THUGS(red) DarkWeb/Monitor_

Statistics

What the monitor sees

Nine views of the same collection: where the services sit, whether they answer, what runs them, and what stops us getting through. Everything below is measured, not modelled — and where a measurement does not exist yet, the panel says so instead of drawing a plausible line.

Tracked 3,455 15 categories
Reachable 499 14% of the board
Blocked 28 answered 403
Broken 17 answered, but not with the site
Dark 2,911 84% of the board
Sweep lag 2h oldest measurement on the board
Checked 24h 3,455 100% of the board
Screenshots 743 captures on file
Reachability flow Open CSV

Every tracked service, flowing from its category through the reachability state we last measured to the HTTP class it answered with.

Reachability flow — Services by category, reachability state and HTTP response class.
CategoryStateHTTP classServices
RansomwareDeadNo reply2682
RansomwareAliveHTTP 2xx317
Dark Web MarketDeadNo reply131
Dark Web MarketAliveHTTP 2xx78
Hacking CommunityDeadNo reply30
Search EngineAliveHTTP 2xx30
RansomwareBlockedHTTP 40319
Hacking CommunityAliveHTTP 2xx17
Email ProviderAliveHTTP 2xx13
Email ProviderDeadNo reply13
HostingDeadNo reply13
Search EngineDeadNo reply12
WikiAliveHTTP 2xx9
Hacker GroupDeadNo reply8
VPN ProviderAliveHTTP 2xx8
RansomwareBrokenHTTP 4047
CryptocurrencyAliveHTTP 2xx6
CryptocurrencyDeadNo reply6
Security NewsAliveHTTP 2xx6
Hacking NewsAliveHTTP 2xx5
HostingAliveHTTP 2xx5
UnknownAliveHTTP 2xx5
UnknownDeadNo reply5
WikiDeadNo reply5
Dark Web MarketBlockedHTTP 4034
Security NewsDeadNo reply3
Hacking NewsDeadNo reply2
Dark Web MarketBrokenHTTP 5xx2
Search EngineBrokenHTTP 5xx2
VPN ProviderBlockedHTTP 4032
Hacking CommunityBlockedHTTP 4031
Email ProviderBrokenHTTP 4041
Dark Web MarketBrokenHTTP 4041
RansomwareBrokenHTTP 5xx1
Search EngineBlockedHTTP 4031
Search EngineBrokenHTTP 4xx1
Security NewsBrokenHTTP 4041
Social MediaBlockedHTTP 4031
Social MediaBrokenHTTP 5xx1
Social MediaDeadNo reply1
sites 3455 services across 14 categories: 499 reachable, 45 answering with something other than the site, 2911 dark.
Reachability now Open CSV

The current state of the board, broken down by category.

Reachability now — Reachability state of every tracked service, by category.
CategoryAliveBlockedBrokenDeadWaitingTotal
Ransomware317198268203026
Dark Web Market78431310216
Hacking Community171030048
Search Engine301312046
Email Provider130113027
Hosting50013018
Wiki9005014
Cryptocurrency6006012
Security News6013010
Unknown5005010
VPN Provider8200010
Hacker Group000808
Hacking News500207
Social Media011103
sites 499 of 3455 tracked services answered on the last sweep - 14% of the board.
Protection Open CSV

What sits in front of the services: which vendor, and whether it stops us.

Protection — Protection layer in front of each service, and whether we still reach the service through it.
ProtectionServicesStill reachableNot reachable
Cloudflare352510
DDoS-Guard101
Captcha1046
JS challenge532
Forbidden (403)23023
Rate limited303
Account or invite wall413
No protection detected33744662908
sites headers, cookies and page titles 81 of 3455 services sit behind a detectable protection layer, and 48 of those are unreachable because of it.
Uptime calendar partial data Open CSV

A year of daily reachability, one cell per day.

site_checks_daily has no rows yet, so this is not uptime: each cell counts the services whose most recent successful reach falls on that day. A true day-by-day uptime calendar starts accumulating from the next crawl, once the collector writes its check history.

