Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Measuring onion website discovery and Tor users' interests with honeypots

Arttu Paju, Waris Abdullah, Juha Nurmi

TL;DR

This work deployed honey-pot onion websites and seeded neutral-looking links via three channels to observe discovery and subsequent interaction events (CAPTCHA solves; registration/login attempts), and found that, almost without exception, human users originate from Ahmia.fi.

Abstract

Tor enables anonymous web browsing and access to anonymous onion websites. Prior work has focused on crawling and content analysis rather than on what users actually try to access. Our honeypot approach measures engagement across onion-site categories, revealing behavioral interest rather than inferred popularity. In March--April 2025, we deployed honeypot onion websites and seeded neutral-looking links via three channels -- the Ahmia Tor search engine, Stronghold paste onion "paste" service, and pastebin.com -- to observe discovery and subsequent interaction events (CAPTCHA solves; registration/login attempts). We observe that, almost without exception, human users originate from Ahmia.fi; after removing the honeypot links from the Ahmia.fi search results, visits dropped to nearly zero and no users solved CAPTCHAs. The honeypot landing front pages represent different forums for cybercrime activities -- child sexual abuse, violence, malware, stolen goods, illegal firearms, illegal drugs, and forgery items -- and, as a baseline comparison, an unclear forum. Within that set, the CSAM-themed honeypot drew markedly higher engagement than the other honeypots. When identical sites were offered in multiple languages, interaction events occurred most often on the English-language versions.

Measuring onion website discovery and Tor users' interests with honeypots

TL;DR

This work deployed honey-pot onion websites and seeded neutral-looking links via three channels to observe discovery and subsequent interaction events (CAPTCHA solves; registration/login attempts), and found that, almost without exception, human users originate from Ahmia.fi.

Abstract

Tor enables anonymous web browsing and access to anonymous onion websites. Prior work has focused on crawling and content analysis rather than on what users actually try to access. Our honeypot approach measures engagement across onion-site categories, revealing behavioral interest rather than inferred popularity. In March--April 2025, we deployed honeypot onion websites and seeded neutral-looking links via three channels -- the Ahmia Tor search engine, Stronghold paste onion "paste" service, and pastebin.com -- to observe discovery and subsequent interaction events (CAPTCHA solves; registration/login attempts). We observe that, almost without exception, human users originate from Ahmia.fi; after removing the honeypot links from the Ahmia.fi search results, visits dropped to nearly zero and no users solved CAPTCHAs. The honeypot landing front pages represent different forums for cybercrime activities -- child sexual abuse, violence, malware, stolen goods, illegal firearms, illegal drugs, and forgery items -- and, as a baseline comparison, an unclear forum. Within that set, the CSAM-themed honeypot drew markedly higher engagement than the other honeypots. When identical sites were offered in multiple languages, interaction events occurred most often on the English-language versions.
Paper Structure (12 sections, 15 figures, 2 tables)

This paper contains 12 sections, 15 figures, 2 tables.

Table of Contents

  1. Introduction
  2. Related work
  3. Ethics
  4. Methods
  5. Results
  6. RQ1: Paste websites vs. Tor search engine: how do users find our honeypot onion websites?
  7. RQ2: What are the most captivating onion websites based on honeypot interaction data?
  8. RQ3: What languages do users prefer on our onion honeypot websites?
  9. Limitations
  10. Conclusion
  11. Authorship contributions
  12. Honeypot website screenshots

Figures (15)

  • Figure 1: honeypot (English version). All honeypot websites contained only text-based hints for users, along with free-to-use legal images, and did not contain any illegal content.
  • Figure 2: Visits to our honeypot websites from all three distribution sources.
  • Figure 3: Resolved CAPTCHAs and log in attempts from all three sources.
  • Figure 4: Visits, solved CAPTCHAs, and registration/log in attempts originating from Ahmia's results.
  • Figure 5: All honeypot websites---as expected---received roughly equal amount of visits and resolved CAPTCHAs.
  • ...and 10 more figures