THUGS(red) DarkWeb/Monitor_

Statistics

What the monitor sees

Nine views of the same collection: where the services sit, whether they answer, what runs them, and what stops us getting through. Everything below is measured, not modelled — and where a measurement does not exist yet, the panel says so instead of drawing a plausible line.

Tracked 3,455 15 categories
Reachable 435 13% of the board
Blocked 30 answered 403
Broken 32 answered, but not with the site
Dark 2,958 86% of the board
Sweep lag 3h oldest measurement on the board
Checked 24h 3,455 100% of the board
Screenshots 743 captures on file
Reachability flow Open CSV

Every tracked service, flowing from its category through the reachability state we last measured to the HTTP class it answered with.

Reachability flow — Services by category, reachability state and HTTP response class.
CategoryStateHTTP classServices
RansomwareDeadNo reply2713
RansomwareAliveHTTP 2xx274
Dark Web MarketDeadNo reply144
Dark Web MarketAliveHTTP 2xx62
Hacking CommunityDeadNo reply32
Search EngineAliveHTTP 2xx29
RansomwareBrokenHTTP 40419
RansomwareBlockedHTTP 40318
Hacking CommunityAliveHTTP 2xx15
Email ProviderAliveHTTP 2xx14
HostingDeadNo reply13
Email ProviderDeadNo reply12
Search EngineDeadNo reply12
WikiAliveHTTP 2xx9
Hacker GroupDeadNo reply8
CryptocurrencyAliveHTTP 2xx7
Dark Web MarketBlockedHTTP 4036
UnknownDeadNo reply6
VPN ProviderAliveHTTP 2xx6
CryptocurrencyDeadNo reply5
Hacking NewsAliveHTTP 2xx5
HostingAliveHTTP 2xx5
Security NewsAliveHTTP 2xx5
WikiDeadNo reply5
UnknownAliveHTTP 2xx4
Dark Web MarketBrokenHTTP 5xx3
Security NewsDeadNo reply3
Hacking NewsDeadNo reply2
RansomwareBrokenHTTP 5xx2
Search EngineBlockedHTTP 4032
Search EngineBrokenHTTP 5xx2
VPN ProviderBlockedHTTP 4032
VPN ProviderDeadNo reply2
Hacking CommunityBlockedHTTP 4031
Email ProviderBrokenHTTP 4041
Dark Web MarketBrokenHTTP 4xx1
Search EngineBrokenHTTP 4xx1
Security NewsBrokenHTTP 4041
Security NewsBrokenHTTP 5xx1
Social MediaBlockedHTTP 4031
Social MediaBrokenHTTP 5xx1
Social MediaDeadNo reply1
sites 3455 services across 14 categories: 435 reachable, 62 answering with something other than the site, 2958 dark.
Reachability now Open CSV

The current state of the board, broken down by category.

Reachability now — Reachability state of every tracked service, by category.
CategoryAliveBlockedBrokenDeadWaitingTotal
Ransomware2741821271303026
Dark Web Market62641440216
Hacking Community151032048
Search Engine292312046
Email Provider140112027
Hosting50013018
Wiki9005014
Cryptocurrency7005012
Security News5023010
Unknown4006010
VPN Provider6202010
Hacker Group000808
Hacking News500207
Social Media011103
sites 435 of 3455 tracked services answered on the last sweep - 13% of the board.
Protection Open CSV

What sits in front of the services: which vendor, and whether it stops us.

Protection — Protection layer in front of each service, and whether we still reach the service through it.
ProtectionServicesStill reachableNot reachable
Cloudflare342113
DDoS-Guard101
Captcha808
JS challenge523
Forbidden (403)21021
Rate limited404
Account or invite wall413
No protection detected33784112967
sites headers, cookies and page titles 77 of 3455 services sit behind a detectable protection layer, and 53 of those are unreachable because of it.
Uptime calendar partial data Open CSV

A year of daily reachability, one cell per day.

site_checks_daily has no rows yet, so this is not uptime: each cell counts the services whose most recent successful reach falls on that day. A true day-by-day uptime calendar starts accumulating from the next crawl, once the collector writes its check history.

