What to See on the Darkweb: A Travel Guide to Hidden Services

We got our hands on a database containing more than 8 000 links to the websites in darknet. It is practically one complete register of what is hidden in Tor Hidden Services. We’ve chosen the best!


WARNING


The authors and the editorial are not responsible for what you might encounter on the other side of the web. Darkweb is full of adult content, illegal products and services, all kinds of fraud, so be careful and keep your private data safe and don’t get into anything illegal.

A carders’ forum, a collection of photos depicting women crushing animals with their high heels, a mirror of Russian Counter-Strike forum, photos of women with their privates decorated with marijuana leaves and heads, someone’s trashy file storage with a bunch of books and complete collection of Hacker magazines, a gun owners forum, photographs of women urinating, an archive of books in Chinese, a topical message board on penis enlargement and of course drugs — of every possible kind, form and state of aggregation. So much and even more you can find just in ten minutes when exploring the dark side of the web.

INFO


Most links in this article lead to Tor hidden services. The easiest way to open them is to install Tor Browser.

It’s not an easy task to dig out something of value in this pile of trash. We used a script to check and sort the links and out of 8 000 webpages only 4300 actually opened. A thousand or so showed an authorization form straight away with no meaningful information whatsoever, so we just could not get any good of those. There was also plenty blank pages, pages with a default web server response and various mirrors, clones and placeholders. So even if we assume that some websites are not always up and therefore they did not make it into our list, all in all there are not so many working websites, maybe a couple thousands.

Using Tor from Python

Requesting pages from your own scripts though Tor is no more complicated than from clearnet. All you need for it is a local Tor node (just open TorBrowser), Python and SocksiPy library. Here is the script, that downloads the PirateBay main page through Tor and shows its contents. We are sure you’ll manage to do the same for anything else.

import socks, socket, urllib

url = "http://hss3uro2hsxfogfq.onion"

def create_connection(address, timeout=None, source_address=None):
    sock = socks.socksocket()
    sock.connect(address)
    return sock

socks.setdefaultproxy(socks.PROXY_TYPE_SOCKS5, "127.0.0.1", 9150, True)
socket.socket = socks.socksocket
socket.create_connection = create_connection

contents = urllib.urlopen(url).read()
print contents

So, what have we got? After the preliminary sorting we noticed that the topics are very few. There were mostly stores and trading platforms, that resemble forums or eBay-like auctions. Drugs, guns, fake documents, stolen things credit cards, exploits, botnets — it’s like some illegal flea market. We will look into it below.

К этой же категории можно отнести и сайты, где предлагают To the same category belong the pages offering all kinds of services, from bitcoin laundering to contract killing. And while the former sounds believable, the latter is likely a spoof. Fraudulent pages make the trading-oriented segment even larger.

Another huge segment is pornography. Anything, from extravagances such as described above to the usual kind, which is plentiful in the clearnet.

Actually quite a big part of dark web sites begs the question: why bother hiding it in the .onion? Libertarian blogs, hackers manifests, home pages… Sometimes you get the impression that someone just wanted to practice or show off by publishing their content in such a cool way. Such sites disappear one by one pretty quickly after their owners realize that having a server is costly but there’s no use to it.

Search and catalogues

After entering the alternative version of the internet, the first thing you want to get hold of is a search engine. No problem, choose your weapon: Torch, Grams, not Evil, Fess, Candle, Ahima and maybe a few more Googlings.

We won’t even try comparing the search quality of the above, we don’t have special metrics and procedures at our disposal, but here are some subjective comments. Grams’ results are full of spam, not Evil and Torch are not good at sorting the results: first lines might be taken by some garbage instead of the largest sites. It is not necessarily bad, since in the darknet the garbage can actually be of interest, but in the end of the day we prefer Fess.

Fess

Fess

The trick is that in the darknet a search engine similar to Google is not always the best and universal solution as usual. First, the most interesting things are hidden in forums, that usually require authorization, so the search engine is helpless here. Second, the websites are so few that the search engine is almost meaningless: different searches yield the same results plus some random unrelated trash. And by the way in the darknet search engines have almost no way to track and use users’ behavior via analogues of Google Analytics and AdWords to improve search quality.

