THUGS(red) DarkWeb/Monitor_

Statistics

What the monitor sees

Nine views of the same collection: where the services sit, whether they answer, what runs them, and what stops us getting through. Everything below is measured, not modelled — and where a measurement does not exist yet, the panel says so instead of drawing a plausible line.

Tracked 3,455 15 categories
Reachable 577 17% of the board
Blocked 29 answered 403
Broken 21 answered, but not with the site
Dark 2,828 82% of the board
Sweep lag 1h oldest measurement on the board
Checked 24h 3,455 100% of the board
Screenshots 713 captures on file
Reachability flow Open CSV

Every tracked service, flowing from its category through the reachability state we last measured to the HTTP class it answered with.

Reachability flow — Services by category, reachability state and HTTP response class.
CategoryStateHTTP classServices
RansomwareDeadNo reply2618
RansomwareAliveHTTP 2xx376
Dark Web MarketDeadNo reply126
Dark Web MarketAliveHTTP 2xx87
Search EngineAliveHTTP 2xx34
Hacking CommunityDeadNo reply27
RansomwareBlockedHTTP 40321
Hacking CommunityAliveHTTP 2xx19
Email ProviderAliveHTTP 2xx13
Email ProviderDeadNo reply12
HostingDeadNo reply10
WikiAliveHTTP 2xx9
HostingAliveHTTP 2xx8
RansomwareBrokenHTTP 4048
Search EngineDeadNo reply8
VPN ProviderAliveHTTP 2xx8
CryptocurrencyAliveHTTP 2xx7
Hacker GroupDeadNo reply7
UnknownAliveHTTP 2xx6
CryptocurrencyDeadNo reply5
Security NewsAliveHTTP 2xx5
Hacking NewsAliveHTTP 2xx4
Security NewsDeadNo reply4
UnknownDeadNo reply4
WikiDeadNo reply4
RansomwareBrokenHTTP 5xx3
Hacking CommunityBlockedHTTP 4032
Hacking NewsDeadNo reply2
Dark Web MarketBrokenHTTP 5xx2
Search EngineBrokenHTTP 5xx2
VPN ProviderBlockedHTTP 4032
Email ProviderBrokenHTTP 4041
Email ProviderBrokenHTTP 5xx1
Hacker GroupAliveHTTP 2xx1
Hacking NewsBlockedHTTP 4031
Dark Web MarketBlockedHTTP 4031
Search EngineBlockedHTTP 4031
Search EngineBrokenHTTP 4xx1
Security NewsBrokenHTTP 4041
Social MediaBlockedHTTP 4031
Social MediaBrokenHTTP 5xx1
Social MediaDeadNo reply1
WikiBrokenHTTP 5xx1
sites 3455 services across 14 categories: 577 reachable, 50 answering with something other than the site, 2828 dark.
Reachability now Open CSV

The current state of the board, broken down by category.

Reachability now — Reachability state of every tracked service, by category.
CategoryAliveBlockedBrokenDeadWaitingTotal
Ransomware3762111261803026
Dark Web Market87121260216
Hacking Community192027048
Search Engine34138046
Email Provider130212027
Hosting80010018
Wiki9014014
Cryptocurrency7005012
Security News5014010
Unknown6004010
VPN Provider8200010
Hacker Group100708
Hacking News410207
Social Media011103
sites 577 of 3455 tracked services answered on the last sweep - 17% of the board.
Protection Open CSV

What sits in front of the services: which vendor, and whether it stops us.

Protection — Protection layer in front of each service, and whether we still reach the service through it.
ProtectionServicesStill reachableNot reachable
Cloudflare34259
DDoS-Guard211
Captcha835
JS challenge440
Forbidden (403)23023
Rate limited202
Account or invite wall413
No protection detected33785432835
sites headers, cookies and page titles 77 of 3455 services sit behind a detectable protection layer, and 43 of those are unreachable because of it.
Uptime calendar partial data Open CSV

A year of daily reachability, one cell per day.

site_checks_daily has no rows yet, so this is not uptime: each cell counts the services whose most recent successful reach falls on that day. A true day-by-day uptime calendar starts accumulating from the next crawl, once the collector writes its check history.

