THUGS(red) DarkWeb/Monitor_

Infrastructure

What belongs to what

An address is disposable; the things behind it are not. This is what happens when you hash the favicon the way Shodan does, hash the order a server emits its headers in, hash the page structure with the words taken out, and then look for the values two addresses have in common that almost nobody else has. Sites that share nothing are not drawn — they are counted below.

Sites fingerprinted 3,457 9,786 signals across 25 signal types
Sharing something 372 3,085 hold nothing any other site holds
Correlations 331 of 1,011 candidate pairs, above the 0.60 floor
Clusters 54 238 addresses grouped, largest holds 34
Uncorrelated 134 share a value with someone, but not enough of one
Strongest link 1.000 11 shared signals
Correlation graph  

A line means the two addresses share one or more fingerprint values that almost nothing else in the corpus shares. Thicker is more confident; hover a line to see exactly which values, and how many other sites hold each one. Click a node to isolate its cluster.

What an edge means

A thick line is a high-confidence link: several rare values in common, or one that essentially nobody else has. Confidence is 1 − ∏(1 − weight) over the shared signals, so corroboration raises it and nothing single can push it past certainty.

A thin line is the floor: 0.60. Below that nothing is drawn at all. A single shared signal only counts when it comes from a signal type where most sites have a value of their own — which is why two hosts buying a certificate from the same CA is not a line, and seven pages emitting byte-identical headers is.

A bigger node has more corroborating signals of its own and more links into its cluster. Colour is the cluster, not the state; the state is on the node's card and in the table below.

What a cluster is not. It is a claim that these addresses share infrastructure, not that one person runs them. A shared reverse proxy build, a shared host and a shared operator all look the same from outside. The density and shape columns are the honest part. A clique is one deployment. A star is an operator publishing its own mirror list — strong evidence, poor shape, low density. A chain is a path, and its two ends are several inferences apart.

The signals

Favicon (MurmurHash3)
Byte-identical favicon. The same integer Shodan publishes as http.favicon.hash.
Favicon (SHA-256)
Byte-identical favicon, our own digest.
Favicon (perceptual)
Visually the same icon after a re-encode or a rescale, which breaks both byte hashes.
TLS certificate
The same leaf certificate. Proof of a shared host, until the certificate is renewed.
TLS public key (SPKI)
The same public key. Survives certificate rotation, so it outlives the certificate hash.
TLS issuer
Issued by the same CA or, for a self-signed onion, carrying the same issuer DN.
TLS SAN entry
Both certificates name the same host.
TLS SAN list
Identical set of subject alternative names.
Header order
The same response headers, in the same sequence, with the same capitalisation.
Server banner
Identical Server: header, version included.
X-Powered-By
Identical X-Powered-By banner.
Generator
Same <meta name="generator"> string.
Cookie name
The stack sets a cookie by the same name.
CSP policy
Byte-identical Content-Security-Policy, which is almost always hand-written per deployment.
Onion version
Same hidden-service protocol version.
Error page
The same body for a path that does not exist. Fingerprints the stack even when the front pages differ.
DOM skeleton
Same markup structure with all text and attribute values stripped. The mirror-on-a-new-address signal.
Page content
The same normalised page text.
Page title
Identical document title.
Screenshot
The rendered pages look the same.
Bitcoin address
The same BTC address is quoted on both.
Monero address
The same XMR address is quoted on both.
Ethereum address
The same ETH address is quoted on both.
Litecoin address
The same LTC address is quoted on both.
Bitcoin Cash address
The same BCH address is quoted on both.
PGP fingerprint
The same PGP key fingerprint is published on both.
PGP key id
The same PGP key id is published on both.
E-mail
The same contact address.
Tox id
The same Tox id.
Session id
The same Session id.
Jabber/XMPP
The same XMPP account.
Telegram
The same Telegram handle.
Matrix
The same Matrix id.
Signal
The same Signal contact.
Onion reference
They link to the same hidden service - or one of them links to the other.
Clusters and members
54 clusters of addresses that share infrastructure fingerprints. Confidence is the mean edge score; density is how close the cluster is to every member being linked to every other.
Cluster Sites Links Density Shape Confidence Linked by
ailock c580 34 33 0.06 star 0.92 strong Onion reference toczr6bmtfbgardwgcgbeqntumkxi3y2tsfbcstybf6xknd6cm6e32ad...
