wa7tv4qiqldghpx4uq.b32.i2p www.cert.at preev.com
rusinfo.cc
xrwveit2nw6etj4b.onion#keyfeatures cp2qnzn7r3iyvgj3.onion
jbsex4wngjpo5i27.onion
552egj2iappsjjdu.onion 4v6veu7nsxklglnu.onion eqzxv6schfhf44xw.onion
ixdgswb7ehnbqsfo.onion
hot-things.net
xpc7hl3vpc625kau.onion
vtle6jettgqyp7o3.onion
jtdzkgzfpvhryjv6.onion
hardcore2cfthaqa.onion idcrldxrzjpljw5w.onion
idcrld3uq3vedplg.oniondream6udx7w66o23.onion hffi5yzh57xceq44.onion
easyppslbft37xq7.onion ts4cwattzgsiitv7.onion ibjfbrjwhfvxict3.onion
z2gu35md7bi3ceew.onion lotjbov3gzzf23hc.onion
caltha.pl vc24blsbg5ow5slk.onion
62lpxb2lt3yt6vgr.onion
y47ylcppnh3afqk4.onion 6bpruxeuncgwp4xv.onion
ga52ionjmqw3bxth.onionidcrldiqkb55tjo4.onion
vzugfdoygasghjsf.onion jcx3r2t55jc2ge5a.onion
ms3pbazxs7qwb422.onion
yeeshafbtyf7aipe.onionwww.tutankemule.net
talk.masked.name pwjxmvlir72hep5u.onion
shouldhaveusedmonero.xyz remailer.frell.eu.org bj6sy3n7tbt3ot2f.onion
jchlju4s5zi5i425.onion tlz3gig7k46s4r66.onionhvieybi6rb45wfpg.onion coinbase.com
ffi5v46ttwgx3fby.onion
r2tjckbrme3yeenx.onion sc3njt2i2j4fvqa3.onion
privacybox.de
t7xcpwokiagivyzq.onion
oddities7n5ei4mz.onion pibn3ueheubjxv2z.onion www.mein-parteibuch.org
s7pvraehwqmazmcy.onion c2hluuzwi7tuceu6.onion d2wssrzhsfdj7x3p.onion
torbibj2v77cbt7w.onion utup22qsb6ebeejs.onion 7w2rtz7rgfwj5zuv.onion
vg7ik2tbrkjr5ooq.onion
xqz3u5drneuzhaeo.onion4aftzxjgrdl45i6u.onion
jhiwjjlqpyawmpjx.onion uoaz2bavpyplrswx.onion btccontwl5ie4yza.onion
65bgvta7yos3sce5.onion
3suaolltfj2xjksb.onion stlw74hqbtzoshyg.onion
uaga3aoawaj6hohg.onion
torgame.crabdance.com
htm3iyhkfq5pwisy.onion bitcoisblqdnzvqo.onion
jr4jzn5zte7nkfcw.onion mul.tiver.se l2zukdb5b2favsfc.onion heidenwut.co.cc
rvomgbplxtz4e7jv.onion
hv2ow7li345lki5w.onion
vescudero.net
echolot.anon-proxy.de xdtfje3c46d2dnjd.onion bitcoiuyen6g3fcw.onion
x7giprgefwfvkeep.onion pdjfyv7v3pn34w4f.onion
js6ogt27wjnbsdux.onion www.bl-lit1.info huph4yrbv4iqjevr.onion
anessadu.6x.to 222222222rrm7tey.onion
bitcoirszago3q7l.onion
bitcoifbhdmd3fxa.onion bitcoi2t6urbe2de.onion
bitcoiq23uoml6qs.onion
tmskhzafkndqaqyx.onion bitcoi2lgwbrvsuo.onion
bitcoinbgpkm2s63.onion
bitcoimpqhbyqdwj.onion
2222222denogzjcg.onion
222222242zkgyc5n.onion 22222227qp2e2l7j.onion
bitcoihqxtj66xvf.onion
mybb.com.tr bitcoirtzaddehn4.onion bitcoixycocg5kex.onion
bitcoiwgg4jizo6n.onion
rbh3gpzgr4chprsd.onion
bitcoi7ns42x5ln5.onion
bitcoiz7u5g35pnl.onion
bitcois3q5xu72ro.onion bitcoi2k7b3jhbfa.onion
2222222zvh2cpisk.onion bitcoigmxdqjaxdv.onion
bitcoid4csxoinrt.onion
tronic.puheenvuoro.uusisuomi.fi bitcoixzxtwqmyjf.onion
t3ykqzimcziol5kj.onion
bz2ybkf4srabpwbl.onion
jratiejtelswmbov.onion bitcoinus4vm2hnp.onion
2222222bueof3k2e.onion 22222222oss4d6al.onion
bitcoidyvgrhvdnv.onion222222265oewkjsa.onion
bitcoij6mh46vd6d.onion bitcoikrrorilqw6.onion
3kkapqsmk3eyc6k5.onion bitcoirzgic4cqv6.onion
bitcoiyxximb3wz4.onion
bitcoijnadw7tzd4.onion bitcoiyadnz6cgwn.onion
bitcoi23mhlxb3tl.onion
bitcoijllnuf4ard.onion 22222223zmnmw45c.onion
2222222mbobnfb3a.onionbitcoij4hzjl35cy.onion
bitcoiecvbz3skap.onion bitcoitcityqqh3w.onion
bitcoigiu4y2wggl.onion
bitcoizvgd3yu5s2.onion btccoy3aux77icda.onion
22222222b5jjiakx.onion
bitcoig2zq3pgc5h.onion
bitcoijuzbwvj3fa.onion
bitcoiz6byyajq4j.onion
22222227giq565lq.onion
22222222fhmxvuyy.onion 2222222bnx5npxpu.onion
bitcoimlztdjdz3e.onion
bitcoihoimasigli.onion
bitcoib75myfeeyr.onion
bitcoilw2kvojufv.onion bitcoib53lztkrdf.onion
btccozsovytqnyur.onion bitcoirzlkucrske.onion
bitcoibz264gxcue.onion
bitcoirmtrc2cmtf.onion bitcoiqlogy2oamm.onion
bitcoi7zrj3uvslr.onion
https
wordpress.com bitcoi2stzn2lxmu.onion
bitcoitidrfj7w4v.onionblockchainbdgpz.onion
btc.com bitcoi5cpvzozpkh.onion
bitcoin3or2zr5s2.onion
blockchainbdgpzk.d33e7059146f2d3189efbd8d7e4658b3a304e4dbe2b83f636b83c25c85f3fbec
bitcoitdiec72b3p.onion
2222222gln6axpfp.onion 2222222fjgch7zpy.onion
bitcoikbv2llz63c.onion
bitcoiamkbwscbb7.onion bitcoiimqy4kuj2v.onion
btcco6vsft7ibg7z.onion
blockchainbdgpzk.onion
bitcoia4vcjfjeqn.onion bitcoidqfvllhib7.onion
bitcoikyk4qtxmwb.onion
bitcoijwrtfmxqsb.onion
btcconlmkzl4c5jo.onion
2222222jrry67pfv.onion bitcoih5mtmcpo2i.onion
btccoqepojtvue7m.onion bitcoi4u2ibrd7i4.onion
222222244trjylim.onion
l3vv4lvjxgy5i7i2.onion bitcoihkhjn5fg7q.onion 2222222xq5omj5dx.onion
bitcoiwvy7he35ap.onion
bitcoilcczkh6djc.onion
bitcoim5hovdraoy.onion
bitcoilqjpqrsnj5.onion bitcoicutyiiw7y6.onion
btccoa6hxovddqog.onion
6aycd2mdcrynhx26.onion
bitcoih4msrugcl7.onion
bitcoizxxzje2eld.onion
2222222ffaklzb6g.onion 2222222ep67fw3hd.onion
bitcoiuj7kqljiqh.onion
bitcoidxlopkburj.onion bitcoimoxd4ja6dr.onion
6qcll3kmt7grddeo.onion 2222222rdllmrua5.onion
bitcoizue2cc4joe.onion bitcoip55du225hb.onion
bitcoiv6ilkolqhn.onion bitcoiuok7l42y3b.onion
bitcoimtnovhdcxm.onion
bitcoiiy5coqwlir.onion
bitcoiyxs44eei75.onion
bitcoikcxhkchejv.onion
2222222my67lpvpd.onion
bitcoi6u7ap3hapo.onion
2ocmf35yp4brofrp.onion btccoawjkf3ebvkl.onion
bitcoic6pd2kehh3.onion
bitcoiami6ntzkp3.onion
bitcoigktk3jdlvl.onion bitcoicv57t3xond.onion
bitcoihfd4mkwcwx.onion
2222222l6oxgijgz.onion
2222222qeou6moyt.onion bitcoijjiz63xfes.onion
bitcoiyqrrmuzolq.onion
btccolxlzmzktkqr.onion
usjudr3c6ez6tesi.onion bitcoib6hxl2tn6t.onion
bitcoihvwoa6xstw.onion
2222222kt6vihsl6.onion
kbyz2vu3fnv2di7l.onion bitcoi7wkysmwiq3.onion bitcoi33owysbt3o.onion
bitcoiuh2afj5fvs.onion bitcoib3vr5a4yq5.onion
2222222qbzrkxl7l.onion
bitcoi4jvq7j5nvm.onion
anatisrfazyawxqv.onion btccod5rszso4t77.onion
bitcoidps5jpndff.onion
2222222ugah2uexw.onion bitcoijytzriwizk.onion
bitcoifkdqkpx3ah.onion
bitcoijdyaecr6sa.onion bitcoigd7dof4zz5.onion
mvfjfugdwgc5uwho.onion bitcoiri2cfs3zjh.onion
mjt54q6pagohhimn.onion
wwwgpe5bfzo5krx4.onion
chaturbov7zh37sa.onion
pekarmarkfovqvlm.onion
vvvvvvvv766nz273.onion
searchb5a7tmimez.onion
e7sin3urmxxcnu6a.onion
rospravjmnxyxlu3.onion
tt3j2x4k5ycaa5zt.onion
ctlog3.wosign.com
yeti2021.ct.digicert.com
yeti2019.ct.digicert.com
enotegggr635n4lw.onion
kruegernyuewww3c.onion
2pdkdy3eo552mpiz.onion ct.ws.symantec.com
rtwtyinmq4wzzl6d.onion ctlog.wotrus.com
gjobqjj7wyczbqie.onion sirius.ws.symantec.com
deneb.ws.symantec.com nessie2021.ct.digicert.com
plausible.ct.nordu.net
ctlog.wosign.com
godnotabatovgyqz.onion 6d3zimnpbwbzdgnp.onion anthill3sqxhevct.onion jk7pdjla5xz3lmip.onion
galaxy3m2mn5iqtn.onion
l637codyp4pzrkgd.onion l2epd2e4g2hx3tdf.onion
vps7nsnlz3n4ckiie5evi5oz2znes7p57gmrvundbmgat22luzd4z2id.onion 7qzmtqy2itl7dwuu.onion
5jp7xtmox6jyoqd5.onion anthillrixdtwsot.onion log.gdca.com.cn
atlayofke5rqhsma.onion onion.to
e4unrusy7se5evw5.onion
rashadowwxave5qp.onion
mc6nld3smffo3vgm.onion sinbad66644fr5lq.onion redrooxkac6svpag.onion
redroowe7pa4m5vz.onion
grams7enufi7jmdl.onion redroothwefp5kza.onion k5vbzl3ucwsjf2ye.onion
tcrth4wace2g2ayk.onion www.certificate-transparency.org
ctgpe2yc6ez56dhwd5hpj2tdkiuz4m5iy7347cpzmxyacphl72dmfyqd.onion
264nglqbtqlabsxl.onion gc3dzlki6foxaskkll36ryicjdao2h5yard2cslflv56nirbzf5uppad.onion
erewhon.superkuh.com costeirazb2xecgs.onion megaeeayahdmmeee.com anthill.shop anthill.fun 4r7utra6sdzvyn2j.onion
idcforumremsa2jk.onion www.namecheap.com 4hohkxjvlt5fjzqv.onion oeioei4qg23lbvew.onion
ozon3kdtlr6gtzjn.onion anthill.xxx yeti2022.ct.digicert.com
3xztn67lhic527zkhzm7jgh6hhb53zjb722asylbc7m3m7xpormuwvid.onion cyruservvvklto2l.onion prwrufrbsfdbhltg.onion
g3kmrf5yo554nzouqqye3uagzrjjbz5nu4vwsqe272ck4hfmdegf5vad.onion
3vfws2yqv4wii54e.onion mop6w2wzinaj7sfv.onion i2puhsgl2aif6fk4.onion
kiy52zq46nqu426l.onion darkwikiss2rmeby.onion
y2qmqomqpszzryei.onion
osearchkiq5mvet6.onion ktocienamierzyl.pl fjmnwowzeavrf7z6.onion 74d4eshogf7wae6bpfiymdhvrdowsvkvjobu75xon5pgyncn6s2vp2id.onion
trinixy73gm6z4fq.onion
qgemzvfj74eb5oxq.onion nessie2020.ct.digicert.com
bah37war75xzkpla.onion jstyroyksfkwsjdj.onion
apbv6itrkcr7k3ny.onion
facebookcorewwwi.onion www.somafm.com g6cgkxjp4cqikbn7uxt5d4ud5wlvhuyrnojxzvv7dz4rh64qq4dv5uqd.onion ft3duakh6qoshogp.onion
ghostbotc3iwjptr.onion ccgurujlhfjjx7tz.onion ctlog-gen2.api.venafi.com
ayp3gd4pm4qduff3.onion iikbmpwhwbbusn23.onion qrjy2nhjdbzdprbq.onion
darkach.com 222222222c7r2gdj.onion tor4.zone ctserver.cnnic.cn vega.ws.symantec.com
ctlog.keysupport.org
2x6rzvgatbcev7cy.onion
verifieasmspsemk.onion
jrz524vll72f4ljr.onion anthill2lyt77rpz.onion er7u5cptfqfsh5zx.onion ixnyoncpod3p7pti.onion
mjqexslnaxungpwj.onion spruce.ct.letsencrypt.org
rutorc6mqdinc4cz.onion tor4ru7koxa2k4ts.onion
5gppqkpx6jxgpuuu.onion
kmxw5vxiykow4ppymfrv5cgtrgl3ru5gmvhrj3mmnagiouwuhbvzt5qd.onion
wlupld3ptjvsgwqw.onion sixteenhbsws3sr7.onion
notoriedadefeminista.torpress2sarn7xw.onion diw5z3renfje7p6oeqzxjexyhm3tuleqh4a6fybnmgbtr25lsm2klpid.onion
www.beam.mw eda2jx74zvsjmd4h.onion
dtveoe72rdufunvp.onion
manual.calibre-ebook.com
felixxxboni3mk4a.onion pnxauh22krzb5xso.onion
www.facebookcorewwwi.onion www.phpbb.com i s.gd
narniaguz47mq3rq.onion 2cxhjkwp5mga2jv5.onion bestes77yawunk6p.onion
www.eyeonpass.com
alpha.libre.fm b2fxrnttdue72ntq.onion mucirnaewm6bumgn.onion ctgpe47oofn4ov5v.onion
dodo.ct.comodo.com
ct.izenpe.com
www.dragonbyte-tech.com zlal32teyptf4tvi.onion redroo6jmpfa5cv7.onion redroo7gs4gvtr4l.onion
scanner.pcrisk.com tor4.ml anthill.la cbodkx5ookrtqugg.onion nessie2019.ct.digicert.com
clicky.ct.letsencrypt.org
sshtunxizmbovzki.onion xenforo.info v6yfk5jbq5vcnyk4.onion
erlach6sjul42c7h.onion anthill4qbbdm2r5.onion ct.sheca.com
5wddm7cim4qfrj3n.onion redrooi5lih6qadh.onion gbpoundzv2ot73eh.onion vola7ileiax4ueow.onion
tssa3yo5xfkcn4razcnmdhw5uxshx6zwzngwizpyf7phvea3gccrqbad.onion doxbinjs77uawbbl.onion
superkuh.com torbox3uiot6wchz.onion
bylu6d6nx3og7shy.onion
torhooh46e624k5y.onion encryptor3awk6px.onion yeti2018.ct.digicert.com
bdqvgdbomnv4qtuf65atcob6scwkmvlmgmc74i7k32rl3apbpon6mfyd.onion tor4.ga qopdcqhuvk2yd7co.onion
ethereum.org
dreadditevelidot.oniones-la.facebookcorewwwi.onion
cryptex3m3o4vygu.onion
nymphetomania.club l.facebookcorewwwi.onion suprbayoubiexnmp.onion 6chfjp47en4uvaev.onion nessie2023.ct.digicert.comyeti2020.ct.digicert.com
sabre.ct.comodo.com
dhosting4xxoydyaivckq7tsmtgi4wfs3flpeyitekkmqwu4v4r46syd.onion torchatrfz2m4gvd.onion p4btzfloayu5s4ww.onion safepaybtc.net ct.gdca.com.cn
uphnm2dgilz4dysl.onion
phobosxilamwcg75xt22id7aywkzol6q6rfl2flipcqoc4e4ahima5id.onion
xcm4pbxoaajsqrps.onion volatile.ano ct.akamai.com
ct.filippo.io
fhacksnplmzxaaoo.onionantiscambrasil.torpress2sarn7xw.onion
abikogailmonxlzl.onion redroozycqivqofz.onion 2j2vuxeaqy3iro2m.onion ct.startssl.com
57f23hcybjqj4ime.onion
whisper4ljgxh43p.onion cp5ju2qrbfrwz4z4.onion
axcdo2zaeyrpdc6z.onion 2222222237z3q52l.onion
pt-br.facebookcorewwwi.onion igdnewsdjfmg7kxu.onion
dovooepjluycxo5r.onion deepmartyqzffl5n.onion
3pc3yapw2xmsfnfx.onion lukmus.ru
xyaukzqqcdkop4ui.onion vij4p3cgway7ixi2hpekyigv5sp7673ghr5y33tgwscvz2qrzvmuepqd.onion
dmzwvie2gmtwszof.onion www.reactos.org
xsqp76ka66qgue2s.onion elevateeo6usyjlq.onion log2.gdca.com.cn
jgyujfb2olkozxgp.onion
visitorfi5kl7q7i.onion anon4jmy3f3ozlv6.onion spyiranhereogc3f.onion certspotter.com ctlog3.wotrus.com
oak.ct.letsencrypt.org ctlog.gdca.com.cn
pdzdg7cbqal33ns6.onionzh-cn.facebookcorewwwi.onion
cafofoakiphznegicbgznr3z47cnlqzdbgcmubg3ihrbluuuckd2xsad.onion me.atsp.in ct.izenpe.eus ct.wosign.com alpha.ctlogs.org
birch.ct.letsencrypt.org
darksell2cuknuca.onion mda3nxsigriahnxq.onion
bithxedusrw236ji.onion applexhmkr5a6ka5.onion b6siqj6jyj5qwb5a.onion
nymphetowhsn3gpf.onion
probiv7jg46vmbox.onion
25xcyznj3pny7mzz.onion darkmarket.biz
prometh5th5t5rfd.onion realpissxny3hgyl.onion?s=ppics nqxrzrkvvy5hy7yn.onion
fsocie3diwtymprg.onion
www.law.cornell.edu
cbsrdi4vw4orqehzp2f4a4z36pmqbr2jsbf3piofifncqdnbx6movryd.onion