Uptime calendar — Services by the day they were last successfully reached.
DayServices last reached
2025-08-291
2025-09-011
2025-09-081
2025-10-161
2025-10-191
2025-10-271
2025-11-091
2025-11-121
2025-11-151
2025-11-191
2025-11-201
2025-11-219
2025-11-291
2025-12-041
2025-12-091
2026-01-061
2026-01-071
2026-01-201
2026-02-091
2026-02-241
2026-03-021
2026-03-301
2026-04-061
2026-04-131
2026-05-091
2026-05-161
2026-06-161
2026-06-231
2026-07-091
2026-07-111
2026-07-231
2026-08-061
2026-08-071
2026-08-122
2026-08-132
2026-08-201
2026-08-21592
sites.last_alive Last successful reach for 638 services, spread over 37 days.
Collection growth Open CSV

Cumulative services under monitoring, stacked by category.

Collection growth — Cumulative services under monitoring at the end of each month, by category.
MonthRansomwareDark Web MarketHacking CommunitySearch EngineEmail ProviderHostingWikiCryptocurrencySecurity NewsUnknownVPN ProviderHacker GroupHacking NewsSocial MediaTotal
2023-0165500000000000070
2023-0265500000000000070
2023-0365500000000000070
2023-0465500000000000070
2023-0565500000000000070
2023-0665500000000000070
2023-078330200020000200119
2023-0813071223720181210919813351
2023-0913271223720181210919813353
2023-1013271223720181210919813353
2023-1113271243720181210919813355
2023-1213671243720181210919813359
2024-0113671253720181210919813360
2024-0213671253720181210919813360
2024-0313672253720181210919813361
2024-0413872253720181210919813363
2024-0513872253720181210919813363
2024-0613872253720181210919813363
2024-0715272253720181210919813377
2024-0815472253720181210919813379
2024-0915672253720181210919813381
2024-1015772253720181210919813382
2024-1115772253720181210919813382
2024-1215972253720181210919813384
2025-0115973253720181210919813385
2025-0215973253720181210919813385
2025-0315973253720181210919813385
2025-0416073253720181210919813386
2025-0516073253720181210919813386
2025-0616173253720181210919813387
2025-0716173253720181210919813387
2025-0816173253720181210919813387
2025-0916173253720181210919813387
2025-1016184314523181210101010873432
2025-1116184314523181210101010873432
2025-1216184314523181210101010873432
2026-0116387314623181312101010873441
2026-0216387314623181312101010873441
2026-0316387314623181312101010873441
2026-0416387314623181312101010873441
2026-0516387314623181312101010873441
2026-0616387314623181312101010873441
2026-0716387314623181312101010873441
2026-0830262164846271814121010108733455
sites.audit_added The collection grew from its first entry in 2023-01 to 3455 services by 2026-08.

Services added against services that went dark, week by week.

Churn — Reachability transitions per week, counted from the crawl history.
Week beginningRecoveriesWent darkNetRunning net
2025-08-250000
2025-09-010000
2025-09-080000
2025-09-150000
2025-09-220000
2025-09-290000
2025-10-060000
2025-10-130000
2025-10-200000
2025-10-270000
2025-11-030000
2025-11-100000
2025-11-170000
2025-11-240000
2025-12-010000
2025-12-080000
2025-12-150000
2025-12-220000
2025-12-290000
2026-01-050000
2026-01-120000
2026-01-190000
2026-01-260000
2026-02-020000
2026-02-090000
2026-02-160000
2026-02-230000
2026-03-020000
2026-03-090000
2026-03-160000
2026-03-230000
2026-03-300000
2026-04-060000
2026-04-130000
2026-04-200000
2026-04-270000
2026-05-040000
2026-05-110000
2026-05-180000
2026-05-250000
2026-06-010000
2026-06-080000
2026-06-150000
2026-06-220000
2026-06-290000
2026-07-060000
2026-07-130000
2026-07-200000
2026-07-270000
2026-08-030000
2026-08-100000
2026-08-1751351616
site_checks Over the last 52 weeks: recoveries 51, went dark 35, net +16.
Response timing Open CSV

How long the services take to answer, and how fresh each measurement is.

Response timing — Response time in milliseconds by category: minimum, lower quartile, median, upper quartile, maximum.
CategoryMeasuredMinQ1MedianQ3Max
Hacking Community46130673581138318586
Cryptocurrency71112326476565
Email Provider241734326361111291
Hacker Group4389386887611261812988
Hacking News79843479136906832
Hosting11113232552112152
Dark Web Market195142463991278560002
Ransomware301517656109821459660002
Search Engine4613117248414742
Security News101237412608110646
Social Media3228356068911652626160
Unknown103584666111039319599
VPN Provider10981322667283154
Wiki121384616172317214
sites.response_ms Median response across 3400 measured services is 10587 ms.
Technology Open CSV

Server family to framework, sized by the number of services running it.

