Dark Web, Tor, and Onion-Service Research
This page collects official technical resources, source-code repositories, peer-reviewed research, conference papers, and selected preprints concerning Tor, onion services, darknet communities, privacy, anonymity, and online illicit-market research.
Research note: A peer-reviewed paper can become outdated as Tor and related technologies evolve. Older security research should be read as historical analysis—not necessarily as a description of current vulnerabilities.
Labels Used on This Page
-
Open access: The complete paper is publicly available.
-
Publisher page: The abstract and citation are available, but the paper may require institutional access or payment.
-
Preprint: Public research that may not yet have completed peer review.
-
Working paper: Preliminary research that may later be revised or published elsewhere.
Official Tor Research Resources
-
Tor Project Research Portal — Tor research information, datasets, collaborations, and technical resources.
-
Tor Project Technical Reports — Technical reports published by Tor Project researchers.
-
Tor Research Safety Board — Guidance for conducting responsible research involving Tor users or the Tor network.
-
Tor Specifications — Technical specifications for Tor protocols and components.
-
Tor Project History — History and development of the Tor Project.
-
Tor Browser User Manual — Official instructions for installing and using Tor Browser.
-
Tor Metrics — Statistics and measurements concerning the Tor network.
-
Selected Papers in Anonymity — Large bibliography of anonymity and privacy research maintained by researchers associated with the Tor community.
Source Code
The Tor daemon and Tor Browser are related but separate projects. The old
gitlab.com/torproject/torlink was not the canonical Tor Browser repository.
-
Tor Core Source Code — Source code for the Tor network daemon.
-
Tor Browser Source Code — Source code used by Tor Browser.
-
Tor Browser Build System — Reproducible build system and packaging configuration.
-
Tails Source Code — Official Tails operating-system repository.
-
Whonix Source Code — Official Whonix GitHub organization and repositories.
Foundational Tor and Anonymity Research
-
Tor: The Second-Generation Onion Router — The foundational 2004 Tor design paper by Roger Dingledine, Nick Mathewson, and Paul Syverson. Open access.
-
De-anonymisation Attacks on Tor: A Survey — Survey of historical and contemporary approaches to attacking Tor anonymity. Preprint/open access.
-
The Effect of DNS on Tor’s Anonymity — Research commonly associated with the “DefecTor” attack, examining how DNS observations may contribute to traffic correlation. Open access.
-
Online Website Fingerprinting: Evaluating Website Fingerprinting Attacks on Tor in the Real World — Real-world evaluation of website-fingerprinting attacks against Tor. USENIX Security 2022; open access.
-
Walkie-Talkie: An Efficient Defense Against Passive Website Fingerprinting Attacks — Research into defenses against traffic-analysis and website-fingerprinting attacks. USENIX Security 2017; open access.
-
Walking Onions: Scaling Anonymity Networks While Protecting Users — A proposed architecture for improving the scalability of anonymity networks. USENIX Security 2020; open access.
-
The DUSTER Attack: Tor Onion Service Attribution Based on Flow Watermarking with Track Hiding — Research on onion-service attribution using traffic manipulation and watermarking. RAID 2019; open access PDF.
Onion-Service Measurement and Security
-
How Do Tor Users Interact with Onion Services? — Measurement study examining how users access and interact with onion services. USENIX Security 2018; open access.
-
On the State of V3 Onion Services — Study of the deployment and characteristics of version 3 onion services. ACM FOCI 2021.
-
How Unique Is Your .onion? An Analysis of the Fingerprintability of Tor Onion Services — Examines whether onion services can be distinguished through traffic characteristics. Open access.
-
Doppelgängers on the Dark Web: A Large-Scale Assessment of Phishing Hidden Web Services — Large-scale investigation of phishing and impersonation involving onion services. Publisher page.
-
Characterizing the Redundancy of DarkWeb .onion Services — Research into duplicated, mirrored, and redundant onion-service content. Publisher page.
-
Detection and Analysis of Tor Onion Services — Methods for identifying and analyzing onion services and their content. Publisher page.
-
Spiders Like Onions: On the Network of Tor Hidden Services — Network-level analysis of relationships among onion services. Publisher page.
-
Dizzy: Large-Scale Crawling and Analysis of Onion Services — Research on the ethical and technical challenges of collecting onion-service data. Publisher page.
-
Advertising, Availability, and Protocols of Onion Services — Study examining how onion services are advertised, reached, and maintained. Publisher page.
-
Protecting Onion-Service Users Against Phishing — Research proposing methods to reduce onion-service phishing risks. Preprint/open access.
-
Onions Got Puzzled: On the Challenges of Mitigating Denial-of-Service Problems in Tor Onion Services — Analysis of denial-of-service defenses for onion services. USENIX Security 2025; open access PDF.