Uptime calendar — Services by the day they were last successfully reached.
DayServices last reached
2025-10-191
2025-10-271
2025-11-091
2025-11-121
2025-11-191
2025-11-201
2025-11-219
2025-11-291
2025-12-041
2025-12-091
2026-01-061
2026-01-071
2026-01-201
2026-02-091
2026-02-241
2026-03-021
2026-03-301
2026-04-061
2026-04-131
2026-05-091
2026-05-161
2026-06-161
2026-06-231
2026-07-091
2026-07-111
2026-08-121
2026-08-132
2026-08-224
2026-08-251
2026-08-263
2026-08-291
2026-09-021
2026-09-042
2026-09-051
2026-09-061
2026-09-081
2026-09-092
2026-09-112
2026-09-123
2026-09-131
2026-09-146
2026-09-161
2026-09-171
2026-09-181
2026-09-191
2026-09-221
2026-09-241
2026-09-271
2026-09-282
2026-09-294
2026-10-021
2026-10-032
2026-10-041
2026-10-0628
2026-10-084
2026-10-092
2026-10-101
2026-10-112
2026-10-129
2026-10-1325
2026-10-14512
sites.last_alive Last successful reach for 665 services, spread over 61 days.
Collection growth Open CSV

Cumulative services under monitoring, stacked by category.

Collection growth — Cumulative services under monitoring at the end of each month, by category.
MonthRansomwareDark Web MarketHacking CommunitySearch EngineEmail ProviderHostingWikiCryptocurrencySecurity NewsUnknownVPN ProviderHacker GroupHacking NewsSocial MediaTotal
2023-0165500000000000070
2023-0265500000000000070
2023-0365500000000000070
2023-0465500000000000070
2023-0565500000000000070
2023-0665500000000000070
2023-078330200020000200119
2023-0813071223720181210919813351
2023-0913271223720181210919813353
2023-1013271223720181210919813353
2023-1113271243720181210919813355
2023-1213671243720181210919813359
2024-0113671253720181210919813360
2024-0213671253720181210919813360
2024-0313672253720181210919813361
2024-0413872253720181210919813363
2024-0513872253720181210919813363
2024-0613872253720181210919813363
2024-0715272253720181210919813377
2024-0815472253720181210919813379
2024-0915672253720181210919813381
2024-1015772253720181210919813382
2024-1115772253720181210919813382
2024-1215972253720181210919813384
2025-0115973253720181210919813385
2025-0215973253720181210919813385
2025-0315973253720181210919813385
2025-0416073253720181210919813386
2025-0516073253720181210919813386
2025-0616173253720181210919813387
2025-0716173253720181210919813387
2025-0816173253720181210919813387
2025-0916173253720181210919813387
2025-1016184314523181210101010873432
2025-1116184314523181210101010873432
2025-1216184314523181210101010873432
2026-0116387314623181312101010873441
2026-0216387314623181312101010873441
2026-0316387314623181312101010873441
2026-0416387314623181312101010873441
2026-0516387314623181312101010873441
2026-0616387314623181312101010873441
2026-0716387314623181312101010873441
2026-0830262164846271814121010108733455
2026-0930262164846271814121010108733455
2026-1030262164846271814121010108733455
sites.audit_added The collection grew from its first entry in 2023-01 to 3455 services by 2026-10.

Services added against services that went dark, week by week.

Churn — Reachability transitions per week, counted from the crawl history.
Week beginningRecoveriesWent darkNetRunning net
2025-10-200000
2025-10-270000
2025-11-030000
2025-11-100000
2025-11-170000
2025-11-240000
2025-12-010000
2025-12-080000
2025-12-150000
2025-12-220000
2025-12-290000
2026-01-050000
2026-01-120000
2026-01-190000
2026-01-260000
2026-02-020000
2026-02-090000
2026-02-160000
2026-02-230000
2026-03-020000
2026-03-090000
2026-03-160000
2026-03-230000
2026-03-300000
2026-04-060000
2026-04-130000
2026-04-200000
2026-04-270000
2026-05-040000
2026-05-110000
2026-05-180000
2026-05-250000
2026-06-010000
2026-06-080000
2026-06-150000
2026-06-220000
2026-06-290000
2026-07-060000
2026-07-130000
2026-07-200000
2026-07-270000
2026-08-030000
2026-08-100000
2026-08-17678702-24-24
2026-08-241930190822-2
2026-08-3124312445-14-16
2026-09-0725272567-40-56
2026-09-142833279142-14
2026-09-21254325385-9
2026-09-2824572471-14-23
2026-10-0524792546-67-90
2026-10-12961995-34-124
site_checks Over the last 52 weeks: recoveries 18839, went dark 18963, net -124.
Response timing Open CSV

How long the services take to answer, and how fresh each measurement is.

