Dark web – the 2022 figures

A year ago we drew up our first quantitative picture of the Tor network from the figures available. As the year begins, we return to that study to bring out how the network changed over 2021. The perimeter of onion sites has seen radical changes, mainly because technical support for V2 addresses ended.

This article covers the dark web in four parts:

1. The transition from V2 to V3 addresses
2. The Tor network in numbers, January 2022
3. How long sites live
4. The Tor network and language communities

1. The transition from V2 to V3 addresses

Since January 2018, a new version of Tor has allowed domains to be created with a name format that strengthens security. This new format, commonly called V3 addresses, is easy to spot: unlike the old 16-character V2 addresses, V3 addresses run to 56 characters, still with the onion extension.

Then, in July 2020, the decision to end technical support for V2 addresses was announced, with the cut-off set for 15 October 2021.

Announcement of the end of support for V2 addresses

In the meantime, reminders of that deadline were put in place. Anyone visiting a V2 site through the Tor Browser was systematically told, by a warning message, that support was about to end.

Warning that support for V2 addresses was about to end

In practice, V2 domains remained viewable until Tor Browser 11.0 was released in early November 2021. At that date we recorded a total of 110,000 active Tor domains, of which 60,000 were V2 addresses. More than half of all onion sites therefore became unreachable for ordinary users of the network.

As the chart below shows, the creation of V3 sites was very marginal until the end of V2 support was announced.

Detection of V3 sites from 2019 to 2022

Since the announcement, new domains have mostly been created with V3 addresses. We were nonetheless somewhat surprised to find that some persisted in creating domains in the old format right up to November 2021. More surprising still, among those latecomers was the site of a ransomware operator team — a team, one imagines, more up to date on extortion methods than on Tor network news.

The V2 to V3 transition therefore reshuffled the existing landscape deeply, since many sites have not (yet) migrated to the new version and can be considered lost. These figures point to a transition that has not, however, changed certain practices and trends.

2. The Tor network in numbers, January 2022

The total mass of active Tor domains in January 2022 is 53,000, against 76,000 a year ago. These figures show the total mass reached more than 115,000 active sites, V2 and V3 combined, while both address formats were still valid — reflecting both the redundancy of newly created V3 sites and the fact that old V2 addresses stayed online.

Nor did the V2 to V3 transition put an end to mass mirroring, far from it. Although V2 mirrors became unreachable, mirror creation carries on more strongly than ever with V3. The previous chart shows, for instance, a peak in new site detections during the second week of May 2021. The 3,400 domains detected that week are mostly mirrors, since they are in reality 150 new domains, around twenty of which are replicated more than a hundred times each.

Finally, last year we found that the most duplicated sites were mostly dedicated to financial operations (carding, bitcoin manipulation and so on). This year the trend is the same — though three sites with more evocative names have joined the ranking.

The ten most replicated sites:

Home page screenshots of the ten most replicated sites

Setting mirrors aside, the total mass of active Tor sites in January 2022 comes to just 6,300. That is a very clear drop in the number of unique sites, given that we counted more than 18,000 in January 2021.

It is entirely likely, however, that we will return to volumes comparable to last year’s before long.

3. How long sites live

The V2 to V3 transition had no great impact on the average longevity of sites. The oldest sites (V2) are no longer among the active domains, but since the volume of old domains was already very small last year, the variation was negligible: average longevity is the same as in January 2021, namely nine months.

Distribution of active Tor domains by longevity

4. The Tor network and language communities

Unlike average longevity, the distribution of language communities has shifted significantly. English remains the hegemonic language on the Tor network — 82% of domains are English-speaking — but the other communities no longer come in the same order. French-language sites are the most represented this year, followed by Russian, German and Spanish.

Distribution of language communities on the Tor network, excluding English-language sites

Non-English sites account for only a tiny share of the total volume of active Tor domains. A significant number of domains also remain whose language cannot be determined, because of their content — raw data from leaks, code repositories and the like.

The dark web — the 2021 figures