ailock Alive, dhnsppqjaaa22lsqxl2tfhji4ca43743kubltnodvsft3hkvai77p6ad.onion 33 links
abyss-data Alive, ah73jnvhuoznb4n3srbtspsgrdyyde2xszywcjryjroz4wixhwmdrjad.onion 1 link
abyss-data Alive, yehbrr7tnzrcpcq2fglrf73ug2jqhgngxnyv3clyhrswdwmg45p7fyad.onion 1 link
abyss-data Alive, l7f3ny5yedcm7zhgxzy34mihk6jvgwg7m6qj3cqw4nvky7xv5wttegyd.onion 1 link
abyss-data Alive, 7lpodmzejui2scqfojx3voadc7fgrt2igww6ipjtnztfg6hprnmel5yd.onion 1 link
abyss-data Alive, ub63kcmphxbm3m64wwhuznbxfap4hlgqtauhnf4rvz23cdnrqr4towid.onion 1 link
abyss-data Alive, jdr3i5np2nyfaa3jut2wnbymrb7dceunpi63no4gvcvr7wrwbqff2wid.onion 1 link
abyss-data Alive, 46vfmzfh3uxc3ojn6z267jmiytfhxzq4x7vvnqtycu5wa6hh3jl2hjyd.onion 1 link
abyss-data Alive, tycacxbqdhohowofueufbnekscyomymoxbr4wlim5cqpfv72z6popcid.onion 1 link
abyss-data Alive, gzpjpapbvqcom6yrjnijfyzspfb7oyqt5xni4uxapwfsddw4n4v5wqyd.onion 1 link
abyss-data Alive, toczr6bmtfbgardwgcgbeqntumkxi3y2tsfbcstybf6xknd6cm6e32ad.onion 1 link
abyss-data Alive, euujzkwziy777bg4oyiks2x3s5cxlydao6jhpilzdjmjohja3s4v7jid.onion 1 link
abyss-data Alive, s5v5hvtk3oyxg3m6afgxeuwlasqku3adeosv7kwwjfvhf22vqiwotrqd.onion 1 link
ailock Alive, q37z64a4j7455p6zcdxfpqrrgctmd46vaz2uejsqgxbmrcjbd4w3fqid.onion 1 link
ailock Alive, epnsv5xaxnrks5yliq5wlthbmdlidkjddon3rx5llftx4ueiwfzdx6ad.onion 1 link
ailock Alive, to3odzfolkvhkj3jf5oo3qq5hvdycy5n5n6bi564yrxdgavnwv5znjqd.onion 1 link
ailock Alive, ccpgp25zc37xccprbjr46iurz5c5awhqxltm6xn7nef7dxpsyegwncid.onion 1 link
ailock Alive, pptiuraybrwacfl5v2qmzknenqxwt5eojtbh5cxxejaq3oo4bidkv7id.onion 1 link
ailock Alive, x7ghos27bltjtfombanecwgynfk4jw53ewkhzfnb5f27qmuquxwzhyad.onion 1 link
ailock Alive, ejqsesb5cgero35i7ujerpuslbokhuwl3dqgsrg44bzamamccf7fw3ad.onion 1 link
ailock Alive, tgyvw6pui3apxlezhiht5ubcmbm6fzn5klh2fi6qcqbvqhhfkyhnejad.onion 1 link
ailock Alive, b26gczu5dbhaovnkp5c3ef3vdphqxj64z4nwzvfdabplbptgp56gsdyd.onion 1 link
ailock Alive, mbqmgrf2kvabejqmoh4kl5tw5fko5pphzmmlbxhgjp5ar5ret7qpobad.onion 1 link
ailock Alive, wqse4qzvrtbg5o3evt2eexovcilxpvlsopwvpu7toimx64njqekzuqid.onion 1 link
ailock Alive, eddo6w66t6t4kribwjbxvtehtsny4g6j2a5gj6pzivivcu5nywhegtqd.onion 1 link
ailock Alive, qvqoau7353xe7wm3z6fzxn33q63ck7cys56wsbx25c22fnxyu4fzhnyd.onion 1 link
ailock Alive, 44ga7x7kicz2bbxaohdfw5iw6j7dgg4kyctwtf4kh6gsxifbah4jv4ad.onion 1 link
ailock Alive, igf7rlhjtvitxh72suhb55hqic67pvphbqikkrqqilzj3drhirglziyd.onion 1 link
ailock Alive, woed7o3il2jrxzczupntvhutc2ogs5otn6ekgoya6qo33qcuhomkhwad.onion 1 link
ailock Alive, dwwnfgp43qjp5cy7n3ab6g5ubdxk4jkma37oykt6loeet7cyadtty5qd.onion 1 link
ailock Alive, qcncet2rpvs3t5lnvuzzth3vbro46snkylgyqx3igdnb5bv324nzojqd.onion 1 link
ailock Alive, 27kmvzlfn3dpb6s4zq3qknqpcbrk5qzhwmg5awhjmu3m2okgpd4pgrid.onion 1 link
ailock Alive, fgx4uh7pzf4xr7k56opyfsy7qmg64xisiv5scgcadaddur7qiv6t3yyd.onion 1 link
ailock Alive, tsz2oqrfnyik3vtcx5rzubfuam3n5kapvkkagqr7yzxdxvdhehjxghqd.onion 1 link
Darkfox c23 16 37 0.31 loose 0.74 partial Onion reference akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad...
d1r Responding-502, dirone3rl3vvq64ckcnrvhe2ogrhjrwu5u7hqzrlotu3rfvmqmmbsuqd.onion 9 links
Darkfox Dead-Connection-Refused, darkfox7kukhe3b2ufsvuknskyhzdjc7a724mh4zrkipeg7pkaikm6yd.onion 9 links
chaos Responding-403, qf4p6ul3g7wyvynkxawlu7ganvgbk44myl35jqfa3aroass33dbvmdyd.onion 7 links
chaos Responding-403, myz2p6mzvbawxggfmakgwshq3ohfk37zmgwjbft7ssggbf2tokonecad.onion 7 links
Akira Alive, akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion 5 links
Blackout Alive, black3gnkizshuynieigw6ejgpblb53mpasftzd6pydqpmq2vn2xf6yd.onion 6 links
Darknet Live Dead-Connection-Refused, darknetlidvrsli6iso7my54rjayjursyw637aypb6qambkoepmyq2yd.onion 6 links
Quantum Dead-Connection-Refused, quantum445bh3gzuyilxdzs5xdepf3b7lkcupswvkryf3n7hgzpxebid.onion 6 links
DN Test IP (direct) Responding-404, enforcer.darknet.dk 3 links
DN Test IP (tor) Responding-404, enforcer.darknet.dk 3 links
CRTsh Responding-502, crt.sh 3 links
FSOCIETY | FLOCKER Dead-Connection-Refused, flock4cvoeqm4c62gyohvmncx6ck2e7ugvyqgyxqtrumklhd5ptwzpqd.onion 3 links
Invidious Alive, inv.pjsfkvpxlinjamtawaksbnnaqs2fc2mtvmozrzckxh7f3kis6yea25ad.onion 3 links
Cloak Responding-403, cloak7jpvcb73rtx2ff7kaw2kholu7bdiivxpzbhlny4ybz75dpxckqd.onion 2 links
akira Responding-403, akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion 1 link
Akira Dead-Connection-Refused, akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion 1 link
Sarcoma c528 15 14 0.13 star 0.92 strong Onion reference zncifh3szqf6awg3o33qyoi43tzjaakcjmmhuytii5bsl33wwblt7yid...