lolksweb3waft3gw.onion lfbg75wjgi4nzdio.onion
de-de.facebookcorewwwi.onion
ar-ar.facebookcorewwwi.onion volatile.bz
cubanosy4g7qdiog.onion
sgkvfgvtxjzvbadm.onion zh-cn.messenger.com developers.facebookcorewwwi.onion
deadpool4x4a25ys.onion
wwhclublci77vnbi.onion dark666b5l2e3lcu.onion
cckingdomtmf7w7l.onion chipmixerwzxtzbw.onion
chat.vola7ileiax4ueow.onion
volatile.i2p golem.ct.digicert.com flimsy.ct.nordu.net
ct1.digicert-ct.com
ct.cloudflare.com
generatorgu25g5b.onion egeeemjcvnebsrtl.onion
traditio3trziwpn.onion thepiratebay.mn chat.efnet.org yeti2023.ct.digicert.com ct.googleapis.com
nethack3dzllmbmo.onion
it-it.facebookcorewwwi.onion forum.suprbay.org
thepiratebay.la nfs6e454oyvajfro.onion ctlog.api.venafi.com
gyklo5wruhin4qpg.onion rekt5jo5nuuadbie.onion www.randevukasino.com cplfk4kp5dzeakwc.onion
pkwfkh3z76xczyxt.onion
www.aktion-freiheitstattangst.org dublik2uqiorycsj.onion nh5hqktdhe2gogsb.onion ctlog.sheca.comnessie2022.ct.digicert.com
fhostingineiwjg6cppciac2bemu42nwsupvvisihnczinok362qfrqd.onion
fr-fr.facebookcorewwwi.onion www.gstatic.com
nessie2018.ct.digicert.com
oneirunda366dmfm.onion qxklmrhx7qkzais6.onion www.legalizer.info www.phpbbhq.com
hi-in.facebookcorewwwi.onion git.volatile.bz mammoth.ct.comodo.com
fel23cncdhum7icf.onion chipmixer.comchat.efnet.org:9090
torhiddenwiki.com hedgehog44773ens.onion
turbod44gwmvxnu3.onion brasilxi6ajnjqdg.onion forums.kkkkkkkkkk63ava6.onion
lgmtjgfpqk6hpik7yygkhavqivn6wsmfa7s7vszmcxwqkpwodinbhnad.onion
dark3zzgex3xwmcj.onion idomquol7lannf22.onion ctlog2.wosign.com www.certificatetransparency.cn
superkuh.bit ja-jp.facebookcorewwwi.onion deeplinkdeatbml7.onion provizorii.ruanticopyright.ru pepaieloghlblocc.onion
thepiratebay.ms anime.website
f5sco6gxvt7twuthpufz3x4pa44v77oi2ycdara44dgajbrgisrolnqd.onion:5222 thehiddenwiki.org log.certly.io
5v6jwhjrcyxjjdfasrqtkwmvyqmrcm2m26tegjfhlwj5icetnp5ydoqd.onion
selfdandism2ycbc.onion
digitk5khbmoayhm.onion tp4ewd72yavuouuy.onion
wikilink77h7lrbi.onion es-es.facebookcorewwwi.onion
g2rvhyzcapyxswgu.onion mariadb.org www.mathjax.org
b7cxf4dkdsko6ah2.onion z.cash
arhivachovtj2jrp.onion fel34pd37solhp2p.onion mixcox2htgxvtdmp.onion clients2.google.com
ct2.digicert-ct.com
cavetord6bosm3sl.onion postmill.xyz
iilhskoicbbrepsy.onion dot-bit.org kickassugvgoftuk.onion
17ysvSES8LyZ2mtAEo9GEYdujA9svP5r5u
bai5vj7eniqkrau5.onion traditio.wiki
wiki7psimrgr3shv.onion xmppspamc54buwix.onion phpbbex.com
wrhsa3z4n24yw7e2.onion wsjabberhzuots2e.onion
cuandojlp3cgenep.onion
xs2hkmcvdwvq4zbbghtfddhbt7fyven6njmh2may33icyivp3eelmzyd.onion
kbofqp5albsmiqqw.onion hi-in.messenger.com www.semantic-mediawiki.org tribute.stretchmyan.us
suicidio5364lj2l.onion freedomxexxwmqvi.onion
itworks.cyruservvvklto2l.onion probiv.biz blackmartdj3gzlh.onion
ygzf7uqcusp4ayjs.onion darkcon.nl dslvz6u2utvaylzg.onion linkdirdgrhkr2zm.onion
mailru2zxiq5rorc.onion
mat32scrdvrn5o4m.onion
megaeeayahdmmeee.onion
maps.metager.de
ddosecretspzwfy7.onion ijeeynrc6x2uy5ob.onion
fel32ygk7gqkjmcg.onion lab.workdark.net
beepedjhffvat3uwij5fxny72vlj7ugqb67ippjebise6adxf73y3uqd.onion
klmtzk5epmfkkaxr.onion pedoisteria.ru retracker.local fel22gpzgvb63pn4.onion
hostingkmq4wpjgg.onion x7ig3agdex7czbyn.onion
silentpost.org
vegalogic.com fel36ibuhqmitnju.onion ja-jp.messenger.com thepiratebay.se or7amhxzp7jc77xr.onion
n6doy7ndydmvdlts.onion darkconbp235ybwn.onion 2ymtdo5gae2mwxlv.onion darkmarket.nl mat26ebbb65svsy3.onion
mat25fp3lkbqz53q.onion
asmithti65rvrwev.onion
it.cyruservvvklto2l.onion
tordirhwtq6p7qcq.onion mega2web.com DeepDot35Wvmeyd5.onion ferkey4nox6vbqwr.onion
autinv5q6en4gpf4.onion
lawiki24onnfcrfl.onion
unityntfy5n7552k2zsxcajgwygpgdaqugxwbvmk4hmribl37xw6jiad.onion
selfdevuilyolz3n.onion try.cyruservvvklto2l.onion thepiratebay.org
cebollabaezobsmm.onion fel26sefmxbluwkj.onion
stack4bw5slctbl6.onion docs.electrum.org
segurof64tgwwnwa.onion
www.nytimes3xbfgragh.onion
jusfileobjorolmq.onion
ujnkg4uirpaiqejr.onion fel33logbgiycm5q.onion legalrcgaqsyxn6y.onion www.coinmama.com
thepiratebay.gd thepiratebay.vg
spectrocoin.com
jabberlistbrrxyk.onion
es.dstormer6em3i4km.onion
shadowrkcrqp3lit.onion justryit.cyruservvvklto2l.onion bitblendervrfkzr.onion novchronic.ru masterlistwtfzgt.onion
www.miner.dk
mat33phug6lqndps.onion663wbgqczxp445am.onion
haritonov.wiki
matanga3jcpwwyr7.onion
qkq6mzqqnh56xyuoetla7zr44vlx6mgm74nl6d3yp3644e3opisv5fyd.onion
linuxunflsafqsgh.onion ar-ar.messenger.com udod.traditio.ru www.suportephpbb.com.br
secdev.ieee.org rutor.info
fr-fr.messenger.com fel354xtupzhdx7q.onion
carontevaha5x626.onion traditio.i2pwww.livejournal.com
rosndp.org fel24rc3sssibpal.onion psi-im.org 3ur4xm2japn56c5f.onion
server66zf3ed473.onion windows.microsoft.com infodesksorcvsgq.onion
onofbqheegw4thzm.onion
bible4u2kjgjvbxs.onion community.livejournal.com securityzap.com www.coinbase.com wallofcoins.com
psyco2l2lrdxfnee.onion cabinet.deepwebvpn.net
z57whuq7jaqgmh6d.onion
torifysmuvxesu6u.onion
icxl2pwzgl7mfxz2imxhodplewzawpgwpjxm34tkeda3viug47fju7ad.onion
medusas6rqee6x6e.onion midcity7ccxtrzhn.onion
knzmercmbiesb7pp.onion darkseller.info mat22s4eohcboc7z.onion
it-it.messenger.com
tmodel-ccs2018.github.io blog.darkach.com
docfarmjyoafnmji.onion eais.rkn.gov.ru mat36pz6dsdt3mnj.onion bit.ly a2jutl5hpza43yog.onion
suma-ev.de
liber4hxj4bnxft4ougyjuyebmi7lz7uxxmv5oscjrtckvnpb4fcblid.onion cyclowiki.org xorgateka6obqneh.onion psi-plus.com
u5ed42u6sbzq7xzs.onion de-de.messenger.com
arhivach.reformal.ru
applei7nkshrsnih.onion
ze4j4or7ax3omqdmsdnje3yk7oykg5bhy5uzrsmeuenlxgororsf4ryd.onion
rivwo3erj6nzo73dhtudwo6xzfi5z3ialia2o2q6iwj4hkp6yxq6hoid.onion godaddybqmlicbis.onion xboardgfawtcsfiu.onion
www.robgjansen.com oek4nfanuw4dccid.onion
panopticlick.eff.org wrkdrkod7ybdfbre.onion es-es.messenger.com
workdark.net
odaystoresh44tsy.onion darkmarket.pw
mat347etuzo2nweg.onion mat35lyu3qfqhgvs.onion www.miranda-im.org
www.syverson.org
mentalg4vb6qto2r.onion 3dboysn3o5d7dk3i.onion darkseller.pw x5iwbj5jtrtiaqzn.onion safeklad.com
gnupg.org rahakottymyflyum.onion fel25g6iq2vvas65.onion
222227qyeb7kxxl7.onion steplaf3p2u4e7pg.onion
paradiseckr3thoo.onion s74kepaw5tnkzj5j.onion safetyjabber.com
gitlab.metager3.de eosdawn6knv2mno3.onion
clonedusbmna6mmw.onion delostadpsfteoqc.onion
xmpp.org
www.blockchain.com clc.am probiv.one www.gajim.org
www.whonix.org&text=&via=Whonix
www.wecanhelp.de
libertedvbw5kkrh.onion dl.acm.org
darkmarket.bz
bible4u2lvhacg4b3to2e2veqpwmrc2c3tjf2wuuqiz332vlwmr4xbad.onion the-hidden-wiki.com
pedofuckk7zv4qxx.onion nginx.org
bookdxr37kjmumpk.onion
noscamkvtrkanzxh.onion www.os-templates.com
abc6onyourside.com 127.0.0.1:43110
petsymposium.org
www.petsymposium.org
dembtxt2izv4tnpb.onion
www.cs.unm.edu
bible4u.i2p nehakumardotorg.files.wordpress.com
3wcwjjnuvjyazeza.onion www.sec.in.tum.de
www.directory-root.com www.cs.toronto.edu
www.aaai.org
elbinario.net
statv2gccyh7roto.onion www.degruyter.com xz2bhyw5g7tnlx5r.onion.direct
gnunet.org on5q7dqzlct7fvef.onion
mqkrplmfqbtifk4n.onion conferences.npl.co.uk
hgi.rub.de 222222224gidecov.onionpapers.ssrn.com www.cl.cam.ac.uk explain4pg4j5wbw.onion
pedofunhph4fwu4b.onion dedis.cs.yale.edu comp.social.gatech.edu
crypto.stanford.edu
www.researchwithoutwalls.org
pages.cs.wisc.edu
research.torproject.org www.victoriamanfredi.com
web.eecs.umich.edu moietybfhbdbulbw.onion
72kkhupynpkdgevn.onion
sps.cs.uni-saarland.de citeseerx.ist.psu.edu
wpage.unina.it
cyber.law.harvard.edu www.eecs.berkeley.edu
techscience.org tlsfingerprint.io www.ieee-security.org mjfjbs3547exsy6r.onion
software.imdea.org
blanu.net
www.drupal.org nginx.com
homes.cs.washington.edu
www.cogitatiopress.com dud.inf.tu-dresden.de nms.csail.mit.edu
gdaqpaukrkqwjop6.onion cryptome.org
conferences.sigcomm.org cseweb.ucsd.edu nrr7eouwbujknu22.onion
gking.harvard.edu
undrol7rt4yu5zzd.onion acmccs.github.io www.eecs.harvard.edu
fc18.ifca.ai conferences2.sigcomm.org www.xmpp.org
tma.ifip.org www.icsi.berkeley.edu
security.cs.georgetown.edu grothoff.org
www.csd.uoc.gr
www.icir.org
netzpolitik.org wind.lcs.mit.edu
www.cs.nyu.edu www.frankwang.org
delivery.acm.org svn.torproject.org data.coop
censorbib.nymity.ch www.cs.rice.edu
ifca.ai cbw.sh
people.cs.umass.edu
www.cypherpunks.ca thecostofknowledge.com
www.cs.uml.edu seclab.cs.ucsb.edu
hatswitch.org
www.cs.princeton.edu
onionvitae4u7l4m.onion www.fsf.org
www.cs.ucr.edu
www.margaretroberts.net
www.jbonneau.com
indymedia.us
roma.indymedia.org
valencia.indymedia.org
maine.indymedia.org lille.indymedia.org qollasuyu.indymedia.org
japan.indymedia.org arizona.indymedia.org
nigeria.indymedia.org
rochester.indymedia.org
www.ucimc.org
barcelona.indymedia.org
nice.indymedia.org atlanta.indymedia.org ovl.indymedia.org
bigmuddyimc.org
tampabay.indymedia.org
193.189.147.16 ontario.indymedia.org
vermont.indymedia.org
sf.indymedia.org bolivia.indymedia.org estrecho.indymedia.org
www.indymedia.ie rogueimc.org
opencontent.orgcolumbus.indymedia.org
grenoble.indymedia.org quebec.indymedia.org
dc.indymedia.org
ottawa.indymedia.ca bc.indymedia.org
athens.indymedia.org
manila.indymedia.org ukraine.indymedia.org
reboot.stlimc.org www.okimc.org cvilleindymedia.org
linksunten.indymedia.org codecoop.org print.indymedia.org tnimc.org
docs.indymedia.org de.indymedia.org www.redside.tkpt.indymedia.org
www.midiaindependente.org www.indymedia.org
bxl.indymedia.org vicindymedia.org calabria.indymedia.org
www.indymediascotland.org
belarus.indymedia.org croatia.indymedia.org ctzzqqimlfamyhrc.onion
italy.indymedia.org madison.indymedia.org
belgium.indymedia.org
qc.indymedia.org piemonte.indymedia.orgbulgaria.indymedia.org
cleveland.indymedia.org
maritimes.indymedia.org 4sy6ebszykvcv2n6.onion
neworleans.indymedia.org
ambazonia.indymedia.org poland.indymedia.org
blog.eichhoernchen.fr
mumbai.indymedia.org
lombardia.indymedia.org endofroad.blackblogs.org
sucre.indymedia.org
kenya.indymedia.org openrepos.net
northern.indymedia.org
burma.indymedia.org portland.indymedia.org southafrica.indymedia.org
hungary.indymedia.org
non.copyriot.com canarias.indymedia.org ecuador.indymedia.org
newmexico.indymedia.org
houston.indymedia.org
nantes.indymedia.org
sandiego.indymedia.org istanbul.indymedia.org
emiliaromagna.indymedia.org patras.indymedia.org
sarasota.indymedia.org
romania.indymedia.org belgrade.indymedia.org
nottingham.indymedia.org darwin.indymedia.org
pittsburgh.indymedia.org
indymediapr.org beirut.indymedia.org baltimore.indymedia.org radio.indymedia.org jolla.com
montreal.indymedia.org korea.indymedia.org
austria.indymedia.org livecounter.theyosh.nl
chilesur.indymedia.org
tijuana.indymedia.org laplana.indymedia.org
chicago.indymedia.org
madrid.indymedia.org
alternativesg7.org
twincities.indymedia.org uruguay.indymedia.org
london.indymedia.org miami.indymedia.org
sardegna.indymedia.org piratenpartij.nl
colorado.indymedia.org jakarta.indymedia.orgwww.indybay.org hawaii.indymedia.orgafrheinruhr.blogsport.de
russia.indymedia.org
hambacherforst.org liguria.indymedia.org londonontario.indymedia.org
uk.indymedia.org israel.indymedia.org gekko.theyosh.nl
venezuela.indymedia.org cyprus.indymedia.org rosario.indymedia.org
asheville.indymedia.org video.indymedia.org
www.indymedia.org.nz
brisbane.indymedia.org bristol.indymedia.org vcard.theyosh.nl
nh.indymedia.org
nyc.indymedia.org
buffalo.indymedia.org
binghamton.indymedia.org la.indymedia.org
alacant.indymedia.org
malta.indymedia.org www.linuxcounter.net
peru.indymedia.org
thunderbay.indymedia.org
chapelhill.indymedia.org
santiago.indymedia.org
me-download.wickr.com nnm5gu6g2bs7nnmm.onion www.webring.org

