222 services fall into 23 groups that answer with an identical server banner.
links_json is still empty, so no service has told us which other onions it references. The edges below are shared infrastructure instead: a hub is one exact Server banner, and the services hanging off it all answer with that identical version string, which usually means the same host or the same operator. The real reference graph replaces this once the collector harvests outbound links.
| Server banner | Services | Services in the group |
|---|---|---|
| nginx/1.26.3 | 40 | Metaencryptor team; abyss-data; abyss-data; abyss-data; abyss-data; abyss-data; abyss-data; abyss-data; abyss-data; abyss-data; abyss-data; abyss-data; abyss-data; abyss-data; abyss-data; abyss-data; abyss-data; abyss-data; ailock; ailock; ailock; ailock; ailock; ailock; ailock; ailock; ailock; ailock; ailock; ailock; ailock; ailock; ailock; ailock; ailock; ailock; ailock; ailock; ailock; metaencryptor |
| nginx/1.22.1 | 40 | Ahmia; RansomHouse; Sarcoma; crypto24; d1r; insomnia; kyber; m3rx; pear; pear; pear; pear; pear; pear; pear; pear; pear; pear; pear; pear; pear; prinz eugen; ransomhouse; ransomhouse; ransomhouse; ransomhouse; ransomhouse; ransomhouse; ransomhouse; ransomhouse; ransomhouse; ransomhouse; ransomhouse; ransomhouse; ransomhouse; ransomhouse; ransomhouse; ransomhouse; ransomhouse; scattered lapsus$ hunters |
| nginx/1.27.5 | 31 | Incransom; Lynx; Lynx; inc ransom; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; lynx; titan |
| nginx/1.18.0 (Ubuntu) | 21 | APT73 / BASHE; BrainCipher; INC Ransom; Medusa (2); Meow; NOKOYAWA; NOKOYAWA WallofShame; OnionLinkHub; VulMon; eraleign (apt73); eraleign (apt73); eraleign (apt73); eraleign (apt73); leaky pro; nitrogen; orova; probiv; t1erone; timc; wallstreet; wallstreet |
| nginx/1.30.2 | 21 | AccMarket; Bitpharma; Brainmagic; Cardshop; DCdutchconnectionUK; Dark Mixer; DrChronic; EasyCoin – Bitcoin Wallet and Mixer; EuroGuns; Hackers for hire; Mixabit; Mobile Store; OnionIdentityServices; OnionLinks; OnionLinks v3; Onionwallet; Pug’s Ultimate Dark Web Guide; Rent-A-Hacker; The Hidden Wiki; TomAndJerry; USfakeIDs |
| nginx/1.30.4 | 11 | Archetype Market; Emils Instruments; RagnarLocker; Ragnar_Locker; Vanir Group; archetyp; archetyp; archetyp; archetyp; hydra; ragnarlocker |
| nginx/1.18.0 | 9 | Black Basta; Dunghill Leak; Imperial Library; Mail2Tor; Malas; audit team; clop; contfr; leaknet |
| nginx/1.29.6 | 6 | embargo; embargo; embargo; embargo; embargo; embargo |
| Apache/2.4.41 (Ubuntu) | 6 | 8Base; CryptoNet News; CryptoNet Recover; Lorenz; Snatch; TorMail |
| nginx/1.27.3 | 5 | embargo; embargo; embargo; embargo; embargo |
| Apache/2.4.52 (Ubuntu) | 5 | La Piovra; La Piovra Cartel; La Piovra Private; Medusa; l group |
| Microsoft-IIS/10.0 | 3 | Everest; everest; nasir security |
| nginx/1.28.0 | 3 | waissbein; waissbein; weaxor |
| nginx/1.31.6 | 3 | As an Onion V3 Service; Kaizushi Hosting; torch |
| Google Frontend | 2 | Skimmer Shop; Virus Total |
| Apache/2.4.6 (CentOS) PHP/7.4.30 | 2 | Cuba; V is Vendetta |
| Apache/2.4.58 (Ubuntu) | 2 | SiegedSec; orion |
| nginx/1.24.0 | 2 | Mallox; rtm locker |
| nginx/1.28.3 (Ubuntu) | 2 | black x; crpx0 |
| FTGate | 2 | DARK LINK; satancd |
| lighttpd/1.4.73 | 2 | AlphaVM; Alphv |
| OpenBSD httpd | 2 | Ablative Hosting; SporeStack |
| nginx/1.29.3 | 2 | CyberFear.com; MORPHEUS |
sites.header_server