Sarcoma Alive, sarcomawmawlhov7o5mdhz4eszxxlkyaoiyiy2b5iwxnds2dmb4jakad.onion 14 links
sarcoma Alive, dj3t7qdgyopmjnvjvni7kdfne36zlq4uic5ajqrh45stquvxcwtdc3qd.onion 1 link
sarcoma Alive, sfhvr7ecppro35ch6vhrzgwtdtv3ehxem6p2thnwlgursr5vdre2nhid.onion 1 link
sarcoma Alive, mdliyoqm37i6ze4grykoa7mc6tltrjfvr5mffhvotrf6hsi5mwsx3myd.onion 1 link
sarcoma Alive, b2frnffyioow5tbiqvehe2ncaxdss2tmw7bvt34cwbdzsx2upbfhbzid.onion 1 link
sarcoma Alive, rzsqkmwfyprkqslslcf4lscqk7x24xzbxamm5jcsqqhj3vrvkdtp4did.onion 1 link
sarcoma Alive, lo52rld4cl2ezr4cd73yxn7ru2fh3dtqtmjzjuraquv7bdubhabvkkad.onion 1 link
sarcoma Alive, zncifh3szqf6awg3o33qyoi43tzjaakcjmmhuytii5bsl33wwblt7yid.onion 1 link
sarcoma Alive, rup34myhoxqzm5m2jcstdwxl2wgjvournnyiysghyef6wjdyk3ets6qd.onion 1 link
sarcoma Alive, f6cwflfjehjl6hosqy7jnkefhddnk7u3eyqn4bjrufmkle53tptxr3ad.onion 1 link
sarcoma Alive, yjri5fg3bw7gqw2c7qgx2ytccmfrghwqyuavsneih34tph7ywuwj2did.onion 1 link
sarcoma Alive, obqwjnaur6r4lpwjbgmalazy6j5d6fgliimdlipjvdomhbodm2lmidqd.onion 1 link
sarcoma Alive, dqf6l7fvqkqbwxqncznnxojdjm5bvnnqxxfnktgdgrpfbm5b2nyteaqd.onion 1 link
sarcoma Alive, xcvwsc3suebephhxxffjp5odqwspdaylgsyoxc3pdwjmnnl4yhtjrkad.onion 1 link
sarcoma Alive, ob4kfkvgqxbiddrhzlq2yhlyfpdmnro4yptt24drsjvcekczjjaf5myd.onion 1 link
LockBit 2.0 c12 15 36 0.34 loose 0.76 good Onion reference lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd...
LockBit 2.0 Dead-Connection-Refused, lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd.onion 7 links
LockBit 5.0 Alive, lockbitapt67g6rwzjbcxnww5efpg4qok6vpfeth7wx3okj52ks4wtad.onion 5 links
Lockbit 5.0 Alive, lockbitfbinpwhbyomxkiqtwhwiyetrbkb4hnqmshaonqxmsrqwg7yad.onion 5 links
Hellcat Dead-Connection-Refused, hellcakbszllztlyqbjzwcbdhfrodx55wq77kmftp4bhnhsnn5r3odad.onion 6 links
La Piovra Private Dead-Connection-Refused, wx3djgl4cacl6y4x7r4e4mbqrrub24ectue7ixyix2du25nfowtvfiyd.onion 6 links
Lorenz Dead-Connection-Refused, lorenzmlwpzgxq736jzseuterytjueszsvznuibanxomlpkyxk6ksoyd.onion 6 links
Rancoz Dead-Connection-Refused, ze677xuzard4lx4iul2yzf5ks4gqqzoulgj5u4n5n4bbbsxjbfr7eayd.onion 6 links
SiegedSec Dead-Connection-Refused, nv5p2mmpctvyqdyyi5zwh4gnifq2uxdx4etvnmaheqlrw6ordrjwxryd.onion 6 links
Trigona Dead-Connection-Refused, 3x55o3u2b7cjs54eifja5m3ottxntlubhjzt6k6htp5nrocjmsxxh7ad.onion 6 links
LockBit 3.0 2 Alive, lockbit7z2jwcskxpbokpemdxmltipntwlkmidcll2qirbu7ykg46eyd.onion 4 links
Lockbit3 Alive, lockbit33chewwx25efq6dgkhkw4u7nefudq4ijkuamjfd7x73on6dyd.onion 4 links
AbleOnion Chat Dead-Connection-Refused, notbumpz34bgbz4yfdigxvd6vzwtxc3zpt5imukgl6bvip2nikdmdaad.onion 4 links
Lockbit 3.0 Alive, lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion 3 links
XSS Forum Dead-Connection-Refused, xssforumv3isucukbxhdhwz67hoa5e2voakcfkuieq4ch257vsburuid.onion 3 links
Random Dead-Connection-Refused, notbumpz34bgbz4yfdigxvd6vzwtxc3zpt5imukgl6bvip2nikdmdaad.onion 1 link
Blacksuit c24 11 34 0.62 star 0.81 good Header order 6ffa962586eb
Blacksuit Dead-Connection-Refused, weg7sdx54bevnvulapqu6bpzwztryeflq3s23tegbmnhkbpqz637f2yd.onion 10 links
archetyp Alive, s4wq4oz66bbyvsv2rg3ixwuwzvoxv226bg3563ptchx7xknelhfu3rqd.onion 7 links
archetyp Alive, a7mupnlw776xwbt3zcaqrvrje2x44mpmwqszc5zzdseyldpq7ftyzsqd.onion 7 links
archetyp Alive, zjfsopfrwpvqrhiy73vxb6zq7ksyffkzfyow2gmhgvjsseogy65uguyd.onion 7 links
archetyp Alive, uyeygtqorgwxmp4bskauanuiofeh7frv35nvmghni5aihf32z27ogqqd.onion 7 links
Archetype Market Alive, 4pt4axjgzmm4ibmxplfiuvopxzf775e5bqseyllafcecryfthdupjwyd.onion 7 links
Ragnar_Locker Alive, rgleaktxuey67yrgspmhvtnrqtgogur35lwdrup4d3igtbm3pupc4lyd.onion 7 links
RAMP Dead-Connection-Refused, rampjcdlqvgkoz5oywutpo6ggl7g6tvddysustfl6qzhr5osr24xxqqd.onion 7 links
APT73 / BASHE Alive, bashe4aec32kr6zbifwd5x6xgjsmhg4tbowrbx4pneqhc5mqooyifpid.onion 3 links
NoEscape Dead-Connection-Refused, noescapemsqxvizdxyl7f7rmg5cdjwp33pg2wpmiaaibilb4btwzttad.onion 3 links
RansomHouse Alive, zohlm7ahjwegcedoz7lrdrti7bvpofymcayotp744qhx6gjmxbuo2yid.onion 3 links
Daixin c103 9 8 0.22 star 0.92 strong Onion reference qlfnwdg2fyvmzmqkk33iwku32ynsbbk6hysorsvvadr4o7gfzs4t46yd...