tmaxyctcdf2zqoiv.onion center4u6cm5cm4w.onion
www.solucija.com www.hackster.io unsplash.com
xxrlxxhjy6ed2d76.onion www.sra.org.uk
decodedsbwzj4nhq.onion www.1centroulette.com flkcpcprcfouwj33.onion
start.jungswtfwgjwile2 docs.joomla.org
intu57shj4wfofk6.onion www.ma.utexas.edu
iwjke47bybivwh6i.onion 222lotto3zga65ot.onion 2rgibznkzrtz7wme.onion 3cxmx5xalprbwmuu.onion 5jlofek2ajaywwk3.onion
ycfgjwbfhnqvtclm.onion forum.jungswtfwgjwile2.onion
www.locorevue.com counter5nolixj34.onion dlegal66uj5u2dvcbrev7vv6fjtwnd4moqu7j6jnd42rmbypv3coigyd.onion member.1centroulette.com start.jungs.wtf forum.joomla.org www.math.cmu.edu
222222222fyhdxlj.onion packages.brom:3142 godel.se skynet7nefghsljj.onion
vestacp.com fluxbb.org
bytesex.org voozaqizei2dborx.onion
www.redtube.com fudkjb2tonsizx7c.onion center222xdihudu.onion rhe4faeuhjs4ldc5.onion
mb4 n4udgsuyqgvaszza.onion s-kassa.com
darktorch5lgddvm.onion
www.unremote.org tm47kmrvlxuibig7.onion
t0r.ch:100
streamtmr46ysxw6.onion sxzgqh7j6sgiy6he.onion ttnkd47gkavn64yz.onion tvlh66qo23ksfk4k.onion wolfmu4yjw3srihs.onion