Uptime calendar — Services by the day they were last successfully reached.
DayServices last reached
2025-10-191
2025-10-271
2025-11-091
2025-11-121
2025-11-191
2025-11-201
2025-11-219
2025-11-291
2025-12-041
2025-12-091
2026-01-061
2026-01-071
2026-01-201
2026-02-091
2026-02-241
2026-03-021
2026-03-301
2026-04-061
2026-04-131
2026-05-091
2026-05-161
2026-06-161
2026-06-231
2026-07-091
2026-07-111
2026-08-121
2026-08-132
2026-08-224
2026-08-251
2026-08-263
2026-08-291
2026-09-021
2026-09-042
2026-09-051
2026-09-061
2026-09-081
2026-09-092
2026-09-112
2026-09-123
2026-09-131
2026-09-146
2026-09-161
2026-09-171
2026-09-181
2026-09-191
2026-09-221
2026-09-242
2026-09-251
2026-09-271
2026-09-283
2026-09-294
2026-10-021
2026-10-034
2026-10-043
2026-10-05196
2026-10-06380
sites.last_alive Last successful reach for 665 services, spread over 56 days.
Collection growth Open CSV

Cumulative services under monitoring, stacked by category.

Collection growth — Cumulative services under monitoring at the end of each month, by category.
MonthRansomwareDark Web MarketHacking CommunitySearch EngineEmail ProviderHostingWikiCryptocurrencySecurity NewsUnknownVPN ProviderHacker GroupHacking NewsSocial MediaTotal
2023-0165500000000000070
2023-0265500000000000070
2023-0365500000000000070
2023-0465500000000000070
2023-0565500000000000070
2023-0665500000000000070
2023-078330200020000200119
2023-0813071223720181210919813351
2023-0913271223720181210919813353
2023-1013271223720181210919813353
2023-1113271243720181210919813355
2023-1213671243720181210919813359
2024-0113671253720181210919813360
2024-0213671253720181210919813360
2024-0313672253720181210919813361
2024-0413872253720181210919813363
2024-0513872253720181210919813363
2024-0613872253720181210919813363
2024-0715272253720181210919813377
2024-0815472253720181210919813379
2024-0915672253720181210919813381
2024-1015772253720181210919813382
2024-1115772253720181210919813382
2024-1215972253720181210919813384
2025-0115973253720181210919813385
2025-0215973253720181210919813385
2025-0315973253720181210919813385
2025-0416073253720181210919813386
2025-0516073253720181210919813386
2025-0616173253720181210919813387
2025-0716173253720181210919813387
2025-0816173253720181210919813387
2025-0916173253720181210919813387
2025-1016184314523181210101010873432
2025-1116184314523181210101010873432
2025-1216184314523181210101010873432
2026-0116387314623181312101010873441
2026-0216387314623181312101010873441
2026-0316387314623181312101010873441
2026-0416387314623181312101010873441
2026-0516387314623181312101010873441
2026-0616387314623181312101010873441
2026-0716387314623181312101010873441
2026-0830262164846271814121010108733455
2026-0930262164846271814121010108733455
2026-1030262164846271814121010108733455
sites.audit_added The collection grew from its first entry in 2023-01 to 3455 services by 2026-10.

Services added against services that went dark, week by week.

Churn — Reachability transitions per week, counted from the crawl history.
Week beginningRecoveriesWent darkNetRunning net
2025-10-130000
2025-10-200000
2025-10-270000
2025-11-030000
2025-11-100000
2025-11-170000
2025-11-240000
2025-12-010000
2025-12-080000
2025-12-150000
2025-12-220000
2025-12-290000
2026-01-050000
2026-01-120000
2026-01-190000
2026-01-260000
2026-02-020000
2026-02-090000
2026-02-160000
2026-02-230000
2026-03-020000
2026-03-090000
2026-03-160000
2026-03-230000
2026-03-300000
2026-04-060000
2026-04-130000
2026-04-200000
2026-04-270000
2026-05-040000
2026-05-110000
2026-05-180000
2026-05-250000
2026-06-010000
2026-06-080000
2026-06-150000
2026-06-220000
2026-06-290000
2026-07-060000
2026-07-130000
2026-07-200000
2026-07-270000
2026-08-030000
2026-08-100000
2026-08-17678702-24-24
2026-08-241930190822-2
2026-08-3124312445-14-16
2026-09-0725272567-40-56
2026-09-142833279142-14
2026-09-21254325385-9
2026-09-2824572471-14-23
2026-10-05362400-38-61
site_checks Over the last 52 weeks: recoveries 15761, went dark 15822, net -61.
Response timing Open CSV

How long the services take to answer, and how fresh each measurement is.