Technology — Server family, framework and exact banner, by number of services.
Server familyFrameworkBannerServices
nginxno framework headernginx155
nginxno framework headernginx/1.24.0 (Ubuntu)80
unknownno framework headerunknown65
nginxno framework headernginx/1.26.339
nginxno framework headernginx/1.27.530
nginxno framework headernginx/1.22.126
nginxno framework headernginx/1.30.221
apacheno framework headerApache19
cloudflareno framework headercloudflare14
nginxno framework headernginx/1.30.411
nginxno framework headernginx/1.18.0 (Ubuntu)10
gunicornno framework headergunicorn10
nginxno framework headernginx/1.29.66
nginxno framework headernginx/1.18.05
nginxno framework headernginx/1.27.35
unknownExpressunknown5
cloudflareWordPresscloudflare5
openrestyno framework headeropenresty5
apacheUnknownApache4
openrestyMagentoopenresty4
nginxno framework headernginx/1.28.03
nginxXenForonginx3
cloudflareAngularJScloudflare3
envoyReactenvoy3
nginxNext.jsnginx2
nginxPrestaShopnginx2
nginxPHP 7.4nginx2
nginxWordPressnginx2
unknownMagentounknown2
apacheWordPressApache2
cloudflareNext.jscloudflare2
openrestyNuxtopenresty2
iisno framework headerMicrosoft-IIS/10.02
nginxno framework headernginx/1.26.3 (Ubuntu)1
nginxno framework headernginx/1.31.31
nginxno framework headernginx/1.9.21
nginxno framework headernginx/1.29.31
nginxno framework headernginx/1.28.3 (Ubuntu)1
nginxno framework headernginx/1.20.11
nginxXenForonginx/1.31.31
nginxXenForonginx/1.18.0 (Ubuntu)1
nginxNext.jsnginx/1.27.51
nginxNext.jsnginx/1.31.11
nginxPrestaShopnginx/1.18.0 (Ubuntu)1
nginxPrestaShopnginx/1.24.0 (Ubuntu)1
nginxMagentonginx1
nginxMagentonginx/1.24.0 (Ubuntu)1
nginxdominant-color-imagesnginx1
nginxPowered by LayerSlider 7.14.4 - Build Heros, Sliders, and Ponginx1
nginxphpBBnginx/1.26.31
nginxDrupalnginx1
nginxReactnginx1
nginxPHP 8.3nginx1
nginxDiscourse 2026.8.0-latest.1 - https://github.com/discourse/dnginx1
nginxFlarumnginx1
nginxExpressnginx/1.22.11
nginxAngularnginx1
unknownno framework headerKalio1
unknownno framework headerLion Market Server1
unknownno framework headerOpenBSD httpd1
unknownno framework headerAkamaiGHost1
unknownno framework headerBaseHTTP/0.6 Python/3.12.31
unknownno framework headerhelix1
unknownno framework headerserver1
unknownWordPressFTGate1
unknownvBulletinunknown1
unknownAngularGlobaLeaks1
unknownPrestaShopAmazonS31
unknownGatsbyunknown1
unknownNext.jsVercel1
unknownVueSucuri/Cloudproxy1
unknownVirusTotalGoogle Frontend1
apacheno framework headerApache/2.4.38 (Debian)1
apacheno framework headerApache/2.4.68 (Debian)1
apacheno framework headerApache/2.4.65 (Debian)1
apacheno framework headerApache/2.4.66 (Debian)1
apacheno framework headerApache/2.4.58 (Ubuntu)1
apachePHP 8.2Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.121
apachePrestaShopApache1
apachePHP 8.5Apache1
apacheMSHTMLApache1
apacheDokuWikiApache1
apacheHugoApache/2.4.52 (Ubuntu)1
cloudflareCGcloudflare1
cloudflareMediaWikicloudflare1
cloudflarePrestaShopcloudflare1
cloudflareReactcloudflare1
cloudflarePHP 8.2cloudflare1
cloudflareXenForocloudflare1
cloudflareAll in One SEO Pro (AIOSEO)cloudflare1
cloudflareSite Kit by Googlecloudflare1
openrestyPrestaShopopenresty/1.25.3.11
iisPHP 8.2Microsoft-IIS/10.01
caddyno framework headerCaddy1
sites.tech_json 610 of 610 services report a server banner; nginx is the most common family.
Onion graph partial data Open CSV