cxpizstpfzlljfng.onion z4kzldluie37m5vp.onion rbaco5flcou46wpd.onion rjuvjyygjqm6mlqm.onion rkphrici4u5ffhhm.onion rocksolidyyacwsa.onion easyko3zrfooqrpo.onion ruv6gkdi2p42juij.onion elherbotsiddarol.onion empiremktxgjovhm.onion sale24u3apkfx252.onion feeds.propub3r6espa33w.onion savkhz37olwuub37.onion serialyheptjyrf5.onion giesn3ivtzp5z2us.onion gnshpojuxrioibud.onion grams7enqfy4nieo.onion gtgmep4mv6gdyvav.onion hpquscklwzoiw7qv.onion hydra23qk4ar6ycs.onion ilovecphfjziywno.onion jabber.jungswtfwgjwile2.onion
www.acme.com imgs.xkcd.com wtj5psom5zufu4yo.onion hookshcsl3v6nzux.onion www.fluxo.info iitnxqlpmjrbhxoz.onion live.blockcypher.com espenav2n45atpsj.onion wiki.wmtransfer.com wallets.onion retroshare.ch elherbowejkqwf32.onion tpo7v66snknyugsf.onion www.pnyxe.shadow.com feed.press www.e-reading.pw www.simplecoin.cz www.valeo-one.de stkonsbado54og4t.onion toradsc6vvmtugty.onion thirdworlds.net bitnodes.21.co hydra.centre sao2lrurmcsakymy.onion wiki.jungswtfwgjwile2
1centcasino.com
escrowq5tus5jpgw.onion
satri4bb5r56y253.onion
gaschambrmavriwo.onion
greenaxgw3nkwkf7.onion
hackhelpnylin6d4.onion
iug4yfvnmag6tqzq.onion
jvauzb4sb3bwlsnc.onion
F g 1 Ne wo k o da a co ec ed du ng c aw ng
Tab e 1 Bas c pa ame e s o he ne wo k

