2022 figures for the dark web

We published our first quantitative evaluation of the Tor network in 2021 (see https://www.aleph-networks.eu/le-dark-web-en-chiffres/). In early 2022, we revisited this study to show how the network has evolved. There has been a dramatic change to Onion sites, as v2 addresses are no longer supported.

1. The transition from v2 to v3 addresses

In January 2018, a new version of Tor allowed for the creation of more secure domain names. This new format, called a v3 address, can easily be identified since it contains 56 characters and still ends in .onion (as opposed to the 16-character v2 addresses).

In July 2020, Tor announced that it was ending technical support for v2 addresses, effective on 15 October 2021.

Warning about the upcoming end of v2 onion services

In the interim, Tor sent out reminders of this deadline. This meant that anyone who visited a v2 site via the Tor Browser systematically saw a warning message with information about the shift to v3.

Warning about the upcoming end of v2 onion services

Warning about the upcoming end of v2 onion services

In practice, v2 domains could still be consulted until version 11.0 of Tor Browser was released in November 2021. At that time, we had identified 110,000 active Tor domains, including 60,000 v2 addresses.

This meant that half of onion sites became inaccessible to regular network users

Detection of v3 sites from 2019 to 2022

Since the announcement, new domains have mainly been created with v3 addresses, though some people incomprehensibly continued to create v2 domains until November 2021.

Even more surprising, one late adopter was the website of a team of ransomware operators, who seemed to be more up to date on extortion methods than the Tor network’s latest news.

The transition from v2 to v3 has profoundly reshuffled the deck because many sites have not (yet) migrated to the new version and can be considered lost. Nevertheless, this transition hasn’t affected certain practices or trends.

 

2. Tor network figures in January 2022

There were 53,000 active Tor domains in January 2022, compared to 76,000 one year ago. There were 115,000 active sites, both v2 and v3, when the two formats were still valid. This includes some overlap between newly created v3 sites alongside old v2 addresses that were kept active.

The transition from v2 to v3 has not ended the practice of mass mirroring, far from it. Though v2 mirrors have

become inaccessible, even more mirrors have been created using v3. We will revisit the concept of mirrors in chapter #3, Mirrors on the Dark Web.

For example, the graph above shows a peak in new sites during the second week of May 2021. The 3,400 domains we identified during that week were mostly mirrors, with only 150 truly new domains, including 20 that were each replicated hundreds of times.

Last year, we noticed that the most duplicated sites primarily involved financial transactions (carding, bitcoin manipulation, etc.). We’ve noticed a similar trend this year, with the addition of three sites with more evocative names.

The 10 most replicated sites:

Site Name
Mirrors
QF Market – Fast Transfers 1560
GC King _-_ GiftCard Shop 1538
All BTC .:. Everything you needed 1523
Porn Hacker 1193
Red Room 1169
Rape and murder! 1126
LordPay – Easy Transfers 1063
Bankor – Cloned Credit Cards 907
SHOP CARD | CLONED CARDS | WESTERN UNION | PAYPAL 888
Paypal Account 857

 

Screenshots of the homepages of the 10 most replicated sites.

Screenshots of the homepages of the 10 most replicated sites.

If we ignore mirrors, there were just 6,300 active Tor sites in January 2022. This marks a dramatic reduction in the number of unique sites since there were more than 18,000 sites in January 2021. However, the volume will likely soon return to last year’s numbers.

3. The lifespan of websites

The transition from v2 to v3 has not had a major impact on the average site’s longevity. The oldest sites (v2) are no longer active, but since the volume of these old domains was already limited last year, variation has been negligible and average longevity is equal to that of January 21, that is nine months.

Breakdown of active Tor domains by lifespan

4. The Tor network and linguistic communities

In contrast to average longevity, the distribution among linguistic communities has changed significantly. While English remains the Tor network’s dominant language (82% of sites are in English), the ranking of other languages has changed. Sites in French are the most frequent this year, followed by Russian, German, and Spanish.

Breakdown of linguistic communities in the Tor network (other than English)

Sites that are not in English represent a tiny percentage of the total volume of active Tor domains. There are also many sites for which we cannot determine the language from their content (raw data from leaks, source code repositories, etc.).