Tor Continues To Confound

Tor is, yet again, producing some data that seems to defy explanation.  Having talked a lot about how the number of unique .onion addresses has varied in recent weeks (and was apparently settling down) another metric has suddenly shown a dramatic change.  The amount of data being reported as using the hidden services has plummeted (and I use that word deliberately).

The immediate thought was that there had been another sudden drop in the number of unique .onion addresses and hence the "dark web" had contracted for some reason.  However, the data shows that the number of unique .onion sites remains stable as I was expecting when I wrote about the "new normal":

Who Is Spinning This Hidden Web?

For anyone who has been following the story of Tor hidden services, which began in February as we all noticed a sudden increase in the number of unique .onion addresses, it appears that it might be finding a new equilibrium.  Having said that, the last time I thought this it leapt up even higher than the original increase which caught our attention.

As of this morning the number of unique .onion addresses appears to be levelling out.  It looks considerably lower than the peak that was reached but it is still at or higher than the level which woke us up a few weeks ago.

Tor Suddenly Goes Into Reverse (Again)

The prevailing theory to account for the surge in Tor .onion addresses was that it was being driven by malware.  The most likely candidate was Locky.  I say "was" because, yet again, Tor has confounded us all by showing just as dramatic a fall in .onion addresses:

The initial surge that raised interest also had its own fall, followed by an even larger rise.  So, what happens from here is anyone's guess.  No one seems to know what is causing this - well someone does but they're not saying.

Whilst the surges do appear to have some correlation with Locky infections its not clear why the number of addresses would fall if it were Locky.  Is Locky somehow clearing up after itself - maybe just turning off the addresses once used?  Does the drop mean that people are paying up and the .onion address is no longer needed?  Lots of questions but few answers.