Measuring onion website discovery and Tor users' interests with honeypots
Arttu Paju, Waris Abdullah, and Juha Nurmi

TL;DR
This study deploys honeypots to measure actual user engagement with onion websites, revealing behavioral interests and discovery patterns across different categories and languages, especially highlighting interest in CSAM content.
Contribution
Introduces a honeypot-based methodology to directly measure user engagement and discovery of onion sites, focusing on behavioral interests rather than popularity metrics.
Findings
Most users originate from Ahmia.fi search engine.
Removing honeypot links from search results drastically reduces visits.
Higher engagement observed on CSAM-themed honeypots.
Abstract
Tor enables anonymous web browsing and access to anonymous onion websites. Prior work has focused on crawling and content analysis rather than on what users actually try to access. Our honeypot approach measures engagement across onion-site categories, revealing behavioral interest rather than inferred popularity. In March--April 2025, we deployed honeypot onion websites and seeded neutral-looking links via three channels -- the Ahmia Tor search engine, Stronghold paste onion "paste" service, and pastebin.com -- to observe discovery and subsequent interaction events (CAPTCHA solves; registration/login attempts). We observe that, almost without exception, human users originate from Ahmia.fi; after removing the honeypot links from the Ahmia.fi search results, visits dropped to nearly zero and no users solved CAPTCHAs. The honeypot landing front pages represent different forums for…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsAuthorship Attribution and Profiling · Cybercrime and Law Enforcement Studies · Spam and Phishing Detection