Daixin Alive, 7ukmkdtyxdkdivtjad57klqnd3kdsmq6tp45rrsxqnu76zzv3jvitlqd.onion 8 links
DAIXIN Dead-Connection-Refused, 232fwh5cea3ub6qguz3pynijxfzl2uj3c73nbrayipf3gq25vtq2r4qd.onion 1 link
daixin Dead-Connection-Refused, kyk6lixosktvbtf3g6zte7kdzid2lwrprfod55mhwunafx6jzeoui7yd.onion 1 link
daixin Dead-Connection-Refused, v66nzl27xxmrulq6c2plrzr7tryv2idflhclpoyxrrn3kfw5gkkpveid.onion 1 link
daixin Dead-Connection-Refused, kolbh6putvp6aw3vpmsppor4kyzs7ctxfbp2donetycftz5jru73ytid.onion 1 link
daixin Dead-Connection-Refused, r3h2balq6aa7plwe5p5bhxzwzxusrtldbfaamfseg33a5hk77bohzxyd.onion 1 link
daixin Dead-Connection-Refused, htz6biyazjyzzxllx4knuvux26xa2ixyjshjtwtgq4cm3vczylikm3id.onion 1 link
daixin Dead-Connection-Refused, qlfnwdg2fyvmzmqkk33iwku32ynsbbk6hysorsvvadr4o7gfzs4t46yd.onion 1 link
daixin Dead-Connection-Refused, pkx3r7xe42z7fgkjjbocf7okdh77bsvngwvp6arykksob7gleyswicyd.onion 1 link
blackout c1026 8 28 1.00 clique 0.88 strong Header order 9efadea15226
blackout Alive, mu6se7h7qfwuqclr4cc6zy7qevod6gyk37aq5vwnayrtbx3qqycx2fyd.onion 7 links
blackout Alive, 2cyxmof76rxeqze5snxxooqmhzjtcploqswxoxmenfayphumdhrtrzqd.onion 7 links
blackout Alive, idep6vd7ywl7uruhsutqjdnjawe33hct35523rrmf73kb46xrhfb5sid.onion 7 links
blackout Alive, eleav2eq3ioyiuevbyvqaz3vruwvpislphszo4cm7n56itbpnupxngyd.onion 7 links
blackout Alive, urey23jtg6z7xx3tiybmc4sgcim7dawiz2abl6crpup2lfobf7yb5wyd.onion 7 links
blackout Alive, ao5oo2luy6avdfomyw7hcegmfl4let2g5bzjqjzch6b5rpdshmuvccad.onion 7 links
blackout Alive, rqqn25k3hgmfkh7ykjbmakjgidwweomr7cbpy6pfecpxs57r5iwzwtyd.onion 7 links
blackout Alive, 4qyjonpyksc52bc3fsgfgedssqgo4a6vlfsjknqnkncbyl4layqkqjid.onion 7 links
Black Wallet c155 7 21 1.00 clique 0.68 good Header order 4aea36f4e5a3
Bitcoin Mixers Alive, deepgcb2qcbbfzgtpii3ltzkuefc2kwj4y6fyhrrzjnojgstkrcuk5id.onion 6 links
Bitcoin Private Key Alive, btcwxfgeyhsb4ng6p7dhz65todetcvp66nohcgw4spwjsaibocw4duad.onion 6 links
Black Wallet Alive, blac3rgsummterbkxkfat67ttzhxz3wxcc6euwtdct4ksddqkx6onoad.onion 6 links
Btc Mining Alive, btcqzgkgnku5trg46afd5famwibdt5lb4asypm2wjlsvmotcijd3iyqd.onion 6 links
DeepHole Alive, btca47siokklhswjppftiq3egdhkosnhw77cmanybgw6baan2xj72oid.onion 6 links
The Armory Dead-Connection-Refused, ak47biwqhn2q7fonbxv4ndgfse5p54v3niadel5aqp2fez3ebmy2p6qd.onion 6 links
Wolf Alive, wolft3xm254bvmv63hoe5v66kazyp7qoy2donh6fniwhur3qfynwljad.onion 6 links
The Best Wiki c135 7 21 1.00 clique 0.68 good Header order 020e77c6e1a9
Firearms72 Dead-Connection-Refused, owwcs2gh72stepbn5pubbgp7wiiosgxva55goloulqcuwc5kieshevyd.onion 6 links
Hungry Eyes Dead-Connection-Refused, b77enzt2hh7sziy3hyrywjkuj6f4aqpgdpufati2rgsowcdkgj5xtxid.onion 6 links
Ranion Dead-Connection-Refused, jt4tpfflmrb7jfpk6jcwxewqmmzids4syg4sjyecqhdj2oc43ib3adid.onion 6 links
SecHack Dead-Connection-Refused, cxvzq4elsmosvx7ewsok4fd5ecbhqmjas6whybk2zm2fh5dd5btvivad.onion 6 links
The Best Wiki Dead-Connection-Refused, bestwikqqlpbdiojjl5p576vlffyaoema5cyd54i6b6yrycdsximjhyd.onion 6 links
TOM & JERRY Dead-Connection-Refused, icbbioca5xmjzbbdnjejmhavvplcasg63jjhy5ajxmax7cb2teeh26id.onion 6 links
Venom Dead-Connection-Refused, ecggysd4a6gzlqwtrwbyadjflkh2g3ermgs3fbkevw7bswe3ss2qvjyd.onion 6 links
Rhysida - Archive c310 5 6 0.60 star 0.95 strong Onion reference rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad...