This Google imposter looks just like the real thing, but is so much less fun

This Google imposter looks just like the real thing, but is so much less fun

In clearnet before the modern search engines were created this problem had been solved with classic useful links catalogues. In a sense, this article is the same thing, it is showcasing the websites that are of interest and are currently alive – the only difference being that we do not get paid for publishing the links.

The situation with popular catalogues is tough: in notable Hidden Wiki a great percent of the links do not work at all, while order and selection of the links rise serious questions to the owners of this page. There are also Onion URL Repository, OnionDir, Yet another Tor Directory, TorLinks, HD Wiki, russian «Godnotaba» and hundreds more, large and tiny, curated and not, published in darkweb and in clearnet.

«Godnotaba». There is a note saying that they stopped accepting new links due to some school troll’s harmful activity.

Yet another Tor Directory. The owners seem to love a little of anarchy now and then

Mail

Absolutely anonymous e-mail can be really useful and of course there are plenty of such services. Although its users pool is obviously quite specific: sending untraceable e-mails is good not only for hackers, spies, political dissidents and informants, but also for spamers, bot-owners and extortionists, who appreciate automation. This stipulates some major restrictions.

The most popular e-mail service hank works via Tor is called Sigaint. Its logo looks like an eye with three scary blood drops under it. “Bleeding from the eyes” is what you actually feel looking at this site, so the metaphor is legit. The interface seems to have arrived right from the 90’s, crazy colors, ads all over the place, annoying captcha (you have to fill it both when logging in and sending mail), mailbox limited to only 50 Mb, problems with encoding… All in all the user experience resembles Middle-age tortures.

Sigaint at its best

Alternative options do exist but they are either paid, such as Lenatos for 0.016 BTC / 6 months, AnonInbox — 0.1 BTC a year, or send e-mails only to addresses within Tor, such as TorBox and Mail2Tor. For an e-mail sent from them to be delivered to an e-mail in clearnet, you’d have to use a relay, which is additional pain in the neck.

There is a whole class of servers based on open-source OnionMail. If you get the settings right, you’ll be able to connect to one of them thorough your usual mail-client (via POP3 or SMTP). For instance you can use Thunderbird with TorBirdy plug-in. The list of working servers you can find in Servers directory on the OnionMail website. If you use Linux (preferably Tails), them the onion.py script might help you with the setup.

This is what almost every OnionMail website looks like

Hosting

In the early years of the internet one could easily host a site for a cheap price or even for free by placing a banner or just a link to the hosting provider’s website. In Onion the situation is different: free hosting attempts did not stick, and the paid hosting does not look attractive.

It is easy to explain: paying for the hosting accessible only through Tor is a good deal only for the drug dealers and other shady businesses. If you are not planning to join them, then you can setup your server at home in no time or find a hosting provider who won’t mind your running Tor on their server. Even for the criminal activities people often use so-called bulletproof hosting providers that work with the clearnet too.

Real Hosting

Real Hosting

Anyway, let’s mention a few hosting providers in the darknet just for the sake of it. Hidden Host provides 20 Gb of server space and unlimited traffic for 0.1 BTC a year; Real Hosting costs 0,25 BTC a year and offers only 256 Mb of space and 1 Tb of traffic; Kowloon Hosting Services has flexible schedule of fees — starting from 0.04 BTC a months for 256 Mb to as much as 0.8 BTC for half a year and 2 Gb.

Kowloon

Kowloon

Kowloon (named after an overpopulated area in Hong Kong) offers a free trial plan. If you send TRIAL domain_name to the dedicated e-mail address, you will get log in credentials in reply. It must be for that reason that our improvised indexation of the darkweb yielded around 6000 links to blank webpages hosted by Kowloon.

Sharing

While free hosting in Onion is not easy to find, the temporary file hosting is no brainer. You can store your files under 500 Kb atPopFiles, pictures at self-explanatory Image Hosting, and for texts there are Stronghold Paste, CrypTor, ZeroBin and Pasta.