Response timing — Response time in milliseconds by category: minimum, lower quartile, median, upper quartile, maximum.
CategoryMeasuredMinQ1MedianQ3Max
Hacking Community471693103661526260001
Cryptocurrency911145660001
Email Provider22165485670760002
Hacker Group4755510859125121400216816
Hacking News7434570674688122674
Hosting10155511184467160001
Dark Web Market195165573091617676644
Ransomware301318352122433083860006
Search Engine4413716693260846
Security News101332626826560002
Social Media324514897295493297836407
Unknown10151037411910460001
VPN Provider10811702644895397
Wiki12176751115060001
sites.response_ms Median response across 3396 measured services is 11846 ms.
Technology Open CSV

Server family to framework, sized by the number of services running it.

Technology — Server family, framework and exact banner, by number of services.
Server familyFrameworkBannerServices
nginxno framework headernginx174
nginxno framework headernginx/1.24.0 (Ubuntu)83
unknownno framework headerunknown73
nginxno framework headernginx/1.26.338
nginxno framework headernginx/1.27.530
nginxno framework headernginx/1.22.127
apacheno framework headerApache23
nginxno framework headernginx/1.30.221
cloudflareno framework headercloudflare15
nginxno framework headernginx/1.18.0 (Ubuntu)12
gunicornno framework headergunicorn11
nginxno framework headernginx/1.29.66
openrestyno framework headeropenresty6
nginxno framework headernginx/1.18.05
nginxno framework headernginx/1.27.35
unknownExpressunknown5
openrestyMagentoopenresty5
apacheUnknownApache4
cloudflareWordPresscloudflare4
nginxXenForonginx3
nginxPrestaShopnginx3
nginxno framework headernginx/1.29.32
nginxno framework headernginx/1.28.3 (Ubuntu)2
nginxno framework headernginx/1.28.02
nginxWordPressnginx2
nginxPHP 7.4nginx2
unknownno framework headerOpenBSD httpd2
unknownPHP 8.3unknown2
unknownMagentounknown2
apacheno framework headerApache/2.4.58 (Ubuntu)2
apacheWordPressApache2
cloudflareNext.jscloudflare2
cloudflareSite Kit by Googlecloudflare2
cloudflareAngularJScloudflare2
iisno framework headerMicrosoft-IIS/10.02
nginxno framework headernginx/1.9.21
nginxno framework headernginx/1.26.3 (Ubuntu)1
nginxno framework headernginx/1.20.11
nginxno framework headernginx/1.30.41
nginxno framework headernginx/1.31.61
nginxXenForonginx/1.31.61
nginxXenForonginx/1.18.0 (Ubuntu)1
nginxPrestaShopnginx/1.18.0 (Ubuntu)1
nginxWordPressnginx/1.22.11
nginxNext.jsnginx/1.31.11
nginxNext.jsnginx1
nginxNext.jsnginx/1.27.51
nginxExpressnginx/1.22.11
nginxExpressnginx1
nginxFlarumnginx1
nginxDiscourse 2026.10.0-latest - https://github.com/discourse/dinginx1
nginxPHP 8.3nginx1
nginxdominant-color-imagesnginx1
nginxPHP 8.5nginx/1.31.61
nginxPowered by LayerSlider 7.14.4 - Build Heros, Sliders, and Ponginx1
nginxphpBBnginx/1.30.31
nginxDrupalnginx1
nginxDanDomain Webshopnginx1
nginxReactnginx1
nginxAngularnginx1
unknownno framework headerKalio1
unknownno framework headerKestrel1
unknownno framework headerAkamaiGHost1
unknownno framework headerhelix1
unknownno framework headerBaseHTTP/0.6 Python/3.12.31
unknownno framework headerLion Market Server1
unknownno framework headerF5-TrafficShield1
unknownWordPressFTGate1
unknownWordPressunknown1
unknownPrestaShopAmazonS31
unknownReactunknown1
unknownNext.jsVercel1
unknownGatsbyunknown1
unknownVueSucuri/Cloudproxy1
unknownVirusTotalGoogle Frontend1
unknownAngularJSserver1
unknownvBulletinunknown1
unknownAngularGlobaLeaks1
apacheno framework headerApache/2.4.68 (Debian)1
apacheno framework headerApache/2.4.38 (Debian)1
apacheno framework headerApache/2.4.65 (Debian)1
apacheno framework headerApache/2.4.66 (Debian)1
apachePHP 8.2Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.121
apachePrestaShopApache1
apacheHugoApache/2.4.52 (Ubuntu)1
apacheMSHTMLApache1
apacheDokuWikiApache1
cloudflareCGcloudflare1
cloudflareReactcloudflare1
cloudflarePrestaShopcloudflare1
cloudflarePHP 8.2cloudflare1
cloudflareAll in One SEO Pro (AIOSEO)cloudflare1
cloudflareXenForocloudflare1
cloudflareMediaWikicloudflare1
cloudflareFlarumcloudflare1
openrestyPrestaShopopenresty/1.25.3.11
iisPHP 8.2Microsoft-IIS/10.01
caddyno framework headerCaddy1
sites.tech_json 644 of 644 services report a server banner; nginx is the most common family.
Onion graph partial data Open CSV

How the services we watch relate to one another.

links_json is still empty, so no service has told us which other onions it references. The edges below are shared infrastructure instead: a hub is one exact Server banner, and the services hanging off it all answer with that identical version string, which usually means the same host or the same operator. The real reference graph replaces this once the collector harvests outbound links.