Rhysida - Archive Alive, rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion 4 links
Rhysida Alive, rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion 3 links
Rhysida Alive, rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion 2 links
Rhysida - Auction Alive, rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion 2 links
rhysida Alive, rhysidaqho36b6i6mvpmy5di4ro5zglovtxixrirky6q3fgack7q5uyd.onion 1 link
blackwater c490 5 5 0.50 chain 0.88 strong Onion reference pandora42btuwlldza4uthk4bssbtsv47y4t5at5mo4ke3h4nqveobyd...
blackwater Alive, ejzl7cjxmkx7lzhiqwidmrwtfjv45pkczbc4fnyaut3t7gll3yaiq5id.onion 3 links
blackwater Alive, 6t5g73fbzdjuhvvovuvuhc4mdgefrwn75szssx4ftqzxyuacdij47pad.onion 2 links
NEW Alive, ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion 2 links
arhivach Alive, arhivachqqqvwqcotafhk4ks2he56seuwcshpayrm5myeq45vlff44yd.onion 2 links
qilin Dead-Connection-Refused, pandora42btuwlldza4uthk4bssbtsv47y4t5at5mo4ke3h4nqveobyd.onion 1 link
The Hidden Wiki c80 5 7 0.70 star 0.83 good Page title onionlinks
The Hidden Wiki Alive, 6nhmgdpnyoljh5uzr5kwlatx2u3diou4ldeommfxjz3wkhalzgjqxzqd.onion 4 links
OnionLinks Alive, jaz45aabn5vkemy4jkg4mi4syheisqn2wn2n4fsuitpccdackjwxplad.onion 3 links
OnionLinks v3 Alive, s4k4ceiapwwgcm3mkb6e4diqecpo7kvdnfr5gg7sph7jjppqkvwwqtyd.onion 3 links
Pug’s Ultimate Dark Web Guide Alive, jgwe5cjqdbyvudjqskaajbfibfewew4pndx52dye7ug3mt3jimmktkid.onion 3 links
As an Onion V3 Service Alive, t3qi4hdmvqo752lhyglhyb5ysoutggsdocmkxhuojfn62ntpcyydwmqd.onion 1 link
AlphaVM c35 4 6 1.00 clique 0.87 strong Onion reference alphvmmm27o3abo3r2mlmjrpdmzle3rykajqc5xsj7j7ejksbpsa36ad...
AlphaVM Dead-Connection-Refused, alphvmmm27o3abo3r2mlmjrpdmzle3rykajqc5xsj7j7ejksbpsa36ad.onion 3 links
Alphv Dead-Connection-Refused, alphvmmm27o3abo3r2mlmjrpdmzle3rykajqc5xsj7j7ejksbpsa36ad.onion 3 links
BreachForums.is Dead-Connection-Refused, breachedu76kdyavc6szj6ppbplfqoz3pgrk3zw57my4vybgblpfeayd.onion 3 links
ALPHV (aka BlackCat 2) Dead-Connection-Refused, alphvuzxyxv6ylumd2ngp46xzq3pw6zflomrghvxeuks6kklberrbmyd.onion 3 links
Atm Skimmers c223 3 3 1.00 clique 1.00 strong Header order 8cd3d159298b
ATM Skimmer Shop Alive, atmskimmer.to 2 links
Atm Skimmers Alive, atmskimmer.to 2 links
Conti News (2) Alive, conti.news 2 links
dark project c1249 3 3 1.00 clique 1.00 strong Header order dc0797a3c744
dark project Alive, 3i5px2hibsyityv6jixnqba35yz25jekbwwumjdxjqzt3euqsygjx5id.onion 2 links
dark project Alive, x2jz63qemhcbhyskzt3pie757oicdkctk2rh5dpykmxsw2yoayeqs5yd.onion 2 links
dark project Alive, darkprn3d3udnhpuxknsrhft3376lrz5tenhgkrxge5hxqe46pkbrwid.onion 2 links
booba team c1046 3 3 1.00 clique 1.00 strong Header order af400b7fae8d
booba team Alive, eazk7las3xsvsyxgww3jgzammqjevso2ydnmlopdhl3u2muyrmmilrqd.onion 2 links
booba team Alive, 7t3zi3e7ki6iseun77ofqtr6wmbpgnpc2ada6gstcxp54lw6q2zb7jad.onion 2 links
booba team Alive, d77tnb4bkmj3e366msrzllnwsi2t5e54e4yqh7zm7y5hlfwugnwzswad.onion 2 links
Hack Forums c130 3 3 1.00 clique 0.98 strong Cookie name mybb[lastactive]
darkforums Alive, darkfoxaqhfpxkrbt7vxns2z2u2k72sgmqbzeorupaiottw3ecm2wgyd.onion 2 links
Hack Forums Responding-403, hackforums.net 2 links
SuprBay Forum Alive, suprbaydvdcaynfo4dgdzgxb4zuso7rftlil5yg5kqjefnw4wq4ulcad.onion 2 links
Shadowcarders c110 3 3 1.00 clique 0.97 strong Header order 9ddff2b5d297
Cracking Responding-403, cracking.org 2 links
