Tor, Onion Services & Darknet Forum Monitoring

Abstract

The Tor network provides a distributed communications system designed to reduce the ability of a single network observer to associate a user's origin with their destination. One of its applications is the hosting and discovery of onion services: websites and other services that are reachable through Tor rather than through the conventional public internet.

Onion services are frequently associated with darknet forums, illicit marketplaces, leak sites, and other underground communities. However, the technology itself is not inherently criminal. The same infrastructure supports legitimate privacy, journalism, whistleblowing, censorship resistance, and secure communication.

This research note examines the relationship between Tor and onion services, the structure of modern 56-character version 3 onion addresses, the use and limitations of Tails OS, and investigative approaches to monitoring publicly observable activity on underground forums and marketplaces.

Keywords: Tor, onion services, darknet, dark web, v3 onion address, Tails OS, threat intelligence, forum monitoring, cybercrime, digital forensics, OSINT, attribution, evidence preservation

1. Introduction

The terms deep web, dark web, and darknet are often used interchangeably in general discussion. They describe different concepts, however, and should not be treated as equivalent. The deep web generally refers to content that is not indexed by conventional search engines, such as private account portals, subscription databases, and internal systems. The dark web generally refers to services hosted on networks that require specialized software or configurations to access.

Tor is one of the best-known anonymity networks used to access these services. It can also be used to access ordinary websites through a privacy-preserving connection. A website does not become a darknet service merely because a visitor uses Tor to reach it.

Within threat intelligence, Tor is relevant because some underground communities use onion services to publish stolen data claims, advertise access to compromised systems, coordinate activity, communicate with other users, and operate marketplaces.

2. Research Questions

This research note addresses the following questions:

1. How does Tor route traffic, and how does that architecture differ from an ordinary connection to a public website?

2. What is an onion service, and how does a version 3 onion address identify a service?

3. Why are modern onion addresses 56 characters long, and what information is represented within the address?

4. What role does Tails OS play when conducting research involving Tor-accessible services?

5. What information can analysts collect by monitoring underground forums, marketplaces, and threat-actor channels?

6. How should analysts preserve, corroborate, and qualify observations obtained from these environments?

3. Understanding the Tor Network

Tor, originally derived from the concept of onion routing, is a distributed network that directs user connections through a sequence of volunteer-operated relays. Rather than connecting directly to a destination using the user's ordinary network address, a Tor client constructs a circuit through multiple relays.

In a typical Tor Browser connection to a conventional website, the circuit uses three relays. The first relay is commonly referred to as the guard or entry relay. The middle relay passes traffic through the circuit, and the final relay is the exit relay.

The entry relay can observe the network address connecting to it, but it does not ordinarily know the final destination. The exit relay connects to the destination website, but it does not ordinarily know the original user's network address.

This layered routing is intended to prevent any single relay from independently identifying both ends of a connection. It does not make a user's activity immune to endpoint compromise, traffic correlation, or operational mistakes.

4. Onion Services and the .onion Domain

An onion service is a website or other network service that is accessible through the Tor network. The service uses the special top-level domain .onion rather than a conventional domain such as .com, .net, or .org.

Onion services are sometimes described as hidden services. The terminology refers to the way the service's network location is concealed through Tor's architecture. The service does not need to publish a conventional public IP address for visitors to connect to it.

An onion service establishes Tor circuits to a set of introduction points and publishes an encrypted service descriptor through the Tor network. A client that knows the onion address can retrieve the relevant descriptor, verify service information, and establish a connection through a rendezvous point.

The rendezvous point acts as an intermediary within the Tor network. The client and onion service each establish their own Tor circuits to that point.

5. Understanding the 56-Character .onion Address

Modern Tor onion services use version 3 addresses, commonly referred to as v3 onion addresses. These addresses contain 56 lowercase letters and numbers before the .onion suffix. The 56-character portion is the address itself; the .onion suffix is not included in that count.

The length is not an arbitrary naming convention. A v3 onion address is a Base32 representation of cryptographic information associated with the onion service. It incorporates the service's Ed25519 public identity key, a checksum, and a version field.

The public key provides the cryptographic identity associated with the service. The checksum allows the address to be checked for certain errors, and the version field identifies the address format.

This design differs from the older version 2 format, which used shorter 16-character onion addresses. Version 2 onion services have been deprecated and are no longer supported by current Tor software.

The address should be recorded exactly as observed. A single incorrect character can prevent a connection or direct an analyst to a different address. When collecting an address from a forum post, directory, screenshot, or intelligence report, analysts should preserve the original source and independently verify the address before treating it as an active service.

6. How Darknet Sites and Forums Operate

Darknet websites can provide many of the same functions as conventional websites. They may contain user accounts, discussion boards, private messages, search functions, administrator announcements, vendor profiles, product listings, reviews, and other familiar web application components.

