Content and popularity analysis of Tor hidden services
This study provides insights into the content and popularity of Tor hidden services, which is important for cybersecurity researchers and policymakers concerned with anonymous online activities.
The paper analyzed the landscape of Tor hidden services by collecting 39,824 descriptors in 2013, scanning for open ports and classifying HTTP content, finding that while content is varied, the most popular services are related to botnets.
Tor hidden services allow running Internet services while protecting the location of the servers. Their main purpose is to enable freedom of speech even in situations in which powerful adversaries try to suppress it. However, providing location privacy and client anonymity also makes Tor hidden services an attractive platform for every kind of imaginable shady service. The ease with which Tor hidden services can be set up has spurred a huge growth of anonymously provided Internet services of both types. In this paper we analyse the landscape of Tor hidden services. We have studied Tor hidden services after collecting 39824 hidden service descriptors on 4th of Feb 2013 by exploiting protocol and implementation flaws in Tor: we scanned them for open ports; in the case of HTTP services, we analysed and classified their content. We also estimated the popularity of hidden services by looking at the request rate for hidden service descriptors by clients. We found that while the content of Tor hidden services is rather varied, the most popular hidden services are related to botnets.