Measuring onion website discovery and Tor users' interests with honeypots

TL;DR

This study deploys honeypots to measure actual user engagement with onion websites, revealing behavioral interests and discovery patterns across different categories and languages, especially highlighting interest in CSAM content.

Contribution

Introduces a honeypot-based methodology to directly measure user engagement and discovery of onion sites, focusing on behavioral interests rather than popularity metrics.

Findings

Most users originate from Ahmia.fi search engine.

Removing honeypot links from search results drastically reduces visits.

Higher engagement observed on CSAM-themed honeypots.

Abstract

Tor enables anonymous web browsing and access to anonymous onion websites. Prior work has focused on crawling and content analysis rather than on what users actually try to access. Our honeypot approach measures engagement across onion-site categories, revealing behavioral interest rather than inferred popularity. In March--April 2025, we deployed honeypot onion websites and seeded neutral-looking links via three channels -- the Ahmia Tor search engine, Stronghold paste onion "paste" service, and pastebin.com -- to observe discovery and subsequent interaction events (CAPTCHA solves; registration/login attempts). We observe that, almost without exception, human users originate from Ahmia.fi; after removing the honeypot links from the Ahmia.fi search results, visits dropped to nearly zero and no users solved CAPTCHAs. The honeypot landing front pages represent different forums for cybercrime activities -- child sexual abuse, violence, malware, stolen goods, illegal firearms, illegal drugs, and forgery items -- and, as a baseline comparison, an unclear forum. Within that set, the CSAM-themed honeypot drew markedly higher engagement than the other honeypots. When identical sites were offered in multiple languages, interaction events occurred most often on the English-language versions.