Bas c Parame er Va ue
No Nodes V 6882
No Edges E 29519
No so a ed nodes 39
Dens y ρ 00
No Connec ed Componen s 127
Avg Shor es Pa h eng h 4 108
der ve a co ec on o seman c abe s nd ca ng broad op cs o con en on Tor Each Tor h dden serv ce s hen ass gned
a abe by he dom nan op c presen across he se o a Web pages nves ga ed n he doma n Tab e 2 presen s a
summary descr p on o he op c abe s n erred
4 L NK NG PROCESS OF TOR SERV CES TO DARK/SURFACE RESOURCES

To ga n an unders and ng o he nk ng process n he ne work F gure 2 nd ca es he number o hyper nks rom each
Tor doma n o Web pages on he sur ace and dark Web From he ver ca and hor zon a nes n he scatterp o po n s
can be ca egor zed n o hree d v s ons
1 Serv ces w h ess han 3 sur ace Web ne ghbors These Tor serv ces are compr sed o 13% o dark serv ces wh e 8%
on y have nks o Tor doma ns w h no re erence o sur ace webs es Hence on y ess han one en h o dark serv ces
are mmune aga ns he n orma on eakage caused by nk ng o he sur ace Web F gure 3 represen s he d s r bu on
o re erence s zes number o re erences or he firs ca egory n ogar hm c sca e Va ues w h he arges requency
nd ca e ha mos Tor doma ns n h s c ass have around 50 o 100 hyper nks o he o her dark coun erpar s Manua
nves ga on on he doma ns w h max mum number o dark ne ghbors shows ha hey be ong o 31 Tor doma ns
Manu p ubm tted o ACM
Table 2. Summary description of Tor domain types

Topic label Description
Directory Directories include unnamed pages with address lists of Tor hidden services including TorDir and
Hidden Wiki services, as well as search engines like DuckDuckGo and Fresh Onions.
Bitcoin Provides services for Bitcoin transactions and fund transfers to wallets.
News Host pages akin to personal weblogs where authors write essays on various topics and visitors can
post follow-up comments.
Email Provides communication services like email, chat room, and Tor VPNs.
Multimedia Provides multimedia products like e-books, movies, music, games, and academic and press articles
even if they are copyright protected.
Shopping Shopping domains allow visitors to purchase goods and services, including drugs, medicine, as well as
consultancy and investment services.
Forum Forum domains host bulletin board and social network services for Tor users to discuss ideas and
thoughts.
Gambling Gambling domains offer services to bet money on games, to purchase gambling advice and consulting,
and to read gambling-related news.
Dream market A shopping domain so large that it merited its own topic category is the Dream market. It suggests a
wide range of content available for sale, most of which are illicit.
500
No. Dark Web Neighbors
50
5
1
1 2 4 10 500
No. Surface Web Neighbors
Fig. 2. Number of references to surface Vs. dark Web; both axes in logarithmic scale.
which is approximately equal to .94% of all Tor services studied in this research. Exploring their corresponding services
indicates that they are some well-known dark directories which present large lists of onion addresses in Tor network.
For instance, one of the domains with maximum number of dark neighbors is a Tor directory (5jgis47vdcpaeafp.onion)
presenting 1,264 hyperlinks to other onion services in Spanish.
(2) Services with less than 3 dark Web neighbors: This category is comprised of 20% of all Tor domains where 14%
are dark services which have links to the surface Web, but no reference to dark domains. This implies that less than one
fifth of dark services contain hyperlinks to only surface websites. Table 3 presents description of some Tor domains
with number of surface Web neighbors close to the maximum (500). The domains listed are some of popular domains
200 500
50
Frequency
5 10
2
1
1 2 5 10 20 50 100
No. Dark Web Neighbors
Fig. 3. Distribution of number of Dark Web neighbors for Tor domains in the first category; both axes in logarithmic scale.
Table 3. Description of some onion domains with more than 200 references to surface Web and no link to dark Web
# of Surface
Onion Domains Service Web Neighbors
222222b63tfqitrx Bitcoin 188
222222zsr3ih57iw Bitcoin 196
3wcwjjnuvjyazeza Hacking books 697
Hosting Debian
4do6yq4iwstidagh services 158
4sy6ebszykvcv2n6 News (German) 1358
Hosting Debian
5nca3wxl33tzlzj5 services 232
that provide services for digital cryptocurrency, hacking, and hosting Tor services. Users of such domains are referred
to surface websites to perform bitcoin transactions, get latest news and information, or download multimedia resources
such as electronic books.
(3) The rest of points belong to dark services that contain hyperlinks to both surface and dark Web. This category
forms 78% of all points on the plot which in addition to the size of second category implies that more than 90% of Tor
domains contain at least one link to the surface Web. It indicates to what extent dark services provided on Tor can be
vulnerable against information leakage due to linking to surface websites. This finding can also explain the reason of
significantly smaller number of isolated nodes (1.1% of Tor services) in the network of Figure 1 in contrast to the Tor
network studied in [29] where 12% of crawled services were isolated.
As an example of services in this group, CensorBib3 is a Tor service linking to 921 dark domains and 205 websites
from the surface Web. It is a well-known Tor service providing open access to research papers in the field of Internet
censorship and Tor. For each article, there are three resources provided as hyperlinks: pdf, cached pdf, bib. The PDF
version of each paper (if exists) redirects users to a publication website on the surface Web while the cached PDF version
3 3wcwjjnuvjyazeza.onion