How the services we watch relate to one another.

links_json is still empty, so no service has told us which other onions it references. The edges below are shared infrastructure instead: a hub is one exact Server banner, and the services hanging off it all answer with that identical version string, which usually means the same host or the same operator. The real reference graph replaces this once the collector harvests outbound links.

Onion graph — Services grouped by the exact Server banner they answer with.
Server bannerServicesServices in the group
nginx/1.26.340Money Message; Wigle; abyss-data; abyss-data; abyss-data; abyss-data; abyss-data; abyss-data; abyss-data; abyss-data; abyss-data; abyss-data; abyss-data; abyss-data; abyss-data; abyss-data; abyss-data; abyss-data; abyss-data; ailock; ailock; ailock; ailock; ailock; ailock; ailock; ailock; ailock; ailock; ailock; ailock; ailock; ailock; ailock; ailock; ailock; ailock; ailock; ailock; ailock
nginx/1.22.137Ahmia; RansomHouse; Sarcoma; crypto24; d1r; insomnia; kyber; m3rx; pear; pear; pear; pear; pear; pear; pear; pear; pear; pear; pear; prinz eugen; ransomhouse; ransomhouse; ransomhouse; ransomhouse; ransomhouse; ransomhouse; ransomhouse; ransomhouse; ransomhouse; ransomhouse; ransomhouse; ransomhouse; ransomhouse; ransomhouse; ransomhouse; ransomhouse; ransomhouse
nginx/1.27.531Incransom; Lynx; Lynx; inc ransom; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; titan
nginx/1.30.221AccMarket; Bitpharma; Brainmagic; Cardshop; DCdutchconnectionUK; Dark Mixer; DrChronic; EasyCoin – Bitcoin Wallet and Mixer; EuroGuns; Hackers for hire; Mixabit; Mobile Store; OnionIdentityServices; OnionLinks; OnionLinks v3; Onionwallet; Pug’s Ultimate Dark Web Guide; Rent-A-Hacker; The Hidden Wiki; TomAndJerry; USfakeIDs
nginx/1.18.0 (Ubuntu)19APT73 / BASHE; BrainCipher; INC Ransom; Medusa (2); Meow; NOKOYAWA; NOKOYAWA WallofShame; OnionLinkHub; eraleign (apt73); eraleign (apt73); eraleign (apt73); eraleign (apt73); leaky pro; orova; probiv; t1erone; timc; wallstreet; wallstreet
nginx/1.30.411Archetype Market; Emils Instruments; RagnarLocker; Ragnar_Locker; Vanir Group; archetyp; archetyp; archetyp; archetyp; hydra; ragnarlocker
nginx/1.18.09Black Basta; Dunghill Leak; Imperial Library; Mail2Tor; Malas; audit team; clop; contfr; leaknet
Apache/2.4.41 (Ubuntu)68Base; CryptoNet News; CryptoNet Recover; Lorenz; Snatch; TorMail
nginx/1.29.66embargo; embargo; embargo; embargo; embargo; embargo
Apache/2.4.52 (Ubuntu)5La Piovra; La Piovra Cartel; La Piovra Private; Medusa; l group
nginx/1.27.35embargo; embargo; embargo; embargo; embargo
nginx/1.31.33As an Onion V3 Service; Kaizushi Hosting; torch
nginx/1.28.03waissbein; waissbein; weaxor
Microsoft-IIS/10.03Everest; everest; nasir security
nginx/1.24.02Mallox; rtm locker
FTGate2DARK LINK; satancd
Apache/2.4.6 (CentOS) PHP/7.4.302Cuba; V is Vendetta
nginx/1.29.32CyberFear.com; MORPHEUS
lighttpd/1.4.732AlphaVM; Alphv
Parking/1.02ATM Skimmer Shop; Atm Skimmers
Apache/2.4.58 (Ubuntu)2SiegedSec; orion
Google Frontend2Skimmer Shop; Virus Total
sites.header_server 215 services fall into 22 groups that answer with an identical server banner.