A Comprehensive and Long-term Evaluation of Tor V3 Onion Services

The version 3 (V3) Tor onion service protocol deeply hides onion service domain names to improve anonymity. Existing onion service analysis methods cannot be used any more to understand V3 onion services and the ecosystem such as benign services, abuses and black markets. To understand the scale of V3 onion services, we theoretically analyze the V3 onion service mechanism and propose an accurate onion service size estimation method, which is able to achieve an estimation deviation of 2.43% on a large-scale emulated Tor network. To understand onion website popularity, we build a system and collect more than two years of data of public onion websites. We develop an onion service popularity estimation algorithm using online rate and access rate to rank the onion services. To reduce the noise from the phishing websites, we cluster onion websites into groups based on the content and structure. To our surprise, we only find 487 core websites out of the collected 45,889 public onion websites.

We further analyze the weighted popularity of each group using yellow page data and discover that 35,331 phishing onion websites spoof the 487 core websites.