Table 4. Summary statistics of network features

Parameter Min 1st. Qu Median Mean 3rd. Qu Max
Edge betweenness Cent. 0.00 1.00 3.00 59.75 28.00 81,126.53
Avg. Shortest Path Len. 0.00 0.00 0.00 0.21 0.00 6.64
Eccentricity 0.00 0.00 0.00 0.25 0.00 11.00
In-degree Cent. 0.00 2.00 3.00 4.29 4.00 309.00
Out-degree Cent. 0.00 0.00 0.00 4.29 0.00 1,358.00
Stress Cent. 0.00 0.00 0.00 175.00 0.00 230,857
Clustering Coef. 0.00 0.00 0.00 0.09 0.083 1.00
1.000
1.00
0.500
0.50
0.100
0.20
0.050
0.10
0.010
0.05
0.005
0.02
0.001
0.01
1 100 10000 1 100 10000 1 5 20 100 1 2 3 5 7
Edge Betweenness Stress In-degree Average Shortest Path Length
1.0
1.00
0.500
0.5
0.20
0.050
0.05
0.2
0.005
0.1
0.01
1 2 5 10 1 5 50 500 1e-05 1e-03 1e-01

Eccentricity Out-degree Clustering Coefficient
Fig. 4. Frequency Distribution of Network Parameters
redirects users to an onion address to download the paper. The bib also contains the content of ‘.bib’ file provided for
each article.
5 ANALYZING REFERENCE VIEW OF TOR SERVICES

Now, we perform topological analysis on the directed network of hyperlinks from dark domains to other dark/surface
resources using various measures of network properties. Table 4 presents the basic statistics of network features. As
illustrated, distributions of all network parameters are right-skewed since the mean is greater than the median, right tail
of the distribution is long, and median is closer to the first quartile. Figure 4 presents the CCDF plot of the distribution
of each feature in log-log scale. CCDF, complementary cumulative distribution function, of a random variable ν shows
the probability that ν will be greater than a particular value x [28].
Table 5. List of edges with Edge betweenness Centralities greater than 10,000
Source Target Source service Target service
dirnxxdraygbifgc wiki5kauuihowqi5 Dir 5 (OnionDir) Dir (HiddenWiki)
doe6ypf2fcyznaq5 dirnxxdraygbifgc Dir (Runion Wiki 6 ) Dir (Web proxy address of
OnionDir 7 )
hiddenwik55b36km newsiiwanaduqpre Dir (HiddenWiki) News (OnionNews provid-
ing news on Tor)
lwplxqzvmgu43uff doe6ypf2fcyznaq5 Forum (Runion Dark Fo- Dir (Web proxy address of
rum) OnionDir)
deurfnquin7mvni2 godnotabatovgyqz Dir (Py- Dir (Fresh Onions search en-
rowiki—Pyrotechnics gine
drug wiki)
newsiiwanaduqpre dirnxxdraygbifgc News (OnionNews provid- Dir (OnionDir)
ing news on Tor)
1. Edge betweenness centrality. 4 The edge betweenness centrality of an edge e indicates number of shortest
paths between each pair of nodes that traverses through e divided by total number of shortest paths between that pair
of nodes [22]. Assuming Centb (e) as the edge betweenness centrality of edge e, the partial betweenness value of this
edge for each pair of nodes is calculated as follows:
δvt (e)
bvt (e) =
δvt
where δvt (e) indicates number of shortest paths between v and t that contains the edge e and δvt is the number of
shortest paths between v and t. Centb (e) is calculated as the summation of the partial values for all pairs of vertices:
Õ
Centb (e) = bvt (e)
v,t ∈V
A high value of this centrality for an edge implies that it plays an important role in bridging communication between
network nodes. As mentioned before, the network does not contain any edges from surface Web nodes to other vertices.
Therefore, edges here indicate connections between a pair of Tor services (dark-dark edges) or from one Tor domain
to a surface website (dark-surface edges). According to Table 4, average edge betweenness centrality is 59.75 which
has significant difference with the maximum centrality (81,126.53). Figure 4 indicates that the probability of values
greater than 100 is less than 0.1 which has significant difference with probability of values lower than 100. Also, all
dark-surface edges should have low edge betweenness centralities because as mentioned before, there is no link from
surface websites to other vertices and thus, the edges that connect Tor to surface Web will have low edge betweenness
centrality. On the other hand, investigation indicates that there is only 3% of the edges with centralities greater than
the average. This implies that few dark-dark edges have notable contribution to communication through the network
and the most efficient nodes through the dark Web thus pass through the surface Web.
To gain an overall impression of edges with high edge betweenness centrality, Table 5 presents the top-six edges and
type of services provided by their corresponding source and target domains. As illustrated, domains corresponding
to edges with high edge betweenness centralities are well-known Tor information providers as either directory or
news/forum services. This finding emphasizes the ability for information disseminating from the dark Web can be
released over the world.
4 It is calculated for networks with no multiple edges.
Frequency
3000
0
0 2 4 6 8 10
Eccentricity
Fig. 5. Frequency Distribution of Eccentricity
2. Eccentricity. The eccentricity of a vertex is the inverse of maximum non-infinite distance it has from other
vertices in the graph [16]. Distance between two nodes is the length of the shortest path between them where length of
a path is declared as the number of edges building the path. Eccentricity of an isolated node is zero. By computing the
shortest path between the vertex v with others, we calculate the eccentricity of v, Ecc(v), as:
1
Ecc(v) =
dist(v, k)
where k is the node which has longest shortest path with v and function dist returns the distance between them. High
value of eccentricity implies that other vertices are in proximity of v while low eccentricity indicates at least one node
and its direct neighbors are located far from v. Maximum value of eccentricity can also depict the diameter of a network
which is defined as the largest distance between two nodes. For a disconnected network, diameter is the maximum
diameter of all the connected components. As Table 4 demonstrates, the diameter of the network in Figure 1 is equal to
11.0. The radius is also defined as the minimum none-zero eccentricity of a network which is here equal to 1.0.
The distribution of eccentricity in Figure 4 indicates that the probability of values greater than five is less than
0.5 and maximum eccentricity has a probability close to zero. It reveals that there are a few resources which have
great proximity to others. Manual investigation shows HiddenWiki, onionDir, TorWiki, and Runion Dark Forum have
eccentricities near the maximum. To get a deeper insight into the distribution of eccentricity values, Figure 5 shows the
eccentricity histogram where for 5,635 nodes (82% of all vertices), this measure is zero. As the network has several
connected components, the distance for nodes located in different components is defined as infinite which makes their
corresponding eccentricity tend towards zero. Also, since there is no outgoing edge from surface websites to other
nodes in the network, their eccentricity will be zero. Such surface websites account for 64% of all vertices with zero
eccentricity. The rest (36% of zero centralities and 61% of Tor domains) belong to dark services which are either isolated
or have only a few connections with others. On the other hand, for 1,102 nodes (16% of all vertices and 33% of Tor
domains), the centrality value is in [1, 2) and a few (2% of all and 6% of Tor domains) have eccentricity equal to or
greater than 2. This finding reveals in spite of referencing to surface, a larger portion of Tor domains are far from either
dark or surface resources which complements the analysis in [29] that reports lack of tendency in Tor domains to link
each other.
5 Dir stands for ‘Directory’

6 Russian forum on the address of lwplxqzvmgu43uff.onion (for more details, please see https://darknetlive.com/runion-forum/)
7 http://dirnxxdraygbifgc.onion/

