Tor Continues To Confound

Tor is, yet again, producing some data that seems to defy explanation.  Having talked a lot about how the number of unique .onion addresses has varied in recent weeks (and was apparently settling down) another metric has suddenly shown a dramatic change.  The amount of data being reported as using the hidden services has plummeted (and I use that word deliberately).

The immediate thought was that there had been another sudden drop in the number of unique .onion addresses and hence the "dark web" had contracted for some reason.  However, the data shows that the number of unique .onion sites remains stable as I was expecting when I wrote about the "new normal":

The question then occurs as to whether the overall traffic on Tor has seen a similar fall.  The short answer is no:

The overall usage of Tor varies a lot during any one day but if you take a simple moving average through the data (black line) you can see that there has been no decrease similar to that seen for hidden services traffic.  As discussed previously one has to remember that hidden services traffic is only a tiny fraction of the overall Tor traffic, so it may be that a change, even a dramatic change, in the hidden services traffic would not show up in the overall traffic volumes.  But what one can say is that the hidden services traffic is not simply a result of some overall drop in usage of Tor in general.

So we have another mystery.  Hidden services traffic has dropped with no drop in the number of .onion addresses and no suggestion that Tor as a whole is being deserted.

If anyone has any ideas I'd love to hear them - see me on Twitter at @profwoodward.


UPDATE 09/04/2016: The volume of data traffic to hidden serbices continues to fall and is now less than 50% of what it was only a week ago: