In an earlier piece we found that around 70% of the active domains recorded on the dark web are in fact copies — mirrors — of some sixty sites. Here we return to the idea of mirror sites and try to explain this phenomenon of mass mirroring.
What is a mirror? Why create mirror sites?
A mirror is a copy of a site at a different address. For a clear web site, that can mean creating a copy on the dark web. The Berlin daily Die Tageszeitung (taz.de), for instance, has a Tor mirror (ibpj4qv7mufde33w.onion). Many dark web sites also have one or more mirrors on that same network.
Having one or more mirrors serves several purposes. It provides a backup copy, which can prove vital if the main site suffers a technical failure. It is also a useful measure against DDoS attacks. Seen this way, mirrors keep the service running when the original site is unavailable. A mirror can also spread the load if too many visits are slowing the main site down.
Screenshot of the Die Tageszeitung Tor mirror
How do you spot mirror sites?
Common practice is for each mirror to carry links to the others. The cannabis sales site HydroBull (now gone) had three mirrors, and displayed on each of its three home pages the three onion addresses of those mirrors — circled in red in the screenshot below.
With the Aleph Search Dark search engine, we can display domains as a graph. Each domain is a point. If site A contains a link to site B, the points representing them are joined. Plotting HydroBull’s three mirrors on a graph shows the three sites are indeed linked to one another.
What are the mirrors for?
Not every mirror on the dark web fits that pattern. Mirrors are frequently not linked to the original site by any hyperlink at all, which raises the question of what these ‘isolated’ mirrors are for. They still offer the benefit of a backup copy, certainly — but if the original site does not reference them, how are users supposed to know which fallback address to turn to when the main site goes down?
As we saw in an earlier publication, some sixty dark web sites each have more than 100 mirrors. Some are duplicated a few thousand times over. Plotting those sites and their mirrors on a graph shows that the vast majority of mirrors are not interconnected. The example below is Xonions, replicated 1,070 times.
We can see that 27 mirrors are connected — connected, not interconnected, since 26 mirrors reference one central site. None of these 27 sites was created during the massive wave of mirror creation in 2020. That wave, as a reminder, ran from March to July, tailing off until early September. Only four mirrors in this network were created after September 2020. All the others date from between 2015 and October 2019.
Graph of Xonions, replicated 1,070 times
A closer look at how mirror sites evolved
Most of the other mirrors — more than 800 — were created during the wave, and after it. The chart below shows detections of Xonions mirrors from January 2020 to June 2021, with the March–September 2020 period highlighted.
Growth in the number of Xonions mirrors
The same pattern repeats for many ‘multi-cloned’ sites. The mirrors are almost all isolated and the creation dates coincide, as we can see with Buy Real Money (1,613 mirrors) and Amazon Gift Cards (2,126 mirrors).
It is entirely plausible that this mass mirroring in 2020 was the work of a single person or a single community. The very strong similarity of the relationship patterns, and of how mirror creation was spread over time, points that way.
We can put forward a first hypothesis to explain both the proliferation of mirrors and the fact that they are not interconnected. It is possible that whoever created these sites wanted to saturate the dark web and gain greater visibility by doing so, without going to the trouble of listing every other mirror address on each mirror. This explanation strikes us as unlikely, however.
Coming in part two of this article on mirrors:
- The possible hypotheses
- How do you tell the real from the fake?