Table 6. 20-top Tor Services with high Stress centrality

Service address Service type/name Service address Service type/name
24boths2mh6sxaz5 Automated bots for rent (Russian) kpvz7ki2lzvnwve7 HiddenWiki
24xbtc424rgg5zah Digital Crypto (Russian) hosting6iar5zo7c Real Hosting
2qrdpvonwwqnic7j Dark net Community (Italian) gnvweaoe2xzjqldu VisiTor
32pbf32xi6ccm63z Pornography 2ddjd7xsni7pefcx Fresh Onions
3bbaaaccczcbdddz OnionLand Search Engine darkwikiss2rmeby DarkWiki (Russian)
3kyl4i7bfdgwelmf DeepDotWeb deurfnquin7mvni2 Pyrowiki—Pyrotechnics drug wiki
doe6ypf2fcyznaq5 Runion Forum (Russian) torlinkbgs6aabns HiddenWiki
dirnxxdraygbifgc OnionDir wiki5kauuihowqi5 HiddenWiki
4do6yq4iwstidagh Debian Onion Service newsiiwanaduqpre News blog on Tor
4hohkxjvlt5fjzqv Search Engine (Portuguese) lwplxqzvmgu43uff Runion Forum (Russian)
3. Stress centrality. The stress centrality shows the number of shortest paths running through each vertex in a
network with no multiple edges [8]. Higher value of stress for a dark domain or surface website shows it is traversed
by a large number of shortest paths and thus plays an important role in information dissemination trough the network.
However, the corresponding vertex may not be critical in maintaining the communication between pairs of nodes since
there may be other shortest paths between each pair that are not passed over it. Let σst (v) show the number of shortest
path between two nodes of s and t that contain vertex v. Then, the stress centrality of v, Cents (v), is calculated as
follows:
Õ
Cents (v) = σst (v)
s,t ,v ∈V
which results in the summation of partial centralities for all pairs of nodes in the network. According to the Table 4,
the average stress centrality of the network is 175 while the maximum equals to 230,857. As Figure 4 indicates, the
probability of values greater than the average is rapidly decreasing from 0.5 while the probability for the rest is
approximately 0.5. Investigation depicts that most network vertices (94%) have stress lower than the average and only a
few centralities (6%) are greater than this value. Also, since surface websites have no out-going edges to others, their
stress centrality should be zero. Therefore, the minor large centralities belong to Tor services. This implies that a large
portion of Tor services are reluctant to contribute in information traversing through the network which help them
remain difficult to discover by Tor users, especially by the law enforcement agencies.
Assuming Tor domains sorted in descending order based on their stress centrality, Table 6 illustrates the 20-top
dark services which provide information in different languages including Russian and Portuguese. More than half of
these services belong to well-known directories and their high stress centrality is the result of their huge number of
in-coming and out-going connections. There are also two forums, one Bitcoin, and one bot rental domain that provide
services in Russian. There are also one pornography, one news blog, and one hosting service which show the other
main Tor domains conductive to information transmission through the dark Web.
4. Out-degree. The out-degree is another important feature which gives the number of links each domain or website
has to others. According to Table 4, values range from 0 to 1,358 where the average is 4.29. The distribution of values in
Figure 4 indicates that the probability of values less than the average is approximately 1. Most vertices (81%) have no
link to others which includes all surface websites along with 60% of Tor domains. This implies that more than half of
Tor services are reluctant to refer their users to either surface or dark sources. For the remaining 40%, their out-degree
lies in [1, 1358] and based on the manual investigation, only 14 domains have out-degree centralities greater than 400.
Table 7. 20-top Tor Services without-degree centrality greater than 400

Domain name Service type Domain name Service type
dirnxxdraygbifgc Dir (OnionDir) jh32yv5zgayyyts3 Dir (Onion List)
4sy6ebszykvcv2n6 News (German) wikitjerrta4qgz4 Dir (HiddenWiki)
4zkgktc6hjdmp6kw Dir (HiddenWiki) chws5ibwliag4fyc Dir (OnionLand Search)
5jgis47vdcpaeafp Dir (La Wiki Oculta)/Spanish wiki5kauuihowqi5 Dir (HiddenWiki)
version of HiddenWiki
gnvweaoe2xzjqldu Multimedia (hosting Debian hiddenwik55b36km Dir (HiddenWiki)
onion services)
7g5bqm7htspqauum Dir (HiddenWiki) torwikignoueupfm Dir (TorWiki)
2ddjd7xsni7pefcx Dir (Fresh Onions) zgrl6sghf5jh37zz Dir (HiddenWiki)
Table 8. 10-top Tor Services with In-degree centrality greater than 100
Node Web address Node type
blockchainbdgpzk.onion (along Dark Bitcoin service
with its 3 mirrors)
btc.com Surface Bitcoin Block Explorer
twitter.com Surface Twitter website
Facebook.com Surface Facebook website
torproject.org Surface Tor project website
github.com Surface GitHub website
3g2upl4pq6kufc4m.onion Dark DuckDuckGo Search Engine
Table 7 presents the description of services provided by the domains with more than 400 links to others. As illustrated,
it contains popular directories, one German news, and one multimedia service that provide information on hosting
Debian onion services. This finding is not surprising as directories are the services with huge lists of onion addresses
in forms of hyperlinks that results in high out-degree centrality. News domains also provide information in different
topics and may support the validity of the content by linking to the original websites of the news. Manual investigation
of the content provided by the multimedia service also depicts that this domain contains several links to other similar
resources on both Tor and surface Web which provide technical details about Tor and Debian operating system.
5. In-degree. This feature demonstrates the number of links to a dark domain or surface website. As Table 4
indicates, values range between zero and 309 with the average of 4.29. Probability of values less than the average is close
to 0.5 while probability of values more than 100 is less than 0.1. Manual exploring reveals that only 8.8% of vertices have
less-than-average in-degree, 91% have in-degree values between the average and 100, and only 10 nodes have more than
100 in-coming links. To further investigate such outliers, Table 8 lists their address/names and whether each is a dark
or surface resource. As Table 8 represents, one dark and surface bitcoin services are among the nodes with more than
100 in-coming links. It is not surprising because there are marketplaces on dark Web which use digital cryptocurrency
using either dark or surface Web services as payment method. The DuckDuckGo search engine is another dark service
that has notable in-degree value. It shows that there are several Tor domains which refer their visitors to this search
engine for further exploration on the dark Web. There are also some popular surface websites such as Twitter, Facebook,
GitHub, and Tor project which are linked by several Tor services which indicates their popularity among dark services.
6. Clustering Coefficient (local). The local clustering coefficient evaluates how much neighbors of a node tend to
cluster with each other. In the context of dark services, this metric for a service c indicates the extent to which other
services that are directly linked by c make reference to each other. This metric calculates the fraction of number of
edges among all neighbors of a node over maximum number of possible edges its neighbors can have with each other.
Assuming ηv is the number of neighbors of vertex v and ev is the number of connected pairs between all neighbors of
v [1], the local clustering coefficient of v in a directed network is calculated as:
ev
CCv =
ηv (ηv − 1)
Ranging between 0 to 1, values close or equal to zero indicate a node whose neighbors seldom connect to each other
while values near one show a node with tightly connected neighborhood.
As Tabel 4 and Figure 4 indicate, the average clustering coefficient is 0.09 and the probability of values less than
the average is near 0.5 which indicates that for about half of the vertices, neighborhoods are almost sparse and barely
link each other. As mentioned before, surface websites in the network have no link to other nodes and hence, their
clustering coefficient will be zero. Regardless of the surface nodes, the rest with less-than-average clustering coefficient
forms 61% of the Tor domains while the remaining 39% have values greater than 0.09. This finding implies that in spite
of interest in Tor domains to remain isolated, references to surface websites increase the clustering coefficient values
for dark services. Also, the reason why their clustering coefficients have notable difference with 1 (as the maximum
possible value) is that there is no links from surface websites to others, which reduces the number of links between
pairs of nodes in neighborhoods of vertices.
7. Average Shortest Path Length. This feature is one of the most important characteristics of real-world complex
networks [19]. This metric indicates the expected distance between each connected pairs of nodes. Assuming G = (V , E)
is a directed graph, dist(s, t) is defined as the shortest distance from s to t, and αG shows the number of all paths in G,
SP(G) which indicates the average shortest path length of G is calculated as:
Í |V |
v i ,v j ∈V dist(vi , v j )
SP(G) =
αG
where for an isolated vertex, the distance to any other node is zero. Similarly, if vi = v j , the average shortest path
length will be zero.
Based on Table 4, the mean (.2) and maximum (6.64) values of this parameter demonstrate that every node of the
network can be reached from others using by average one and at most seven edge(s), respectively. As Figure 4 indicates,
the probability of values less than or equal to 2 is close to 1 while for values near 7, the probability is less than 0.2.
This implies that most vertices are accessible via at most two edges and only a few of them are far from the others. As
mentioned earlier, the linking process of the network indicates that large portion of vertices participate in a single large
connected component which can explain why the average shortest path length of most vertices have low values. Since
the network is almost connected and the maximum average shortest path is comparable with the logarithm of network
size, users of this small world can reach every dark domain or surface website after traversing a short distance on the
network.
6 CONCLUSION AND FUTURE WORK