Some underground forums operate as discussion communities. Users may create threads, reply to posts, maintain profiles, publish announcements, and exchange information. Other sites operate as marketplaces, where listings, vendor accounts, payment mechanisms, escrow arrangements, and dispute systems are presented through a web interface.

The presence of these features does not establish that a marketplace transaction occurred or that a vendor fulfilled an advertised service. Forum content is user-generated and should be treated as a claim until corroborated.

Common forum components

Threads and posts: Provide the primary discussion structure, including initial claims, replies, updates, and administrator intervention.

User profiles and handles: Identify accounts within the platform. A handle is a platform identifier, not proof of a real-world identity.

Announcements and pinned posts: May contain forum rules, operational updates, vendor notices, and administrator statements.

Marketplace listings: May advertise databases, credentials, access to compromised systems, malware, or other goods and services.

Reputation and dispute systems: May include reviews, ratings, escrow references, complaints, and claims of successful transactions.

7. Tails OS and Privacy-Focused Research

Tails, short for The Amnesic Incognito Live System, is a Linux-based operating system designed to help protect user privacy and anonymity. It is commonly started from a USB drive and is designed to leave as little trace as possible on the computer being used.

Tails routes internet connections through the Tor network. Its network restrictions are designed to prevent applications from making ordinary internet connections outside Tor.

Tails includes Tor Browser for web access and other privacy and security tools. It can be useful for researchers who need to access Tor services while keeping investigative activity separated from their everyday operating environment.

Tails is not the same thing as Tor Browser. Tor Browser is an application that routes browser traffic through Tor. Tails is an operating system that applies Tor-oriented network protections across the system.

Tails also supports optional Persistent Storage. When configured, selected data can be retained between sessions in an encrypted storage area. This means that the amnesic behavior of a session depends in part on how the system is configured and used.

8. Security Limitations and Operational Considerations

Tor and Tails provide privacy protections, but neither should be treated as a complete anonymity guarantee. A user can still disclose identifying information through account activity, browser behavior, downloaded documents, communication patterns, or other actions.

A person who signs into a personally identifiable account while conducting supposedly anonymous research may associate that activity with their identity. Similarly, using the same account handle across multiple platforms can create a link between otherwise separate online identities.

Downloaded documents can contain metadata or active content. Opening an untrusted file in an ordinary desktop environment may introduce risks that are unrelated to Tor's network protections.

Tor also has limitations against powerful observers capable of monitoring traffic at multiple points in a circuit. Timing and traffic-pattern correlation are recognized research concerns.

9. Monitoring Underground Forums and Marketplaces

Monitoring underground forums is a form of threat intelligence collection that focuses on identifying, documenting, and evaluating information published by users within online communities. The objective is not simply to visit a forum. It is to identify relevant activity, determine whether it relates to an organization or threat actor, and establish whether the information can be corroborated.

Monitoring may involve publicly accessible forum threads, marketplace listings, actor announcements, breach claims, data-leak posts, credential advertisements, and discussions about specific organizations or sectors.

An analyst may monitor a defined set of forums over time, recording new posts and changes to existing content. Relevant observations can include the account handle, post title, publication time, claimed victim, alleged incident date, type of material advertised, and any supporting sample or reference supplied by the poster.

Monitoring should also account for changes in forum structure. Sites may change domains, move to new onion addresses, restrict access, remove posts, or reappear under different branding.

Common monitoring categories

Forum activity: New threads, replies, pinned posts, administrator notices, complaints, user disputes, and changes to forum rules.

Threat-actor activity: Changes in aliases, public statements, claimed affiliations, advertised capabilities, and references to prior campaigns.

Victim and breach claims: Organization names, claimed compromise dates, alleged data types, sample descriptions, and statements about publication or sale.

Marketplace activity: Listings, vendor accounts, product descriptions, pricing claims, reviews, escrow references, and disputes.

Infrastructure changes: New onion addresses, mirror announcements, service outages, redirects, and references to replacement platforms.

10. Collection and Evidence Preservation

Online content can change quickly. Forum posts may be edited, deleted, moved, or made inaccessible. A monitoring process should therefore preserve relevant observations at the time they are identified.

A useful collection record should identify the source, the exact onion address or conventional URL, the date and time observed, the time zone used, and the specific content reviewed. Where available, the record should include the thread title, post identifier, account handle, publication timestamp, and any visible edit or update information.

Screenshots can help preserve the appearance and context of a page, but they should not be the only record when additional source information can be collected.

When permitted and appropriate, analysts may retain a contemporaneous capture of the page or relevant source data. Files should be handled according to organizational procedures, and cryptographic hashes can be used to document the integrity of collected files after acquisition.

The collection record should distinguish between the time a post claims an event occurred and the time the analyst observed the post. These are separate temporal values.

11. Correlation, Reposts, and Attribution

A single forum post rarely provides enough information to establish the identity of a threat actor or the validity of a breach claim. Stronger analysis comes from comparing observations across multiple sources and time periods.