Hackread Responding-403, www.hackread.com 2 links
Shadowcarders Responding-403, shadowcarders.com 2 links
Play c95 3 3 1.00 clique 0.94 strong Page content 40dfc2dde9a5
Play Alive, ipi4tiumgzjsym6pyuzrfqrtwskokxokqannmd6sa24shvr7x5kxdvqd.onion 2 links
Play Alive, j75o7xvvsm4lpsjhkjvb4wl2q6ajegvabe6oswthuaubbykk4xkzgpid.onion 2 links
Play Dead-Connection-Refused, mbrlkbtq5jonaqkurjwmxftytyn2ethqvbxfu4rgjbkkknndqwae6byd.onion 2 links
anubis c382 3 3 1.00 clique 0.93 strong Page title anubis blog
anubis Alive, om6q4a6cyipxvt7ioudxt24cw4oqu4yodmqzl25mqd2hgllymrgu4aqd.onion 2 links
anubis Alive, anubisyfkh5rixydjpoo3jqucauajz2juybrbtuglcppjj2y3eg3y6ad.onion 2 links
SpaceBears Alive, 5butbkrljkaorg5maepuca25oma7eiwo6a2rlhvkblb4v6mf3ki2ovid.onion 2 links
CryptoNet Recover c105 3 3 1.00 clique 0.91 strong Header order 5cd6b6da3ad7
CryptoNet News Dead-Connection-Refused, blog6zw62uijolee7e6aqqnqaszs3ckr5iphzdzsazgrpvtqtjwqryid.onion 2 links
CryptoNet Recover Dead-Connection-Refused, cryptr3fmuv4di5uiczofjuypopr63x2gltlsvhur2ump4ebru2xd3yd.onion 2 links
8Base Dead-Connection-Refused, basemmnnqwxevlymli5bs36o5ynti55xojzvn246spahniugwkff2pad.onion 2 links
Hacker Warehouse c166 3 2 0.67 star 0.90 strong X-Powered-By WP Engine
Hacker Warehouse Alive, hackerwarehouse.com 2 links
Censys Alive, censys.io 1 link
Nord Vpn Responding-403, nordvpn.com 1 link
Dread c139 3 3 1.00 clique 0.89 strong Header order fbdacd159b88
Dread Alive, dreadytofatroptsdj6io7l3xptbet6onoyno2yv7jicoxknyazubrad.onion 2 links
Dread Alive, dreadytofatroptsdj6io7l3xptbet6onoyno2yv7jicoxknyazubrad.onion 2 links
HackTown Alive, hacktowns3sba2xavxecm23aoocvzciaxirh3vekg2ovzdjgjxedfvqd.onion 2 links
Whistleblower Aid c220 3 2 0.67 star 0.87 strong Page title welcome | whistleblower aid | securedrop
Whistleblower Aid Dead-Connection-Refused, kogbxf4yf3bsblr3izo4dopgkbhueoa3h7ii6xnppx7viifuwx7yy2qd.onion 2 links
Whistleblower Aid Dead-Connection-Refused, kogbxf4ysay2qzozmg7ar45ijqmj2vxrwqa4upzqq2i7sqj7wv7wcdqd.onion 1 link
alphv Alive, he5dybnt7sr6cm32xt77pazmtm65flqy6irivtflruqfc5ep7eiodiad.onion 1 link
54bb47h c34 3 3 1.00 clique 0.87 strong Onion reference 54bb47h5qu4k7l4d7v5ix3i6ak6elysn3net4by4ihmvrhu7cvbskoqd...
54bb47h Dead-Connection-Refused, 54bb47h5qu4k7l4d7v5ix3i6ak6elysn3net4by4ihmvrhu7cvbskoqd.onion 2 links
54bb47h Dead-Connection-Refused, 54bb47h5qu4k7l4d7v5ix3i6ak6elysn3net4by4ihmvrhu7cvbskoqd.onion 2 links
Sabbath Dead-Connection-Refused, 54bb47h5qu4k7l4d7v5ix3i6ak6elysn3net4by4ihmvrhu7cvbskoqd.onion 2 links
Cock c48 3 3 1.00 clique 0.82 strong Page title home — cock.li e-mail hosting
Cock Dead-Connection-Timeout, rurcblzhmdk22kttfkel2zduhyu3r6to7knyc7wiorzrx5gw4c3lftad.onion 2 links
Cock.li (web) Alive, cock.li 2 links
Everest Alive, ransomocmou6mnbquqz44ewosbkjk3o5qjsl3orawojexfook2j7esad.onion 2 links
Moses Staff (web) c20 3 3 1.00 clique 0.82 strong Header order a6268f919761
Mate Host Dead-Connection-Refused, hostmate2s6cudoclklceo6u2jjjilgdz2rfx5r2xuezr26kx2jgl5ad.onion 2 links
Moses Staff (web) Dead-Could-Not-Resolve, moses-staff.se 2 links
x001xs Dead-Connection-Refused, nalr2uqsave7y2r235am5jsfiklfjh5h4jc5nztu3rzvmhklwt5j6kid.onion 2 links
DNMX c144 3 3 1.00 clique 0.60 good Generator WordPress 7.1
ArcusMedia Alive, arcuufpr5xxbbkin4mlidt7itmr6znlppk63jbtkeguuhszmc5g7qdyd.onion 2 links
DNMX Alive, hxuzjtocnzvv5g2rtg2bhwkcbupmk7rclb6lly3fo4tvqkk5oyrv3nid.onion 2 links
