Measuring onion website discovery and Tor users' interests with honeypots

This paper presents a honeypot-based study conducted in early 2025 that reveals human Tor users primarily discover onion sites via the Ahmia search engine and exhibit significantly higher engagement with child sexual abuse material (CSAM) compared to other illicit categories, with English-language versions attracting the most interaction.

The Gist

Imagine the dark web (specifically the Tor network) as a massive, foggy city where everyone wears a mask, and the streets are lined with millions of hidden doors. Most people think they know what's behind those doors because they've read reports about the "shops" selling illegal drugs or weapons. But this study asks a different question: What are the actual people walking around this city trying to open?

To find out, the researchers didn't just look at the doors; they built traps (called "honeypots") that looked exactly like the things people were rumored to want.

Here is the story of their experiment, broken down simply:

1. The Setup: Building Fake "Trap Doors"

The researchers built 32 fake websites. They looked like real forums for all sorts of illegal activities:

• Child abuse material (CSAM)
• Violence
• Malware (computer viruses)
• Stolen goods
• Illegal guns
• Illegal drugs
• Counterfeit items
• A "mystery" forum (the control group)

They made these sites in four languages: English, German, Finnish, and Russian.

The Bouncer: To make sure they were talking to real humans and not just computer robots, they put a CAPTCHA (those "click all the traffic lights" puzzles) in front of the door. If you couldn't solve the puzzle, you couldn't get in.

2. The Bait: How Did People Find the Traps?

The researchers needed to see how people found these hidden doors. They used three different "signposts" to lead people to their traps:

1. Ahmia: A search engine for the dark web (like Google, but for the hidden city).
2. Paste sites: Websites where people paste links (like a digital bulletin board).

They dropped links to their traps in these three places and waited to see who walked in.

3. The Big Surprise: The Search Engine vs. The Bulletin Board

The Result: It was a landslide.

• Ahmia (The Search Engine): Almost every single real human came from here. When the researchers removed the links from the search engine, the traffic from real humans dropped to almost zero.
• Paste Sites: These sites were flooded with traffic, but it was almost entirely robots and automated bots. When the researchers looked at who actually solved the CAPTCHA and tried to log in, the paste sites had zero real human activity.

The Analogy: Imagine you put up a flyer for a secret party.

• Ahmia is like a person walking down the street reading the flyer and actually showing up.
• Paste sites are like a wind machine blowing thousands of copies of the flyer around. It looks busy, but no one is actually there; it's just paper flying in the wind.

4. The "What They Wanted" Shock

Once the humans got past the CAPTCHA, they saw the "menu" of fake illegal activities. The researchers counted how many people tried to create an account or log in for each topic.

The Ranking of Interest:

1. 🥇 Child Sexual Abuse Material (CSAM): This was the most popular category by a huge margin. More than double the interest of the next category.
2. 🥈 Violence: The second most popular.
3. 🥉 Malware & Stolen Goods: Moderate interest.
4. 📉 Illegal Drugs: Surprisingly, this was very low on the list.

Why is this weird?
Most news stories and studies focus on the dark web as a giant "drug market." But this study suggests that for the average person stumbling onto the dark web via a search engine, drugs aren't the main attraction. They are more interested in the disturbing, violent, or abusive content.

Note: The researchers suspect that people looking for drugs already know exactly which "shops" to go to and don't need to search for them. But people looking for the other, more disturbing content might be using search engines to find it.

5. The Language Barrier

When the researchers offered the same traps in different languages, English was the clear winner.

• English: The most popular.
• German & Finnish: Second and third.
• Russian: Surprisingly, the least popular, even though Russian is a huge language on the dark web.

The "Finnish" Twist: The study was done by researchers in Finland, and the search engine (Ahmia) is Finnish. This likely explains why Finnish was so popular—it's the "home turf" of the search engine.

The Takeaway

This study is like a mood ring for the dark web. Instead of guessing what people want based on what's available, they measured what people actually tried to access.

• Main Finding: Real humans mostly find the dark web through search engines, not by pasting links.
• Biggest Shock: The content that draws the most human curiosity isn't drugs or weapons; it's the most disturbing, abusive material.
• Language: English speakers are the most active group in this specific "search engine" crowd.

The researchers emphasize that this only shows the behavior of people using a specific, filtered search engine. It doesn't represent everyone on the dark web, but it gives us a very clear picture of what happens when a regular person types a query and clicks a link.

Technical Summary

Here is a detailed technical summary of the paper "Measuring onion website discovery and Tor users' interests with honeypots."

1. Problem Statement

Prior research on the Tor network (the "dark web") has predominantly focused on content analysis and crawling to map the existence and popularity of onion sites. However, these methods suffer from significant limitations:

• Inference vs. Behavior: Crawlers infer popularity based on link structures or content availability, which does not necessarily reflect actual human user interest or intent.
• Automation Noise: Existing metrics often fail to distinguish between automated crawlers/bots and genuine human users.
• Discovery Gaps: There is a lack of quantitative data regarding how users discover specific types of onion sites (e.g., via search engines vs. paste services) and which categories they actively attempt to access.
• Historical Gap: Direct measurement of user login/registration attempts on onion sites has not been conducted since 2014, and even then, it did not distinguish between humans and bots.

The authors aim to fill this gap by measuring actual human engagement (attempts to create credentials or log in) across different cybercrime categories and discovery channels.

2. Methodology

The researchers employed a honeypot approach to observe user behavior without compromising anonymity or causing harm.

