Abstract

The Tor network is known for its opaque characteristics and involvement in illicit activities, motivating to shed light on the exposure, lifetime, and functionalities of onion services. This study focuses on the appearance of Tor links in online advertising and monitors the connectivity status and protocols of the collected onion domains through the Tor network over 105 days. Out of 54,602 onion addresses gathered, it was found that 38% of Tor links were advertised only once, 43% between two and five times, and 19% more than five times. Furthermore, 50% of the addresses were exclusively advertised on the surface web, 6% on the dark web, and 44% on both portions. The temporal analysis revealed that 67% of the addresses were predominantly active, 7% were intermittent, and 26% were mostly inactive. The study examined fifteen protocols used by onion services, concluding that 94% employed a single protocol, while 6% utilized between two and eight protocols. Among active sites, HTTP was present in 99.75% of cases, followed by SSH (4.95%) and HTTPS (0.64%). Additionally, onion services without web services often deploy cryptocurrency or instant messaging servers. This study offers a comprehensive and current understanding of the dark web, surpassing previous research in its scope.

中文翻译：

---

Tor 网络的最新探索：洋葱服务的广告、可用性和协议

摘要

Tor 网络以其不透明的特征和参与非法活动而闻名，有助于揭示洋葱服务的暴露、生命周期和功能。本研究重点关注在线广告中 Tor 链接的出现，并在 105 天内通过 Tor 网络监控收集的洋葱域的连接状态和协议。在收集的 54,602 个洋葱地址中，我们发现 38% 的 Tor 链接仅发布一次，43% 在 2 到 5 次之间，19% 超过 5 次。此外，50% 的地址专门在表面网络上进行广告，6% 在暗网上进行广告，44% 在这两个部分上进行广告。时间分析显示，67% 的地址主要处于活动状态，7% 是间歇性的，26% 的地址大部分处于不活动状态。该研究检查了洋葱服务使用的 15 种协议，得出的结论是，94% 采用单一协议，而 6% 使用两种到八种协议。在活跃站点中，99.75% 的情况下存在 HTTP，其次是 SSH (4.95%) 和 HTTPS (0.64%)。此外，没有网络服务的洋葱服务通常会部署加密货币或即时消息服务器。这项研究提供了对暗网的全面且最新的了解，其范围超越了之前的研究。