Onion graph — Services grouped by the exact Server banner they answer with.
Server bannerServicesServices in the group
nginx/1.26.340Metaencryptor team; abyss-data; abyss-data; abyss-data; abyss-data; abyss-data; abyss-data; abyss-data; abyss-data; abyss-data; abyss-data; abyss-data; abyss-data; abyss-data; abyss-data; abyss-data; abyss-data; abyss-data; ailock; ailock; ailock; ailock; ailock; ailock; ailock; ailock; ailock; ailock; ailock; ailock; ailock; ailock; ailock; ailock; ailock; ailock; ailock; ailock; ailock; metaencryptor
nginx/1.22.140Ahmia; RansomHouse; Sarcoma; crypto24; d1r; insomnia; kyber; m3rx; pear; pear; pear; pear; pear; pear; pear; pear; pear; pear; pear; pear; pear; prinz eugen; ransomhouse; ransomhouse; ransomhouse; ransomhouse; ransomhouse; ransomhouse; ransomhouse; ransomhouse; ransomhouse; ransomhouse; ransomhouse; ransomhouse; ransomhouse; ransomhouse; ransomhouse; ransomhouse; ransomhouse; scattered lapsus$ hunters
nginx/1.27.531Incransom; Lynx; Lynx; inc ransom; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; titan
nginx/1.18.0 (Ubuntu)21APT73 / BASHE; BrainCipher; INC Ransom; Medusa (2); Meow; NOKOYAWA; NOKOYAWA WallofShame; OnionLinkHub; VulMon; eraleign (apt73); eraleign (apt73); eraleign (apt73); eraleign (apt73); leaky pro; nitrogen; orova; probiv; t1erone; timc; wallstreet; wallstreet
nginx/1.30.221AccMarket; Bitpharma; Brainmagic; Cardshop; DCdutchconnectionUK; Dark Mixer; DrChronic; EasyCoin – Bitcoin Wallet and Mixer; EuroGuns; Hackers for hire; Mixabit; Mobile Store; OnionIdentityServices; OnionLinks; OnionLinks v3; Onionwallet; Pug’s Ultimate Dark Web Guide; Rent-A-Hacker; The Hidden Wiki; TomAndJerry; USfakeIDs
nginx/1.30.411Archetype Market; Emils Instruments; RagnarLocker; Ragnar_Locker; Vanir Group; archetyp; archetyp; archetyp; archetyp; hydra; ragnarlocker
nginx/1.18.09Black Basta; Dunghill Leak; Imperial Library; Mail2Tor; Malas; audit team; clop; contfr; leaknet
Apache/2.4.41 (Ubuntu)68Base; CryptoNet News; CryptoNet Recover; Lorenz; Snatch; TorMail
nginx/1.29.66embargo; embargo; embargo; embargo; embargo; embargo
Apache/2.4.52 (Ubuntu)5La Piovra; La Piovra Cartel; La Piovra Private; Medusa; l group
nginx/1.27.35embargo; embargo; embargo; embargo; embargo
nginx/1.31.63As an Onion V3 Service; Kaizushi Hosting; torch
Microsoft-IIS/10.03Everest; everest; nasir security
nginx/1.28.03waissbein; waissbein; weaxor
lighttpd/1.4.732AlphaVM; Alphv
OpenBSD httpd2Ablative Hosting; SporeStack
nginx/1.29.32CyberFear.com; MORPHEUS
FTGate2DARK LINK; satancd
nginx/1.28.3 (Ubuntu)2black x; crpx0
Google Frontend2Skimmer Shop; Virus Total
Apache/2.4.6 (CentOS) PHP/7.4.302Cuba; V is Vendetta
Apache/2.4.58 (Ubuntu)2SiegedSec; orion
nginx/1.24.02Mallox; rtm locker
sites.header_server 222 services fall into 23 groups that answer with an identical server banner.