E-Mail Alive, danielas3rtn54uwmofdo3x2bsdifr47huasnmbgqzfrec5ubupvtpid.onion 2 links
Video Search c171 2 1 1.00 pair 1.00 strong Header order 3b12e56cdfaa
Handala Hack Team Alive, handala.to 1 link
Video Search Alive, oniontv.org 1 link
Mullvad Vpn c165 2 1 1.00 pair 1.00 strong Header order cbbb8867507a
Mullvad VPN Alive, o54hon2e2vj6c7m3aqqu6uyece65by3vgoxxhlqlsvkmacw6a7m7kiad.onion 1 link
Mullvad Vpn Alive, o54hon2e2vj6c7m3aqqu6uyece65by3vgoxxhlqlsvkmacw6a7m7kiad.onion 1 link
DragonForce c391 2 1 1.00 pair 1.00 strong Header order 57e0ee13586d
Dragonforce Alive, 3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion 1 link
DragonForce Alive, z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion 1 link
PROTONMAIL c145 2 1 1.00 pair 1.00 strong Favicon (MurmurHash3) -831561550
PROTONMAIL Alive, protonmailrmez3lotccipshtkleegetolb73fuirgj7r4o4vfu7ozyd.onion 1 link
ProtonMail (web) Alive, protonmail.com 1 link
Lynx c524 2 1 1.00 pair 1.00 strong Page content 77b5add6b820
Lynx Alive, lynxblogmx3rbiwg3rpj4nds25hjsnrwkpxt5gaznetfikz4gz2csyad.onion 1 link
Lynx Alive, lynxblogxutufossaeawlij3j3uikaloll5ko6grzhkwdclrjngrfoid.onion 1 link
bravox c1088 2 1 1.00 pair 1.00 strong Header order 9c8a369d4ed3
bravox Alive, bravoxxwcfz5qk43ychgveprpd5mw5hvxfs4a2uz2okx7mumiht4fzyd.onion 1 link
bravox Alive, bravoxxtrmqeeevhl7gdh2yzvlrjxajr66d33c7ozosrccx4cz7cepad.onion 1 link
RansomHub c379 2 1 1.00 pair 1.00 strong Header order 57bbca070a27
RansomHub Dead-Connection-Refused, ransomxifxwc5eteopdobynonjctkxxvap77yqifu2emfbecgbqdw6qd.onion 1 link
RansomHub - Archive Dead-Connection-Refused, fpwwt67hm3mkt6hdavkfyqi42oo3vkaggvjj4kxdr2ivsbzyka5yr2qd.onion 1 link
ThreeAM c471 2 1 1.00 pair 1.00 strong Favicon (SHA-256) 3b7b295739e1
3am Alive, threeam7fj33rv5twe5ll7gcrp3kkyyt6ez5stssixnuwh4v3csxdwqd.onion 1 link
ThreeAM Alive, threeamkelxicjsaf2czjyz2lc4q3ngqkxhhlexyfcp2o6raw4rphyad.onion 1 link
Have I Been Pwned? c444 2 1 1.00 pair 0.99 strong Onion reference admate3tczgp6digew7jpzcosq52rs7anru53imwqimron27emq7dbqd...
Have I Been Pwned? Alive, pwneduufdnxe3dvfwvnzlv5rt4xbfaepc6rw5pajekuwqxe32uivkyyd.onion 1 link
PasswordFox Alive, passfoxyz6w6x6rk2j7kmvrlpa5o7n25mwe7wu6pr6v3lb62tzkqgcad.onion 1 link
Cuba c8 2 1 1.00 pair 0.98 strong Server banner Apache/2.4.6 (CentOS) PHP/7.4.30
Cuba Dead-Connection-Refused, cuba4ikm4jakjgmkezytyawtdgr2xymvy6nvzgw5cglswg3si76icnqd.onion 1 link
V is Vendetta Dead-Connection-Refused, test.cuba4ikm4jakjgmkezytyawtdgr2xymvy6nvzgw5cglswg3si76icnqd.onion 1 link
French World Market c123 2 1 1.00 pair 0.97 strong Cookie name SID
Anubis Alive, anubisrmxruiuxyw4ld2cjcjqeydce66q3zje2wyhg4wmdirjdbg3lqd.onion 1 link
French World Market Alive, frenchwltobamdhyq5y2egezkbnz53ws5kaa6wnscildhnegdw5nhsyd.onion 1 link
Qilin c98 2 1 1.00 pair 0.96 strong Header order 5942e66ed617
Elude Dead-Connection-Refused, eludemailxhnqzfmxehy3bk5guyhlxbunfyhkcksv4gvx6d3wcf6smad.onion 1 link
Qilin Dead-Connection-Refused, kbsqoivihgdmwczmxkbovk7ss2dcynitwhhfu5yw725dboqo5kthfaad.onion 1 link
Cactus c287 2 1 1.00 pair 0.92 strong Onion reference cactusbloguuodvqjmnzlwetjlpj6aggc6iocwhuupb47laukux7ckid...
Cactus Dead-Connection-Refused, cactusbloguuodvqjmnzlwetjlpj6aggc6iocwhuupb47laukux7ckid.onion 1 link
Cactus Dead-Connection-Refused, cactusbloguuodvqjmnzlwetjlpj6aggc6iocwhuupb47laukux7ckid.onion 1 link
DARK LINK c136 2 1 1.00 pair 0.92 strong Onion reference mzg4llxp4kaf4qq5s4hlentf45rjda3mzev3j6hlh2endarc2k6z6oyd...