Stronghold Paste

Stronghold Paste

Each of them allows you to set a timer to erase the data after given amount of time. At Stronghold Paste you can check out their archives and see what kind of trash people upload. Don’t forget to tick Private box to make sure your files don’t end up there. By the way, Pasta’s limit as to maximum text file size is 10 Mb! So, you can even upload a file encoded in Base64.

Torrents

What can be hidden in the dark corners of the internet, except for drugs and porn? Yep, software! Nowadays there’s no fun, though. Here is a PirateBay mirror, that will cover most of your piratic needs.

If thepiratebay.org does not work again, you know what to do

Books

For the book lovers there is Imperial Library of Trantor with books in English and German, but you won’t find all the newest books there. Then, there is Calibre with a database of just 1600 books. To rummage through the piles of student books and IT literature, follow this link. And finally, this mirror of Sci-Hub, the research papers aggregator might make it into your Favorites too.

Social

Why use hidden services just to have a chat? In the clearnet there’re many websites where you can sign up anonymously (or with no registration at all) and chat about whatever you like. Onion chats are mostly to speak about business. You know what kind.

There are not many places for free communication. Imageboards, such as Russian 2ch.hk , Neboard and Haibane.

The main social network in Onion is Galaxy2, if you spend some time, you can find nice thematic groups or meet interesting people. Those who prefer Russian might like onelon. It is quite an unusual blogging platform with a small but lively community. Make sure to create a PGP key, it will be required to sign up (quite a usual thing in the darkweb).

Galaxy2. I already have 2 friends!

Hidden Answers is similar to Yahoo Answers but focuses on the darknet-related topics. People discuss reliability of different darkweb stores, assist each other with Tor set-up, and of course help each other find the resources on certain topics. The latter maker Hidden Answers a great starting point for surfing the darkweb.

Facebook’s mirror is worth mentioning at least for the sake of people living in China, where the social network is blocked.

Actually, the greater part of all communication in the dark side of the internet takes place not on the websites, but in Jabber and IRC. Describing how to choose a good client program or how to setup an anonymous connection and find servers and groups would take a whole new article or two, so here’s just a bunch of useful links for you. TorXMPP, Cyruserv, securejabber.me — Jabber servers in Onion; CgAn IRC and Volatile — IRC clients that can work right in Tor Browser; ChatTor — a very basic but handy web chat that allows to create chat rooms.

Okay, and if you get really bored and want to talk about weather and your latest findings in the darknet, then visit Chat with strangers, it is the local analog of Chatroulette.

Shops

Apparently shops and trading sites are the main application of the Tor hidden services, at least for now. So let’s explore them a bit deeper and (for sheer research) visit the main markets. Browsing through the links you get dizzied by the multitude of “markets”, “oases”, “ghettos”, “stalls”, “shops”, “stores”, “stands”, “pharmacies”, “apothecaries” and other corners. Business competition is real, each and every drug-dealer tries to get his deal of attention and do any trick to get noticed. How do you like a shop named “Flickering circus of retribution”? We did love it — from the literary point of view.

AlphaBay

AlphaBay is one of the largest shops, that have divided the hidden market after the famous Silk Road had been closed forever. Officially the site “was founded by a carder named alpha02, a renowned member of several carders’ forums and a person well-known among the advanced carders”. European researchers though insist that this market works under “Russian mafia protection”, because the servers are physically in Russia and are being administrated from the Russian IP-addresses. (Too bad Russian mafia does not have some cooler name like “yakuza”!)

Russia mafia or not, but the website is in English. The registration is free, but quite complicated, a few dozens of fields to fill out. Just like the majority of shops here, this shop’s currency is bitcoin. There is the escrow service. Users mention that the site is well-moderated, all spam and scam gets promptly wiped out. But there are things that can’t be helped, some sections are covered in ads and prostitutes anyway.

AlphaBay’s main advantage is of course the broad range of goods. There are 147 000 items in Drugs & Chemicals section, 27 000 — in Fraud and 13 000 in Digital Products (accounts, game keys and software). Other sections also contain a few thousands offers each: guns, jewelry, carding, malware, hosting and other services. Surprisingly, the Guides & Tutorials section turned out interesting: from harmless websites catalogues or guides on how to hack Wi-Fi to actual ready for use botnets including the lists of existing bots, instructions and handling software.