• Experimental Setup:

  • Honeypot Sites: 32 unique onion websites were created, representing 8 categories of illegal activity (CSAM, violence, malware, stolen goods, illegal firearms, illegal drugs, forgery, and an "unclear" baseline).
  • Languages: Each category was deployed in 4 languages (English, German, Finnish, Russian), resulting in 32 unique domains.
  • Structure: Each site had a neutral landing page with a CAPTCHA puzzle. Solving the CAPTCHA granted access to a second page containing descriptions of the specific cybercrime theme and functional-looking (but non-functional) registration/login fields.
  • Data Collection: The system logged visits, CAPTCHA solves, and credential creation attempts. No cookies or IP tracking were used to preserve user anonymity.

• Distribution Channels (Discovery Sources):
  The honeypot URLs were seeded via three distinct channels to test discovery mechanisms:

  1. Ahmia Tor Search Engine: Links were randomly inserted into search results with neutral descriptions ("onion log in page available").
  2. Stronghold Paste: An onion-based "paste" service.
  3. Pastebin.com: A clear-web paste service.

• Timeline:

  • Active Distribution: March 24 – April 10, 2025.
  • Observation Period: March 24 – April 17, 2025 (including one week after removing links from Ahmia).
  • Total Unique URLs: 96 (32 sites × 3 sources).

• Unit of Analysis: The study measures interaction events (CAPTCHA solves, login attempts) rather than unique individuals, acknowledging that Tor anonymity prevents reliable de-duplication of users.

3. Key Contributions

1. Discovery Channel Analysis: The first quantitative comparison of human engagement across Tor search engines versus paste services.
2. Theme-Level Interest: Empirical data on which specific categories of illegal content users actively attempt to access, moving beyond content availability to user intent.
3. Language Preference: Quantification of language preferences among Tor users attempting to access illicit content.
4. Bot vs. Human Differentiation: Demonstrated that while paste services generate traffic, it is almost entirely automated, whereas search engines drive genuine human interaction.

4. Key Results

A. Discovery Channels (RQ1)

• Traffic Volume: Ahmia generated the vast majority of traffic (87.65%), followed by Pastebin (6.42%) and Stronghold (5.93%).
• Human Engagement:
  • Ahmia: Accounted for 100% of meaningful human engagement. Out of 17,054 solved CAPTCHAs and 6,648 login attempts, all but two originated from Ahmia.
  • Paste Services: Despite generating visits, these sources yielded zero login attempts and only two CAPTCHA solves.
  • Conclusion: Paste services are primarily used by bots/crawlers. Real human users rely heavily on the Ahmia search engine for discovery.
• Post-Removal Test: When links were removed from Ahmia, visits dropped to near zero, and no further login attempts occurred, confirming Ahmia as the primary discovery vector for humans.

B. Content Interests (RQ2)

• Most Engaging Category: CSAM (Child Sexual Abuse Material) was the most captivating, accounting for 37.67% of all login attempts.
• Second Most Engaging: Violence (20.47%).
• Lowest Engagement: Surprisingly, Illegal Drugs (3.43%) and Forgery (3.38%) had the lowest engagement rates.
• Engagement Rate: The CSAM category showed an unusually high conversion rate (115.55%), indicating that users who solved the CAPTCHA often attempted multiple registrations.
• Insight: The high CSAM engagement occurred despite Ahmia's filtering mechanisms, suggesting that search-engine users may be less experienced or arrive via "neutral" entry points they do not fully vet. Conversely, the low drug engagement suggests that serious buyers likely use established, private marketplaces rather than public search engines.

C. Language Preferences (RQ3)

• Dominant Language: English was the clear preference, accounting for 43.49% of all login attempts.
• Secondary Languages: German (22.47%) and Finnish (18.07%).
• Least Popular: Russian (15.97%), despite its prevalence in general Tor discourse.
• Conversion Rates: English had the highest conversion rate (67.40% of CAPTCHA solvers attempted login), followed by German (35.79%), Finnish (27.51%), and Russian (25.13%).
• Note on Finnish: The high engagement with Finnish is likely due to Ahmia being a Finnish search engine, creating a local bias rather than a global dark web trend.

5. Significance and Implications

• Behavioral Insight: This study shifts the focus from "what exists on the dark web" to "what users actually try to access," revealing that abusive content (CSAM/Violence) drives significantly more active user engagement than commercial illicit goods (drugs) in a search-engine context.
• Search Engine Vulnerability: The findings highlight that public search engines like Ahmia are the primary vector for human discovery of illicit content, even for highly sensitive categories like CSAM, despite filtering efforts.
• Bot Traffic: The study confirms that "paste" services on the dark web are largely populated by automated traffic, not human users, which is crucial for threat modeling and resource allocation.
• Policy & Research: The results suggest that counter-measures targeting search engine indexing may be more effective for disrupting access to CSAM than targeting paste services. Furthermore, the low engagement with drug markets via search engines implies that law enforcement strategies focusing on public search queries may miss the core user base of drug markets.

6. Limitations

• Sampling Bias: The study relies on Ahmia users, who represent a specific subset of Tor users (likely less technical or new).
• Filtering Effects: Ahmia filters CSAM queries; the high engagement observed suggests users are finding these sites via neutral descriptions, but this may not reflect the behavior of users on unfiltered or private channels.
• Honeypot Realism: The minimalist design of the honeypots may not perfectly replicate the complexity of real illicit forums, potentially altering engagement rates.
• Language Scope: The study excluded French and Italian, which are common on Tor, limiting the generalizability of the language findings.