[tor-talk] Content and popularity analysis of Tor hidden services

Eugen Leitl eugen at leitl.org
Thu Sep 5 10:05:49 UTC 2013


Content and popularity analysis of Tor hidden services

July 29, 2013

Alex Biryukov

University of Luxembourg alex.biryukov at uni.lu

Ivan Pustogarov University of Luxembourg ivan.pustogarov at uni.lu

Ralf-Philipp Weinmann University of Luxembourg ralf-philipp.weinmann at uni.lu


Tor hidden services allow running Internet services while protecting the
location of the servers. Their main purpose is to enable freedom of speech
even in situations in which powerful adversaries try to suppress it. However,
providing location privacy and client anonymity also makes Tor hidden
services an attractive platform for every kind of imaginable shady service.
The ease with which Tor hidden services can be set up has spurred a huge
growth of anonymously provided Internet services of both types. In this paper
we analyse the landscape of Tor hidden services. We have studied Tor hidden
services after collecting 39824 hidden service descriptors on 4th of Feb 2013
by exploiting protocol and implementation aws in Tor: we scanned them for
open ports; in the case of HTTP services, we analysed and classified their
content. We also estimated the popularity of hidden services by looking at
the request rate for hidden service descriptors by clients. We found that
while the content of Tor hidden services is rather varied, the most popular
hidden services are related to botnets.


Tor, hidden services, port scanning, classification

More information about the tor-talk mailing list