Dream Market

This market’s is similar to AlphaBay: same quality and assortment of digital products and drugs, but there are much less items in general. Dream Market is absolutely unremarkable, but keeps provoking a curious thought — why would anyone shop at Dream Market when there are better ones?

We mentioned this shop just because other shops in English have even poorer choice of goods. In other words, if AlphaBay is the best of the best, then Dream Market is the worst of the best, it’s your typical hidden-market.

Hydra

Hail Hydra! Oh, wait, this Hydra one is different. It’s called “anonymous trading platform” but it is actually a social network for drug dealers. Its specialty is drugs and drugs (amphetamine and salts, cocaine and derivatives, packages exchange). The owners don’t have a problem advertising their shop in the clearnet: you can see hydra.ooo on the first pages of Google search results, which seems odd. Childish mistypes and harebrained emojis don’t make it look serious either.

This website is in Russian and judging by the code and applications used — it is initially Russian. The registration is easy as 1-2-3, or just 1-2 — login and password without any additional confirmations. There is a chat and there is no spam moderation. Administration’s position described on the main page is that people who paid for publishing their information won’t be considered spammers. Beside the sections devoted to trading, hiring and discussing the sellers in different countries and regions, there are more interesting discussions. For example there is a section unveiling the secrets and details of dark drug business, another one for drugs recipes and cooking process information and even one where people unfold the hidden relationship between some legal professions and world of drugs and dealing.

T*chka

Yet another drug market, only this one has some kind of ideology. “Tochka” (the founder is Russian) was created one and a half years ago and was advertised as the first drug market where each deal is supervised to ensure security and trustworthiness. Before Tochka the word “dead drop” or “drop-off” was not very popular in the English-speaking part of darkweb.
Site’s administrator says that in this market he is trying to impose «honesty, security and tolerance in every way». You can see confirmation immediately as you sign up, the site shows you the warning that it is prohibited to spread any low quality or unverified drugs, weapons, poisons, porn, extremist materials, also it’s illegal to discriminate against someone because of that person’s race, religion or political views.

You can choose another language for the interface, but all the descriptions of the offers are in English. As you can see on the screenshot, there are a thousand times less offers that on the AlphaBay market, but Tochka focuses on quality and purity of the goods. Those are not only illegal drugs, at this market you can also find rare and expensive medicine that can’t be bought legally in some countries, fake documents and software for forgery, some hacking services.

Forums

RAMP

RAMP is yet another Russian half-forum and half-market for drug dealers. There is no general conversations there, and discussing the whole list of topics (including hacking, security, cryptography, leaks, malware, carding and so on) is strictly prohibited, you get the respective warning during the registration, moreover you’ll have to stare at this list for two minutes straight. All the activity on this website is limited to selling drugs.

The Hub

A cheerless English-speaking forum about everything that’s not allowed in the innocent and pure clearnet. The most crowded sections are: “For Beginners”, “Darknet In General” and “Off Topic”, which might give you an idea of the audience of The Hub. It does not work without JavaScript. “Vendors” section contains depressing attempts of some drug dealers to promote themselves and dozens of unvaried stiff reviews of different drug markets. Tedious as hell.

Closed hackers’ forums and sites

Topics on hacking can be found here and there, but specialized forums are mostly closed and unfriendly, you can hardly find ones with free and open registration. For example, to enter Hell, one of the most known forums, you will have to pay 0,1 BTC (around 120 USD).

Hell

Hell

GroundZero, SiphON and BlackHat are in fact open, but look suspiciously empty. No doubt, everything of interest is hidden in sections not visible to an ordinary visitor.

GroundZero has only three public sections

When you fill out the registration form, there is a field for an invitation code, and even if you have one, there is no guarantee you will be able to access or even see all the existing threads. 0day has a bunch public sections, but don’t be mistaken, surely the main body of the forum is underwater and unseen.