This work investigates the network of references from dark services to surface websites using well-known network
analysis metrics to answer how the network structure of dark-to-surface hyperlinks differs with the linking pattern of
Tor hidden services. It also considers to what extent dark services are vulnerable against information leakage caused by
linking to the surface Web resources. To achieve a deeper insight into the nature of Tor hidden services, the results are
also analyzed regarding the type of content and information provided by Tor domains.
Results depict a structure that contrasts with the hyperlink structure of Tor. The dark-to-surface reference network
is a single massive connected component with small number of isolated Tor domains. However, Tor resources are still
interested in being isolated. Only a few Tor hidden services are immune against information leakage while over 90% have
at least one link to the surface Web. Such referencing to surface makes Tor domains closer to each other and increases
their interest to cluster. But, it does not raise the contribution of dark services to either communication or information
dissemination through the network. Analyses on the type of dark services reveal that well-known Tor directories
have the maximum proximity to all the other Web resources and significantly contribute to both communication and
information dissemination from the dark-to-surface network. A few domains with other types of services such as news,
pornography, and multimedia also contribute to information propagation through the network. Analysis on the degree
distribution indicates popular surface websites such as GitHub, Twitter, and Facebook are popular even among Tor
domains.
Future work can expand this work further by investigating the changes in the pattern of referencing from dark
to surface Web over time. It can reveal some permanent characteristics in the linking structure of dark services and
indicate how their vulnerability against information leakage can change over time. Another direction of future work is
to compare this network with other type of socio-technical systems like the Web structure. Such a comparative study
can reveal possible ways to model the dark-to-surface network using algorithms such as ERGM which can be useful for
link prediction and thus, assessing the risk of information leakage.
7 ACKNOWLEDGMENTS
This paper is based on work supported by the National Science Foundation (NSF) under Grant No. 1464104. Any
opinions, findings, and conclusions or recommendations expressed are those of the author(s) and do not necessarily
reflect the views of the NSF.
REFERENCES
[1] Albert-Laszlo Barabasi and Zoltan N Oltvai. 2004. Network biology: understanding the cell’s functional organization. Nature reviews genetics 5, 2
(2004), 101.
[2] Kevin Bauer, Damon McCoy, Dirk Grunwald, Tadayoshi Kohno, and Douglas Sicker. 2007. Low-resource routing attacks against tor. In Proc. of the
2007 ACM workshop on Privacy in electronic society. 11–20.
[3] Massimo Bernaschi, Alessandro Celestini, Stefano Guarino, and Flavio Lombardi. 2017. Exploring and analyzing the Tor hidden services graph.
ACM Transactions on the Web 11, 4 (2017), 24.
[4] Massimo Bernaschi, Alessandro Celestini, Stefano Guarino, Flavio Lombardi, and Enrico Mastrostefano. 2019. Spiders like Onions: on the Network
of Tor Hidden Services. In The World Wide Web Conference. 105–115.
[5] Alex Biryukov and Ivan Pustogarov. 2015. Bitcoin over Tor isn’t a Good Idea. In 2015 IEEE Symposium on Security and Privacy. 122–134.
[6] Alex Biryukov, Ivan Pustogarov, and Ralf-Philipp Weinmann. 2013. Trawling for Tor Hidden Services: Detection, measurement, deanonymization.
In Symposium on Security and Privacy. 80–94.
[7] David M Blei, Andrew Y Ng, and Michael I Jordan. 2003. Latent Dirichlet Allocation. Journal of Machine Learning Research 3, Jan (2003), 993–1022.
[8] Ulrik Brandes. 2001. A faster algorithm for betweenness centrality. Journal of mathematical sociology 25, 2 (2001), 163–177.
[9] Andrei Broder, Ravi Kumar, Farzin Maghoul, Prabhakar Raghavan, Sridhar Rajagopalan, Raymie Stata, Andrew Tomkins, and Janet Wiener. 2000.
Graph Structure in the Web. Computer Networks 33, 1-6 (2000), 309–320.
[10] Pavlo Burda, Coen Boot, and Luca Allodi. 2019. Characterizing the redundancy of DarkWeb. onion services. In Proc. of the 14th Int. Conference on
Availability, Reliability and Security. 19.
[11] Enrico Cambiaso, Ivan Vaccari, Luca Patti, and Maurizio Aiello. 2019. Darknet Security: A Categorization of Attacks to the Tor Network. In Italian
Conference on Cybersecurity.
[12] Michael Chertoff and Tobby Simon. 2015. The Impact of the Dark Web on Internet Governance and Cyber Security. GCIG Paper Series 6 (2015).
[13] Ian Clarke, Oskar Sandberg, Matthew Toseland, and Vilhelm Verendel. 2010. Private Communication through a Network of Trusted Connections:
The Dark Freenet. Network (2010).
[14] David Goldschlag, Michael Reed, and Paul Syverson. 1999. Onion routing for anonymous and private internet connections. Technical Report. NAVAL
Research Lab Washington DC Center For High Assurance Computing Ssystems.
[15] Virgil Griffith, Yang Xu, and Carlo Ratti. 2017. Graph Theoretic Properties of the Darkweb. arXiv preprint arXiv:1704.07525 (2017).
[16] Per Hage and Frank Harary. 1995. Eccentricity and centrality in networks. Social networks 17, 1 (1995), 57–63.
[17] Vanessa Henri. 2017. The Dark Web: Some Thoughts for an Educated Debate. Canadian Journal of Law and Technology 15, 1 (2017).
[18] Ioana Hulpus, Conor Hayes, Marcel Karnstedt, and Derek Greene. 2013. Unsupervised Graph-based Topic Labelling using DBpedia. In Proc. of the
sixth ACM Int. Conf. on Web Search and Data Mining. 465–474.
[19] Guoyong Mao and Ning Zhang. 2013. Analysis of average shortest-path length of scale-free network. Journal of Applied Mathematics 2013 (2013).
[20] Damon McCoy, Kevin Bauer, Dirk Grunwald, Tadayoshi Kohno, and Douglas Sicker. 2008. Shining Light in Dark Places: Understanding the Tor
Network. In Privacy Enhancing Technologies. 63–76.
[21] Aziz Mohaisen and Kui Ren. 2017. Leakage of. onion at the DNS Root: Measurements, Causes, and Countermeasures. IEEE/ACM Transactions on
Networking 25, 5 (2017), 3059–3072.
[22] Mark EJ Newman and Michelle Girvan. 2004. Finding and evaluating community structure in networks. Physical review E 69, 2 (2004), 026113.
[23] Amirali Sanatinia and Guevara Noubir. 2017. Off-path man-in-the-middle attack on tor hidden services. New England Security Day (2017).
[24] Amirali Sanatinia, Jeman Park, Erik-Oliver Blass, Aziz Mohaisen, and Guevara Noubir. 2019. A Privacy-Preserving Longevity Study of Tor’s Hidden
Services. arXiv preprint arXiv:1909.03576 (2019).
[25] Iskander Sanchez-Rola, Davide Balzarotti, and Igor Santos. 2017. The Onions Have Eyes: A Comprehensive Structure and Privacy Analysis of Tor
Hidden Services. In Proc. of the 26th Int. Conf. on World Wide Web. 1251–1260.
[26] Paul Syverson, R Dingledine, and N Mathewson. 2004. Tor: The Second-generation Onion Router. In Usenix Security.
[27] Jennifer Xu and Hsinchun Chen. 2008. The topology of Dark Networks. Commun. ACM 51, 10 (2008), 58–65.
[28] Mahdieh Zabihimayvan and Derek Doran. 2018. Some (Non-) Universal Features of Web Robot Traffic. In Annual Conf. on Information Sciences and
Systems. 1–6.
[29] Mahdieh Zabihimayvan, Reza Sadeghi, Derek Doran, and Mehdi Allahyari. 2019. A Broad Evaluation of the Tor English Content Ecosystem. In Proc.
of the 10th ACM Conference on Web Science. 333–342.

A First Look at References From The Dark To Surface Web World

Uploaded by

Document Information

Original Title

Copyright

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

A First Look at References From The Dark To Surface Web World

Uploaded by

Copyright:

A First Look at References from the Dark to Surface Web World

MAHDIEH ZABIHIMAYVAN and DEREK DORAN, Wright State University

ACM Reference format:

Manuscript submitted to ACM 1

Manuscript submitted to ACM

Manuscript submitted to ACM

www.luusa.org jobportal.99gi.ga www.planet-traffic.com gcardscr6zwjya2s.onion

maine.indymedia.org lille.indymedia.org qollasuyu.indymedia.org

me-download.wickr.com nnm5gu6g2bs7nnmm.onion www.webring.org

streamtmr46ysxw6.onion sxzgqh7j6sgiy6he.onion ttnkd47gkavn64yz.onion tvlh66qo23ksfk4k.onion wolfmu4yjw3srihs.onion

Tab e 1 Bas c pa ame e s o he ne wo k

4 L NK NG PROCESS OF TOR SERV CES TO DARK/SURFACE RESOURCES

Table 2. Summary description of Tor domain types

No. Surface Web Neighbors

Manuscript submitted to ACM

Table 4. Summary statistics of network features

1 2 5 10 1 5 50 500 1e-05 1e-03 1e-01

Fig. 4. Frequency Distribution of Network Parameters

5 ANALYZING REFERENCE VIEW OF TOR SERVICES

5 Dir stands for ‘Directory’

Manuscript submitted to ACM

Table 6. 20-top Tor Services with high Stress centrality

Table 7. 20-top Tor Services without-degree centrality greater than 400

6 CONCLUSION AND FUTURE WORK

Manuscript submitted to ACM

You might also like