215 services fall into 22 groups that answer with an identical server banner.
links_json is still empty, so no service has told us which other onions it references. The edges below are shared infrastructure instead: a hub is one exact Server banner, and the services hanging off it all answer with that identical version string, which usually means the same host or the same operator. The real reference graph replaces this once the collector harvests outbound links.
| Server banner | Services | Services in the group |
|---|---|---|
| nginx/1.26.3 | 40 | Money Message; Wigle; abyss-data; abyss-data; abyss-data; abyss-data; abyss-data; abyss-data; abyss-data; abyss-data; abyss-data; abyss-data; abyss-data; abyss-data; abyss-data; abyss-data; abyss-data; abyss-data; abyss-data; ailock; ailock; ailock; ailock; ailock; ailock; ailock; ailock; ailock; ailock; ailock; ailock; ailock; ailock; ailock; ailock; ailock; ailock; ailock; ailock; ailock |
| nginx/1.22.1 | 37 | Ahmia; RansomHouse; Sarcoma; crypto24; d1r; insomnia; kyber; m3rx; pear; pear; pear; pear; pear; pear; pear; pear; pear; pear; pear; prinz eugen; ransomhouse; ransomhouse; ransomhouse; ransomhouse; ransomhouse; ransomhouse; ransomhouse; ransomhouse; ransomhouse; ransomhouse; ransomhouse; ransomhouse; ransomhouse; ransomhouse; ransomhouse; ransomhouse; ransomhouse |
| nginx/1.27.5 | 31 | Incransom; Lynx; Lynx; inc ransom; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; titan |
| nginx/1.30.2 | 21 | AccMarket; Bitpharma; Brainmagic; Cardshop; DCdutchconnectionUK; Dark Mixer; DrChronic; EasyCoin – Bitcoin Wallet and Mixer; EuroGuns; Hackers for hire; Mixabit; Mobile Store; OnionIdentityServices; OnionLinks; OnionLinks v3; Onionwallet; Pug’s Ultimate Dark Web Guide; Rent-A-Hacker; The Hidden Wiki; TomAndJerry; USfakeIDs |
| nginx/1.18.0 (Ubuntu) | 19 | APT73 / BASHE; BrainCipher; INC Ransom; Medusa (2); Meow; NOKOYAWA; NOKOYAWA WallofShame; OnionLinkHub; eraleign (apt73); eraleign (apt73); eraleign (apt73); eraleign (apt73); leaky pro; orova; probiv; t1erone; timc; wallstreet; wallstreet |
| nginx/1.30.4 | 11 | Archetype Market; Emils Instruments; RagnarLocker; Ragnar_Locker; Vanir Group; archetyp; archetyp; archetyp; archetyp; hydra; ragnarlocker |
| nginx/1.18.0 | 9 | Black Basta; Dunghill Leak; Imperial Library; Mail2Tor; Malas; audit team; clop; contfr; leaknet |
| nginx/1.29.6 | 6 | embargo; embargo; embargo; embargo; embargo; embargo |
| Apache/2.4.41 (Ubuntu) | 6 | 8Base; CryptoNet News; CryptoNet Recover; Lorenz; Snatch; TorMail |
| nginx/1.27.3 | 5 | embargo; embargo; embargo; embargo; embargo |
| Apache/2.4.52 (Ubuntu) | 5 | La Piovra; La Piovra Cartel; La Piovra Private; Medusa; l group |
| Microsoft-IIS/10.0 | 3 | Everest; everest; nasir security |
| nginx/1.31.3 | 3 | As an Onion V3 Service; Kaizushi Hosting; torch |
| nginx/1.28.0 | 3 | waissbein; waissbein; weaxor |
| Apache/2.4.58 (Ubuntu) | 2 | SiegedSec; orion |
| nginx/1.24.0 | 2 | Mallox; rtm locker |
| FTGate | 2 | DARK LINK; satancd |
| Apache/2.4.6 (CentOS) PHP/7.4.30 | 2 | Cuba; V is Vendetta |
| nginx/1.29.3 | 2 | CyberFear.com; MORPHEUS |
| lighttpd/1.4.73 | 2 | AlphaVM; Alphv |
| Parking/1.0 | 2 | ATM Skimmer Shop; Atm Skimmers |
| Google Frontend | 2 | Skimmer Shop; Virus Total |
sites.header_server