0day

0day

Of course hacking groups have their own sites in darknet. For instance you can check out CyberGuerrilla, The Hack Lair, Hacker4Hire and Hackmasters, but frankly there is not much of interest there. The only exception is “the Market of the Anonymous International” where you can participate in a bidding where the contents of the Russian officials’ hacked accounts are auctioned.

Weapons, spying, special operations

Runion

Russian Onion Union is the most popular and informative Russian forum of the darkweb, specialized in defense and self-defense. In the “Weapons” section you will find FAQ and the glossary with the frequently used terms related to guns, manuals and books on self-made protective means, calculations of the explosives’ power, discussions on the military hardware, weaponry and ammunition, self-defense and sabotage lessons and warnings about certain guns forums where the information about the users can be sold outside.

There is another large section where people discuss the methods of wiretapping, shadowing and detection as well as how to protect yourself from the same, typical mistakes of the rookies and high-profile mistakes of the notorious terrorists. There are FAQ, rules and advice on how to stay safe in different countries and ways to get around official bans, conceal potential evidence and hide one’s tracks.

Information security section contains information on the methods of encryption and concealing traffic, safe services and utilities and ways to make popular programs, devices and web-servers abuse-proof.

Raegdan’s Fukken Saved

Russian-language archive containing complete and partial dumps of some clearnet sites that were “cleared” and stripped off of the most interesting materials. There’s much to explore for the guns lovers.

1. The dump of the weapons forum steelrats.org contains its contents as in the end of 2012. There are materials on handicraft weapons, special tools and surveillance equipment. If compared with Runion, it makes it obvious how pathetic were the anonymous forums at the time.

2. Designs, photosets and video instructions for 3D printing DYI weapons, that were saved from now non-existent James Patrick’s website. The weapons would do only for self-defense, since they’ll be made of plastic.

3. Guides for beginning rebels on how to create your own armed gang: “the ABC book of home-made terrorism”, “Guerrilla war”, “The textbook of a city guerilla”. Of course having read these books you won’t become a city guerilla (those guys are no big readers anyway), but this will help you better understand the criminal mind and maybe someday you’ll be able to avoid violence.

Cryptostorm

Tor-version of the forum of the VPN-provider Cryptostorm located in Iceland. The forum is really informative, people discuss protection and encryption of the information about private life and movements. Of course a greater part of this forum is about using Cryptostorm VPN and development of their “absolute protection utility” Cryptostorm Widget. The section called “Stormphone” contains useful information regarding data protection on mobile devices.

Black Market

This market’s website speaks of it as the “number one in the Tor network” and its owners act almost as if it were a legal shop, they claim they provide a guarantee in every country, that the weapons are all tested and can be replaced in case they fail to work (within one week after purchase), the prices already include the delivery price and each order is shipped with 10 free bullets as a courtesy. There is even a golden Desert Eagle in the catalogue! In a word that’s a great spoof, clean and clever.

Black Market Guns

Unlike the previous shop, this one is real. It is located in the US and only sells the guns, spare parts and ammo allowed in the US. All in all there are 26 items including even a couple night vision devices. The owners ignore all legalization issues that could arise on the buyer’s side, they just ingenuously offer FedEx delivery. They send a tested gun with an assembly instruction included. Official contact e-mail address at tutanota.com adds a few more credibility points. So, this shop looks real, but of course we haven’t tried ordering anything.

No Background Check Gun Store

This presumably American shop advertises itself as “the biggest weapons catalogue in the Deep Web”. The number of items in the shop is indeed impressive: 570 handguns, 230 rifles and 30 pump-action guns. The assortment is so wide, they even have a catalogue search. But there are sispicious things, for instance round numbers of items in each section, contact e-mail at gmail.com and only the generally-known brands. Too nice to be true.

Euro Guns и UK Guns


These two shops belong to one owner, they are most likely situated one in Europe (presumably in the Netherlands) and another one in the UK. The shop offers registration (why?), referral program with a 1% interest deductions (ah, here is why!), several ways to buy bitcoins for cash and free shipping. The assortment is small and absolutely identical in both shops, this is why we suspected there’s the same owners (or most likely just one person who is neither in the Netherlands, nor in England). Anyway, if you have successful shopping there, we are hoping to get our 1%!

