Empirical analysis of Tor hidden services

Gareth Huw Owenson, Nicholas John Savage

Research output: Contribution to journalArticlepeer-review


Tor hidden services allow someone to host a website or other transmission control protocol (TCP) service whilst remaining anonymous to visitors. The collection of all Tor hidden services is often referred to as the ‘darknet’. In this study, the authors describe results from what they believe to be the largest study of Tor hidden services to date. By operating a large number of Tor servers for a period of 6 months, the authors were able to capture data from the Tor distributed hash table to collect the list of hidden services, classify their content and count the number of requests. Approximately 80,000 hidden services were observed in total of which around 45,000 are present at any one point in time. Abuse and Botnet C&C servers were the most frequently requested hidden services although there was a diverse range of services on offer.
Original languageEnglish
Pages (from-to)113-118
Number of pages6
JournalIET Information Security
Issue number3
Publication statusPublished - 1 May 2016


  • Tor
  • hidden services


Dive into the research topics of 'Empirical analysis of Tor hidden services'. Together they form a unique fingerprint.

Cite this