Response timing — Response time in milliseconds by category: minimum, lower quartile, median, upper quartile, maximum.
CategoryMeasuredMinQ1MedianQ3Max
Hacking Community461855104466000060002
Cryptocurrency9111169748
Email Provider211815931197960002
Hacker Group46000060001600016000160001
Hacking News7246461641720834304
Hosting121166791944660001
Dark Web Market1961690105136000066722
Ransomware301219405259206000177560
Search Engine44157200128160002
Security News1055199768912460001
Social Media321911091219633029438625
Unknown10156692735521160002
VPN Provider1011032311071960002
Wiki121155396106337202
sites.response_ms Median response across 3396 measured services is 21250 ms.
Technology Open CSV

Server family to framework, sized by the number of services running it.

Technology — Server family, framework and exact banner, by number of services.
Server familyFrameworkBannerServices
nginxno framework headernginx171
nginxno framework headernginx/1.24.0 (Ubuntu)81
unknownno framework headerunknown74
nginxno framework headernginx/1.26.338
nginxno framework headernginx/1.27.530
nginxno framework headernginx/1.22.128
apacheno framework headerApache22
nginxno framework headernginx/1.30.221
cloudflareno framework headercloudflare14
nginxno framework headernginx/1.18.0 (Ubuntu)12
gunicornno framework headergunicorn11
openrestyno framework headeropenresty9
nginxno framework headernginx/1.29.66
nginxno framework headernginx/1.27.35
nginxno framework headernginx/1.18.05
unknownExpressunknown5
openrestyMagentoopenresty5
apacheUnknownApache4
cloudflareWordPresscloudflare4
nginxXenForonginx3
nginxPrestaShopnginx3
nginxno framework headernginx/1.28.02
nginxno framework headernginx/1.30.52
nginxno framework headernginx/1.28.3 (Ubuntu)2
nginxno framework headernginx/1.29.32
nginxWordPressnginx2
unknownno framework headerOpenBSD httpd2
unknownMagentounknown2
apacheno framework headerApache/2.4.58 (Ubuntu)2
apacheWordPressApache2
cloudflareAngularJScloudflare2
cloudflareNext.jscloudflare2
cloudflareSite Kit by Googlecloudflare2
iisno framework headerMicrosoft-IIS/10.02
nginxno framework headernginx/1.9.21
nginxno framework headernginx/1.31.61
nginxno framework headernginx/1.20.11
nginxno framework headernginx/1.30.41
nginxno framework headernginx/1.26.3 (Ubuntu)1
nginxXenForonginx/1.18.0 (Ubuntu)1
nginxXenForonginx/1.31.61
nginxPrestaShopnginx/1.18.0 (Ubuntu)1
nginxWordPressnginx/1.22.11
nginxNext.jsnginx/1.27.51
nginxNext.jsnginx/1.31.11
nginxNext.jsnginx1
nginxExpressnginx1
nginxExpressnginx/1.22.11
nginxMagentonginx1
nginxMagentonginx/1.24.0 (Ubuntu)1
nginxPHP 8.5nginx/1.31.61
nginxDrupalnginx1
nginxAngularnginx1
nginxPHP 7.4nginx1
nginxDiscourse 2026.10.0-latest - https://github.com/discourse/dinginx1
nginxdominant-color-imagesnginx1
nginxFlarumnginx1
nginxReactnginx1
nginxPHP 8.3nginx1
nginxPowered by LayerSlider 7.14.4 - Build Heros, Sliders, and Ponginx1
nginxphpBBnginx/1.30.31
unknownno framework headerLion Market Server1
unknownno framework headerserver1
unknownno framework headerKalio1
unknownno framework headerBIG-IP/16.1.01
unknownno framework headerhelix1
unknownno framework headerKestrel1
unknownno framework headerBaseHTTP/0.6 Python/3.12.31
unknownno framework headerAkamaiGHost1
unknownWordPressFTGate1
unknownWordPressunknown1
unknownReactunknown1
unknownNext.jsVercel1
unknownvBulletinunknown1
unknownAngularGlobaLeaks1
unknownVueSucuri/Cloudproxy1
unknownVirusTotalGoogle Frontend1
unknownGatsbyunknown1
unknownPHP 8.3unknown1
unknownPrestaShopAmazonS31
apacheno framework headerApache/2.4.66 (Debian)1
apacheno framework headerApache/2.4.38 (Debian)1
apacheno framework headerApache/2.4.65 (Debian)1
apacheno framework headerApache/2.4.68 (Debian)1
apachePHP 8.2Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.121
apacheMSHTMLApache1
apacheHugoApache/2.4.52 (Ubuntu)1
apacheDokuWikiApache1
apachePrestaShopApache1
cloudflareReactcloudflare1
cloudflarePrestaShopcloudflare1
cloudflarePHP 8.2cloudflare1
cloudflareCGcloudflare1
cloudflareAll in One SEO Pro (AIOSEO)cloudflare1
cloudflareShopifycloudflare1
cloudflareXenForocloudflare1
cloudflareMediaWikicloudflare1
openrestyPrestaShopopenresty/1.25.3.11
iisPHP 8.2Microsoft-IIS/10.01
caddyno framework headerCaddy1
caddyno framework headerFrankenPHP Caddy1
sites.tech_json 644 of 644 services report a server banner; nginx is the most common family.
Onion graph partial data Open CSV