An organization may be named in a forum thread, a marketplace listing, a separate leak site, and a public threat-actor announcement. These references may describe the same alleged incident, but they may also be copies of one original claim.

Analysts should determine whether sources are independent or whether they repeat information from the same post. Repetition across multiple websites does not necessarily constitute independent corroboration.

Account attribution requires similar caution. Usernames, profile descriptions, writing style, language, posting schedules, and shared links may provide investigative indicators. They do not independently establish that two accounts belong to the same person.

12. Indicators and Analytical Value

Underground forum monitoring can produce indicators that support broader cyber threat intelligence and digital investigations. These indicators may include organization names, domains, email addresses, IP addresses, usernames, cryptocurrency addresses, file names, malware references, and descriptions of alleged access.

The value of an indicator depends on its context. A domain mentioned in a forum post may be a victim domain, a reference to a third-party service, a phishing domain, or simply text copied from another source.

Indicators should therefore be normalized, deduplicated, time-stamped, and evaluated in relation to the source from which they were obtained. Where possible, they should be compared with independent technical evidence, public disclosures, organizational records, or other reliable sources.

13. Limitations

Darknet sources are inherently difficult to evaluate. Forums may be operated by anonymous administrators, accounts may be disposable, and content may be deliberately fabricated to attract attention, damage reputations, or create leverage.

A posted sample may be incomplete, outdated, publicly available, or unrelated to the organization named in the post. A seller may advertise the same material repeatedly or claim exclusive access to information that has already circulated elsewhere.

Access to a forum may also be intermittent. Onion services can become unavailable, change addresses, restrict access, or disappear without notice. A failed connection does not establish that a service has permanently shut down.

Monitoring coverage is limited by the sources known to the analyst, the time period examined, access restrictions, language, search functionality, and the availability of archived content.

14. Findings and Clearnet Resource Directories

This publication does not directly disclose or reproduce .onion addresses. Onion service links can change, become inactive, or lead to unsafe or impersonated resources. Rather than publishing unverified links, RemnantTrace identifies publicly accessible clearnet resources that provide directories, reporting, research, and access information for individuals conducting darknet research.

Examples of these resources include:

The Hidden Wiki: A directory-style resource that has historically catalogued onion services.

Ransomware.live: Ransomware activity tracking, including victim listings and threat actor information.

RansomLook: A monitoring resource for ransomware leak sites and related activity.

Daunt Link: A clearnet resource associated with darknet link directories.

The Tor Times: News and reporting related to Tor and darknet activity.

Ahmia: A search engine for Tor onion services.

The DarkWeb Informer: A resource covering darknet websites, activity, and related developments.

These resources are provided for research and informational purposes. Their inclusion does not constitute an endorsement of the services or websites they reference. Researchers should independently verify destinations, exercise caution when accessing unfamiliar services, and understand that the availability and legitimacy of listed resources may change over time.

Research note: These are clearnet starting points, not a guarantee that every directory or listing is safe, active, or legitimate.

15. Recommended Analytical Methodology

A structured monitoring process should begin by defining the investigative scope. The analyst should identify the organizations, domains, aliases, sectors, and incident indicators relevant to the research question.

The analyst should then identify known sources and document how each source can be accessed. Onion addresses should be recorded exactly and verified where possible. Source descriptions should distinguish between a forum, marketplace, leak site, directory, mirror, and other service type.

During collection, relevant posts and listings should be documented with their source location, observation time, visible publication time, account identifiers, and surrounding context. The analyst should preserve changes and reposts rather than treating a later version as though it were the original observation.

Collected claims should then be evaluated for credibility. Analysts should consider the source's history, the specificity of the claim, whether supporting material is present, whether the material can be independently validated, and whether other sources are merely repeating the same information.

16. Conclusion

Tor provides a distributed network architecture that allows users and services to communicate without relying on a direct connection between the user's ordinary network address and the destination. Onion services extend this architecture by allowing websites and other services to operate within Tor without publishing a conventional public IP address.

Modern v3 onion addresses contain 56 characters before the .onion suffix. These characters encode the service's public identity key, checksum, and version information.

Tails provides a separate operating environment designed around privacy and Tor-based network access. It can help reduce certain risks associated with local traces and accidental direct connections, but it does not eliminate endpoint, account, behavioral, or traffic-analysis risks.

For threat-intelligence and digital-forensics work, the practical value of these technologies extends beyond access. Monitoring forums, marketplaces, and threat-actor channels can reveal claims, advertisements, aliases, infrastructure references, and changes in underground activity.

The central analytical principle is that visibility is not verification. A post establishes that a statement was published; a listing establishes that an offer was advertised; and repeated claims establish that information circulated. None of these observations independently proves the truth of the underlying allegation.

Reliable darknet research therefore depends on source provenance, careful preservation, cross-source analysis, independent corroboration, and appropriately qualified conclusions.

References