DARK LINK Alive, m3w65dgd5x26jz4fdot66bxkzdajdvtez4holkah3qehpcsqtw37vnid.onion 1 link
satancd Responding-404, mzg4llxp4kaf4qq5s4hlentf45rjda3mzev3j6hlh2endarc2k6z6oyd.onion 1 link
crpx0 c1222 2 1 1.00 pair 0.89 strong Header order 09ffa736942b
crpx0 Alive, tlxoddx4odmc2qvsmtsbgwwsv5j45osb5sox7mz6izxliuju5mkulzad.onion 1 link
datakeeper Alive, dc4nwiijwiffwztwzj5fngmcoppedrxg4jqj2tq67ontbini6qmlguid.onion 1 link
brain cipher c1055 2 1 1.00 pair 0.89 strong Header order 8522ed1953f5
brain cipher Alive, zijgmuqjzb6dc7pofxhtaiz36qqyg35lhutybmzaz6whzgei2casjgid.onion 1 link
brain cipher Alive, 6ft2dfh26wm3w44orpjcgviutvfp25ez2iyh5ego5egvfmifrws7vvqd.onion 1 link
Cryptostorm c164 2 1 1.00 pair 0.89 strong Header order ffed452debf1
Cryptostorm Responding-403, stormwayszuh4juycoy4kwoww5gvcu2c4tdtpkup667pdwe4qenzwayd.onion 1 link
Imperial Library Responding-502, kx5thpx2olielkihfyo4jgjqfb7zx7wxr3sd4xzt26ochei4m6f7tayd.onion 1 link
Kowloon Hosting c143 2 1 1.00 pair 0.89 strong Header order 75e3ce69939f
Kowloon Hosting Alive, kowloon5ddwuqwlqckuibv4fxw6m3a6ymk5kinigbjsgjcly346dh7qd.onion 1 link
Torch Alive, xmh57jrknzkhv6y3ls3ubitzfqnkrwxhopf5aygthi7d6rplyvk3noyd.onion 1 link
Hacking Conference c138 2 1 1.00 pair 0.89 strong Header order c444fe281380
Hacking Conference Alive, g7ejphhubv5idbbu3hb3wawrs5adw7tkx7yjabnf65xtzztgg4hcsqqd.onion 1 link
InfoCon.org Alive, w27irt6ldaydjoacyovepuzlethuoypazhhbot6tljuywy52emetn7qd.onion 1 link
Medusa (2) c390 2 1 1.00 pair 0.88 strong Page title human verify
Medusa Dead-Connection-Refused, xfv4jzckytb4g3ckwemcny3ihv4i5p4lqzdpi624cxisu35my5fwi5qd.onion 1 link
Medusa (2) Dead-Connection-Refused, kyfiw76eol6ph2mq7pi5e5tdvce37bicddhai62qhdc5ja6jdchz4qqd.onion 1 link
SecureDrop c215 2 1 1.00 pair 0.88 strong Page title share and accept documents securely
SecureDrop Alive, sdolvtfhatvsysc6l34d65ymdwxcujausv7k5jk4cy5ttzhjoi6fzvyd.onion 1 link
SecureDrop Dead-Connection-Refused, sdolvtfhe5xcod5ghegkgtj6y5jegqx5524wpnwnrr7bmy5avpx65pyd.onion 1 link
DeepMarket c125 2 1 1.00 pair 0.88 strong Page title loading...
DeepMarket Responding-503, deepme4wt5n3n6nvwnmkiiusewng4nnunjztlbljliq7clhilzruiryd.onion 1 link
Hunters Dead-Connection-Refused, hunters55rdxciehoqzwv7vgyv6nt37tbwax2reroyzxhou7my5ejyid.onion 1 link
Facebook onion c149 2 1 1.00 pair 0.87 strong Onion reference www.facebookwkhpilnemxj7asaniu7vnjjbiltxjqhye3mhbshg7kx5...
Facebook onion Responding-500, www.facebookwkhpilnemxj7asaniu7vnjjbiltxjqhye3mhbshg7kx5tfyd.onion 1 link
US CIA Alive, ciadotgov4sjwlzihbbgxnqg3xiyrg7so2r2o3lt5wz5ypk4sxyjstad.onion 1 link
Turk Hack Team c79 2 1 1.00 pair 0.86 strong Cookie name xf_csrf
darkmoney Alive, darkmonn6oy55o7kgmwr4jny2gi2zj6hyalzcjgl444dvpalannl5jid.onion 1 link
Turk Hack Team Alive, www.turkhackteam.org 1 link
Hackers for hire c86 2 1 1.00 pair 0.85 strong Screenshot 0606061e0e160606
EasyCoin – Bitcoin Wallet and Mixer Alive, mp3fpv6xbrwka4skqliiifoizghfbjy5uyu77wwnfruwub5s4hly2oid.onion 1 link
Hackers for hire Alive, prjd5pmbug2cnfs67s3y65ods27vamswdaw2lnwf45ys3pjl55h2gwqd.onion 1 link
DataBreaches c191 2 1 1.00 pair 0.83 strong X-Powered-By PHP/8.1.27
BHF Dead-Connection-Refused, bhf2b5nb3lb2kxpaoyqz7cuk2dkgej5n2refuffxzyhldwt4d7de4zqd.onion 1 link
DataBreaches Alive, www.databreaches.net 1 link
What we can actually see

Every weight below is measured from this corpus, not configured. Resolution is the share of sites whose value in that signal is held by nobody else — above 0.5 the signal behaves like an identifier and may carry a link on its own, below it the signal is a classification and can only corroborate one. Best weight is the most informative value of that type currently in the data, where 1.0 would be unique.

Signal coverage across 3,457 fingerprinted sites.
Signal Sites Distinct values Resolution Can stand alone Best weight
Onion reference 3,377 3,580 0.968 identifier 0.915
Onion version 3,279 2 0.000 classification only 0.704
Header order 428 250 0.500 identifier 0.886
Server banner 376 56 0.090 classification only 0.883
Page title 330 287 0.803 identifier 0.881
Page content 268 253 0.903 identifier 0.876
Favicon (MurmurHash3) 167 149 0.808 identifier 0.865
Favicon (SHA-256) 167 149 0.808 identifier 0.865
Cookie name 127 78 0.339 classification only 0.857
TLS issuer 86 21 0.105 classification only 0.844
TLS SAN entry 85 225 0.894 identifier 0.844
TLS SAN list 85 80 0.894 identifier 0.844
X-Powered-By 58 33 0.414 classification only 0.829
E-mail 50 90 0.920 identifier 0.823
CSP policy 44 43 0.955 identifier 0.817
Generator 16 14 0.813 identifier 0.604
Screenshot 9 3 0.000 classification only 0.685
Favicon (perceptual) 7 3 0.000 classification only 0.644
Monero address 4 4 1.000 identifier
Tox id 3 3 1.000 identifier
PGP fingerprint 3 4 1.000 identifier
Telegram 2 5 1.000 identifier
Bitcoin address 2 6 1.000 identifier
Jabber/XMPP 1 2 1.000 identifier
PGP key id 1 5 1.000 identifier