How the services we watch relate to one another.

links_json is still empty, so no service has told us which other onions it references. The edges below are shared infrastructure instead: a hub is one exact Server banner, and the services hanging off it all answer with that identical version string, which usually means the same host or the same operator. The real reference graph replaces this once the collector harvests outbound links.

Onion graph — Services grouped by the exact Server banner they answer with.
Server bannerServicesServices in the group
nginx/1.22.141Ahmia; RansomHouse; Sarcoma; crypto24; d1r; insomnia; kyber; m3rx; metaencryptor; pear; pear; pear; pear; pear; pear; pear; pear; pear; pear; pear; pear; pear; prinz eugen; ransomhouse; ransomhouse; ransomhouse; ransomhouse; ransomhouse; ransomhouse; ransomhouse; ransomhouse; ransomhouse; ransomhouse; ransomhouse; ransomhouse; ransomhouse; ransomhouse; ransomhouse; ransomhouse; ransomhouse; scattered lapsus$ hunters
nginx/1.26.339Metaencryptor team; abyss-data; abyss-data; abyss-data; abyss-data; abyss-data; abyss-data; abyss-data; abyss-data; abyss-data; abyss-data; abyss-data; abyss-data; abyss-data; abyss-data; abyss-data; abyss-data; abyss-data; ailock; ailock; ailock; ailock; ailock; ailock; ailock; ailock; ailock; ailock; ailock; ailock; ailock; ailock; ailock; ailock; ailock; ailock; ailock; ailock; ailock
nginx/1.27.531Incransom; Lynx; Lynx; inc ransom; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; titan
nginx/1.30.221AccMarket; Bitpharma; Brainmagic; Cardshop; DCdutchconnectionUK; Dark Mixer; DrChronic; EasyCoin – Bitcoin Wallet and Mixer; EuroGuns; Hackers for hire; Mixabit; Mobile Store; OnionIdentityServices; OnionLinks; OnionLinks v3; Onionwallet; Pug’s Ultimate Dark Web Guide; Rent-A-Hacker; The Hidden Wiki; TomAndJerry; USfakeIDs
nginx/1.18.0 (Ubuntu)21APT73 / BASHE; BrainCipher; INC Ransom; Medusa (2); Meow; NOKOYAWA; NOKOYAWA WallofShame; OnionLinkHub; VulMon; eraleign (apt73); eraleign (apt73); eraleign (apt73); eraleign (apt73); leaky pro; nitrogen; orova; probiv; t1erone; timc; wallstreet; wallstreet
nginx/1.30.411Archetype Market; Emils Instruments; RagnarLocker; Ragnar_Locker; Vanir Group; archetyp; archetyp; archetyp; archetyp; hydra; ragnarlocker
nginx/1.18.09Black Basta; Dunghill Leak; Imperial Library; Mail2Tor; Malas; audit team; clop; contfr; leaknet
nginx/1.29.66embargo; embargo; embargo; embargo; embargo; embargo
Apache/2.4.41 (Ubuntu)68Base; CryptoNet News; CryptoNet Recover; Lorenz; Snatch; TorMail
nginx/1.27.35embargo; embargo; embargo; embargo; embargo
Apache/2.4.52 (Ubuntu)5La Piovra; La Piovra Cartel; La Piovra Private; Medusa; l group
nginx/1.31.63As an Onion V3 Service; Kaizushi Hosting; torch
nginx/1.28.03waissbein; waissbein; weaxor
Microsoft-IIS/10.03Everest; everest; nasir security
Apache/2.4.58 (Ubuntu)2SiegedSec; orion
FTGate2DARK LINK; satancd
Google Frontend2Skimmer Shop; Virus Total
nginx/1.24.02Mallox; rtm locker
Apache/2.4.6 (CentOS) PHP/7.4.302Cuba; V is Vendetta
nginx/1.30.52payload; payload
lighttpd/1.4.732AlphaVM; Alphv
nginx/1.28.3 (Ubuntu)2black x; crpx0
OpenBSD httpd2Ablative Hosting; SporeStack
nginx/1.29.32CyberFear.com; MORPHEUS
sites.header_server 224 services fall into 24 groups that answer with an identical server banner.