THUGS(red) DarkWeb/Monitor_
  1. Board
  2. About

An observatory, not an index

DarkWeb Monitor is a THUGS(red) project. It watches 3,455 Tor hidden services around the clock and publishes one thing about each of them: whether it answers. Nothing here is hosted, mirrored, cached or endorsed.

Tracked 3,455 approved and public
Reachable 577 on the most recent probe
Watching since 2023 first entry in the collection
Contributors 3 accounts that added an entry

What the monitor does

Every monitored address is probed on a rolling sweep. A probe is a plain HTTP request through a Tor SOCKS proxy: we ask for the front page, record the status line, the response headers and the page title, and take a screenshot with a headless browser when the request succeeded. That result is written back against the entry and, for the newer collector, appended to an immutable check history so the statistics can plot yesterday instead of only right now.

We do not crawl. We do not follow links into a service, we do not download content, we do not archive anything a service publishes, and we do not attempt to authenticate. A leak site's index page is fetched exactly the way any visitor's browser would fetch it, once per sweep.

How fresh the picture is

The recheck threshold is configured at one hour, but the crawler is currently running below its configured worker count, so a full pass over the collection takes about 1 hours rather than one. Every card shows when its service was last probed and when it was last confirmed alive, so you can see for yourself how old a given fact is. We would rather publish the lag than round it away.

The five states

The crawler records a dozen different outcomes. The interface collapses them to five, because five is the number of distinctions that change what you would do about it. Each has its own shape and its own written label — state is never communicated by colour alone.

Alive
The service answered the last probe with a usable response. Currently 577 services.
Blocked
It answered, with HTTP 403. Something in front of it is refusing us specifically - a Cloudflare or DDoS-Guard interstitial, an allow-list, a captcha wall. Currently 29 services.
Broken
It answered with some other error: a 404, a 500, a bad gateway. The hidden service descriptor resolves, the application behind it does not work. Currently 21 services.
Dead
Nothing answered: the connection timed out, was refused, or the descriptor would not resolve. On Tor this is as often an operator taking a break as it is a takedown. Currently 2,828 services.
Waiting
Queued and never probed, or deliberately re-queued so the crawler visits it next. Currently 0 services.

A screenshot that turned out to be a challenge page is flagged as one and shown as a blocked placeholder rather than passed off as a capture of the service. That distinction exists in the schema on purpose.

Where the entries come from

Signed-in accounts submit addresses, partner tooling posts them over the API, and our own scanners feed in what they see referenced. Everything arrives with approved = No and stays invisible until a human looks at it. There is no parameter, on the form or in the API, that can set that flag. Classification into one of the 14 populated categories is also a human decision.

What we will not do

Takedown, correction, abuse

If you operate something we list and want the entry corrected or removed, or you believe an entry is misclassified, mail [email protected] with the address. We keep reachability records, not content, so there is rarely much to argue about — but an address that should not be on a public board comes off it.

Nothing here condones anything. This is a threat-hunting resource: knowing that a leak site is up, and since when, is how incident responders and journalists do their jobs.

Built with

Back to the live board JSON API Statistics