Dark-Web Research Reviews and Frameworks
-
Evolution of Dark Web Threat Analysis and Detection: A Systematic Approach — Systematic review of dark-web threat analysis and detection methods. IEEE Access 2020.
-
A Review of Dark Web: Trends and Future Directions — Review covering dark-web technologies, research trends, challenges, and possible future directions. IEEE COMPSAC 2022; open access PDF.
-
A Synopsis of Critical Aspects for Darknet Research — Discussion of methodological, ethical, and technical issues affecting darknet research. ACM publisher page.
-
Darkweb Research: Past, Present, and Future Trends and Mapping to Sustainable Development Goals — Bibliometric review of dark-web research themes and publication trends. Open access.
-
A General and Modular Framework for Dark Web Analysis — Framework for collecting and analyzing dark-web information. Publisher page.
-
A Big Data Architecture for Early Identification and Categorization of Dark Web Sites — Architecture for collecting and categorizing dark-web content at scale. Preprint/open access.
-
Inside of Deep Web Anonymous Technology: A Short Review — Introductory review of anonymity technologies associated with the deep and dark web. Open access.
-
Recognition of Tor Malware and Onion Services — Research on distinguishing Tor-related malware behavior from legitimate onion-service activity. Open access.
-
Forensic Investigation of the Dark Web on the Tor Network — Review and discussion of forensic approaches involving Tor and dark-web investigations. Publisher page.
-
Secure in the Dark? An In-Depth Analysis of Dark-Web Markets and Their Security — Analysis of security practices and weaknesses observed across dark-web markets. Publisher page.
Social-Science and Community Research
-
The Not So Dark Side of the Darknet: A Qualitative Study — Qualitative examination of darknet communities, motivations, activities, and noncriminal uses. Security Journal; publisher page.
-
Tor and the Darknet: Exploring the World of Hidden Services — Catherine Flick and Runa Sandvik’s ETHICOMP conference paper examining hidden services and research ethics. Author-uploaded conference paper.
-
The Dark Web Privacy Dilemma: Linguistic Diversity, Talkativeness, and Vendor Success — Research into language, disclosure, communication patterns, and privacy within dark-web marketplaces. Open access.
-
Who Uses the Dark Web? Cross-National and Longitudinal Evidence — Research examining characteristics associated with dark-web use across countries and over time. Publisher page.
-
Constructive Activism in the Dark Web: Cryptomarkets and Illicit Drugs in the Digital “Demimonde” — Social-science analysis of harm-reduction practices and community behavior within cryptomarkets. Publisher page.
-
Foundations and Trends in Darknet-Related Criminals in the Last 10 Years — Systematic literature review and bibliometric analysis of darknet-related criminology research. This is the completed peer-reviewed version of the preliminary SSRN paper previously listed here. Open access.
Anonymous-Marketplace and Cybercrime Research
These papers are included to document and understand online-marketplace behavior. They are not instructions for participating in illegal transactions.
-
Measuring the Longitudinal Evolution of the Online Anonymous Marketplace Ecosystem — Major longitudinal study of anonymous online marketplaces by Kyle Soska and Nicolas Christin. USENIX Security 2015; open access.
-
Plug and Prey? Measuring the Commoditization of Cybercrime via Online Anonymous Markets — Analysis of products and services offered through anonymous cybercrime markets. USENIX Security 2018; open access PDF.
-
Network of Online Stolen-Data Markets: How Vendor Flows Connect Digital Marketplaces — Examines vendor movement and connections among stolen-data marketplaces. British Journal of Criminology.
-
The Moral Embeddedness of Cryptomarkets: Text Mining Feedback, Dispute Resolution, and Context — Social-science analysis of trust and dispute resolution in cryptomarkets. Socio-Economic Review.
-
Macroscopic Properties of Buyer–Seller Networks in Online Marketplaces — Network analysis of buyer and seller relationships in online markets. PNAS Nexus; open access.
-
Does Online Anonymous-Market Vendor Reputation Matter? — Empirical analysis of reputation and purchasing behavior in anonymous markets. USENIX Security 2024; open access PDF.
-
On the Accuracy of Online Marketplace Measurements — Examines sources of error and bias when researchers measure online marketplaces. USENIX Security 2022; open access PDF.
Research Ethics and Responsible Study
Researchers should avoid actions that could expose users, disrupt the Tor network, collect unnecessary sensitive information, or create additional risk for vulnerable communities.
Before conducting Tor-related research, consult:
-
The applicable institutional-review, data-protection, and research-ethics requirements in your jurisdiction.
Do not assume that information reachable through Tor is ethically unrestricted simply because it is technically accessible. Minimize collection, avoid publishing operational onion addresses unnecessarily, protect research datasets, and consider the possible consequences for affected users.
Last reviewed: August 2026
For educational, historical, and research purposes only.