Content and popularity analysis of Tor hidden services

Tor hidden services allow running Internet services
while protecting the location of the servers. Their main purpose
is to enable freedom of speech even in situations in which
powerful adversaries try to suppress it. However, providing
location privacy and client anonymity also makes Tor hidden
services an attractive platform for every kind of imaginable shady
service. The ease with which Tor hidden services can be set up
has spurred a huge growth of anonymously provided Internet
services of both types. In this paper we analyse the landscape
of Tor hidden services. We have studied 39824 hidden service
descriptors collected on 4th of Feb 2013: we scanned them for
open ports; in the case of 3050 HTTP services, we analysed
and classified their content. We also estimated the popularity of
hidden services by looking at the request rate for hidden service
descriptors by clients. We found that while the content of Tor
hidden services is rather varied, the most popular hidden services
are related to botnets.We also propose a method for opportunistic
deanonymisation of Tor Hidden Service clients. In addtiton, we
identify past attempts to track “Silkroad” by consensus history
analysis.