MaskRabbit

MaskRabbit is an “anonymous agency for the real world operations” as they put it. Its specialties are goods delivery, theft, spying, sabotage, thuggery and breaking in. The funniest thing is that next to “we only work with professional agents” you see “we are looking for new agents, apply here”. Sorry, Agent 47, you are being replaced by a better candidate: we just got an e-mail from Joe Schmoe from Idaho!

C’thulhu

This one is even more hilarious. If you are not impressed enough with the name, looks at the founders of the “organized crime group C’thulhu” explaining why their services are the best and why they work via Tor, and when asked for proofs of their deeds, they answer that they erase all the evidence immediately after the oder is executed (for your own good), and the happy customers just don’t have time to leave feedback, visit some forums or send e-mails. Nuff said.

There are things though that add a little credibility to C’thulhu’s image: public PGP key, e-mail address at bitmessage.ch and a really detailed price list. Who knows, maybe the deliberately ridiculous appearances is just a smoke-screen for a real serious business.

Besa Mafia

This site is not funny at all, it belongs to an actual working mafia group from Albania. Before opening this site make sure there are no kids around.

Besa Mafia acts in the US, Canada, Europe and other countries, rendering a wide scope of services, such as: debts collection (incl. mutilation), murdering for intimidation (quiet killing also possible), arson of the houses or cars and selling unregistered guns. The list of their services looks much like a criminal code. There are pages dedicated to how to stay safe and anonymous when you make an order, FAQ, price-list and even a disclaimer where Besa Mafia insists that all their services are intended only to protect their customer from the imminent danger.

To make an “order” you must leave the contact information of someone already in a gang. Otherwise you might become the next target. The site owners claim they are not themselves the executors, they are just an intermediary, and in this role they get 20% of the payment. The executor will get the 80%.

Alright, did you believe that? Was it convincing? And now the truth: this site — is a police scam. Besa Mafia website administrators leak all the conversations with the “customers” and “executors” contacts to the law enforcement of their corresponding countries. If you are paranoid enough, you might have suspected this already when visiting the “Videos” section of the site: videos these are just fragments from American news from YouTube that won’t work without JavaScript. Anyway, after the Silk Road leak, the majority of Tor websites are actually similar scam.

Miscellaneous

Dead Drop is a service for sending encrypted messages. You will need PGP key to register and it will help you leave your message without an addressee. Those for whom the message was intended will be able to open it using your public key.

Deep Web Radio. It is hard to explain the need in an underground radio station, since there is definitely no shortage in music in the clearnet. Well, it exists anyway. Now you can listen to one of the five available stations and get the kicks from doing it via Tor.

Radio from the depths

Bitcoin Block Explorer is the mirror of Blockchain.info allowing to trace Bitcoin transactions.

Keybase mirrors Keybase.io. It allows you to connect your public PGP keys with your user profile. It might be a good idea to sign up, but don’t be surprised by a massive queue you’ll have to wait before you get an invitation.

Cryptome is a mirror of a legendary website about privacy and cryptography, cryptome.org. The latest sync happened in 2013, but while the actual website is still up, what’s the use in its hidden copy?

Total

Of course it’s impossible to just review the entire darkweb, first of all because there are so many links and researching them all is hard and also redundant. We are sure you got the general idea and we hope we helped you with “what to see” and “where to start”.

The second restraining factor is that darknet’s darkness implies you can’t see all there is at first glance. Our indexing won’t help here, you’ll need custom solutions for each case.

All in all the visible part of the darkweb so much resembles the internet of 90-s with its characteristic anti-design and general chaos that you get carried away by nostalgia. The main difference is that onion websites are fewer in number but so much more criminal. But on the bright side, here you can surf the web and feel the wind of freedom blowing over your face just like in good old times!


2 Responses to “What to See on the Darkweb: A Travel Guide to Hidden Services”

Leave a Reply to Darkwebs and Sharepoint Exploitation – HEXpert

Click here to cancel reply.

XHTML: You can use these tags: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>