The dark web in numbers

figures as at 28 January 2021

The dark web attracts a good deal of fantasy, because of the kind of content found there. The public has little objective information about its actual scope.

This publication, based on data collected by Aleph Search Dark since October 2014, sets out to give some volumetric grounding for understanding the dark web. To keep things simple, we deal here with the Tor network (.onion sites), which makes up the largest part of what we call the dark web. Less well-known networks such as I2P and Freenet are not included in the figures below.

The dark web: a small perimeter

Contrary to its image as an elusive, sprawling creature, the dark web is a relatively small perimeter. In December 2020 we counted ‘only’ 76,300 active sites — sites that could actually be reached.

Once you account for mirroring*, the practice of creating copies of a site at different addresses, the dark web comes down to 18,000 sites. Some sites are replicated in very large numbers of copies, or ‘mirrors’.

One site offering to multiply your bitcoin by 200 had been ‘cloned’ across more than 5,000 different addresses. Adding up all the mirrors of the sites that each have more than 100 mirrors gives a total of 54,000 domains.

We can therefore consider that 70% of the total mass of active onion domains today consists of mirrors of just 62 sites.
* This subject will be covered in a dedicated article.

Mass mirroring, a practice that intensified with the Covid-19 pandemic

Mass mirroring appears to have intensified around the Covid-19 pandemic.

The chart opposite shows new sites detected by Aleph Search Dark between December 2017 and December 2020.

Between 1 March and 1 July 2020, several tens of thousands of new domains were detected.

There is even a marked peak during the last week of May 2020, with 5,650 domains detected. The overwhelming majority are mirrors of sites offering financial operations of, to put it mildly, dubious character.

The table below gives the names of the ten most duplicated sites and the number of mirrors created over that four-month period.

Home page screenshots of the 10 most duplicated sites

Home page screenshots of the 10 most duplicated dark web sites

Sites live briefly

These very numerous mirrors, whose purpose remains to be established, will most likely have vanished within a few months, possibly replaced by others.

One characteristic of the dark web is indeed its volatility: sites have a very short average lifespan. Taking the domains active today, that average is only nine months. Looking at the 300,000 onion domains detected by Aleph Search Dark since October 2014, average longevity drops to seven and a half months.

This short average lifespan should not obscure the longevity of certain sites created before our search engine went into service. The chart opposite shows the distribution by ‘average age’ of onion sites active today.

Among the oldest active sites, we can cite as examples.

Screenshots of the oldest active sites

Oldest active sites

Languages on the dark web

Finally, a few points on the language communities present on the dark web.

Unsurprisingly, the overwhelming majority of onion sites are English-speaking. English is the language of choice as soon as a site targets an international audience.

Setting mirrors aside and considering only the 18,000 unique sites, the most represented language communities beyond English break down as follows:

Some 3,000 sites are of undetermined language, most often because the content cannot be tied to one — raw data leak files, for instance.