The Real Dark Web -Tor-Freenet-Tarzan-MixMaster-JAP-Antsp2p-HayStack

The following networks are discussed on this page.

  • Tor
  • Morphmix / Tarzan
  • Mixminion / Mixmaster
  • JAP
  • MUTE / AntsP2P
  • Haystack
  • Freenet

Tor / Onion Routing

[Tor] [Onion Routing]

Tor and Onion Routing are both anonymizing proxy networks, allowing people to tunnel out through their low latency mix network. The two primary differences between Tor / Onion-Routing and I2P are again related to differences in the threat model and the out-proxy design (though Tor supports hidden services as well). In addition, Tor takes the directory-based approach – providing a centralized point to manage the overall ‘view’ of the network, as well as gather and report statistics, as opposed to I2P’s distributed network database and peer selection.

The I2P/Tor outproxy functionality does have a few substantial weaknesses against certain attackers – once the communication leaves the mixnet, global passive adversaries can more easily mount traffic analysis. In addition, the outproxies have access to the cleartext of the data transferred in both directions, and outproxies are prone to abuse, along with all of the other security issues we’ve come to know and love with normal Internet traffic.

However, many people don’t need to worry about those situations, as they are outside their threat model. It is, also, outside I2P’s (formal) functional scope (if people want to build outproxy functionality on top of an anonymous communication layer, they can). In fact, some I2P users currently take advantage of Tor to outproxy.

Comparison of Tor and I2P Terminology

While Tor and I2P are similar in many ways, much of the terminology is different.

Tor I2P
Cell Message
Client Router or Client
Circuit Tunnel
Directory NetDb
Directory Server Floodfill Router
Entry Guards Fast Peers
Entry Node Inproxy
Exit Node Outproxy
Hidden Service Eepsite or Destination
Hidden Service Descriptor LeaseSet
Introduction point Inbound Gateway
Node Router
Onion Proxy I2PTunnel Client (more or less)
Relay Router
Rendezvous Point somewhat like Inbound Gateway + Outbound Endpoint
Router Descriptor RouterInfo
Server Router

Benefits of Tor over I2P

  • Much bigger user base; much more visibility in the academic and hacker communities; benefits from formal studies of anonymity, resistance, and performance; has a non-anonymous, visible, university-based leader
  • Has already solved some scaling issues I2P has yet to address
  • Has significant funding
  • Has more developers, including several that are funded
  • More resistant to state-level blocking due to TLS transport layer and bridges (I2P has proposals for “full restricted routes” but these are not yet implemented)
  • Big enough that it has had to adapt to blocking and DOS attempts
  • Designed and optimized for exit traffic, with a large number of exit nodes
  • Better documentation, has formal papers and specifications, better website, many more translations
  • More efficient with memory usage
  • Tor client nodes have very low bandwidth overhead
  • Centralized control reduces the complexity at each node and can efficiently address Sybil attacks
  • A core of high capacity nodes provides higher throughput and lower latency
  • C, not Java (ewww)

Benefits of I2P over Tor

  • Designed and optimized for hidden services, which are much faster than in Tor
  • Fully distributed and self organizing
  • Peers are selected by continuously profiling and ranking performance, rather than trusting claimed capacity
  • Floodfill peers (“directory servers”) are varying and untrusted, rather than hardcoded
  • Small enough that it hasn’t been blocked or DOSed much, or at all
  • Peer-to-peer friendly
  • Packet switched instead of circuit switched
    • implicit transparent load balancing of messages across multiple peers, rather than a single path
    • resilience vs. failures by running multiple tunnels in parallel, plus rotating tunnels
    • scale each client’s connections at O(1) instead of O(N) (Alice has e.g. 2 inbound tunnels that are used by all of the peers Alice is talking with, rather than a circuit for each)
  • Unidirectional tunnels instead of bidirectional circuits, doubling the number of nodes a peer has to compromise to get the same information.
  • Protection against detecting client activity, even when an attacker is participating in the tunnel, as tunnels are used for more than simply passing end to end messages (e.g. netDb, tunnel management, tunnel testing)
  • Tunnels in I2P are short lived, decreasing the number of samples that an attacker can use to mount an active attack with, unlike circuits in Tor, which are typically long lived.
  • I2P APIs are designed specifically for anonymity and security, while SOCKS is designed for functionality.
  • Essentially all peers participate in routing for others
  • The bandwidth overhead of being a full peer is low, while in Tor, while client nodes don’t require much bandwidth, they don’t fully participate in the mixnet.
  • Integrated automatic update mechanism
  • Both TCP and UDP transports
  • Java, not C (ewww)

Other potential benefits of I2P but not yet implemented

…and may never be implemented, so don’t count on them!

  • Defense vs. message count analysis by garlic wrapping multiple messages
  • Defense vs. long term intersection by adding delays at various hops (where the delays are not discernible by other hops)
  • Various mixing strategies at the tunnel level (e.g. create a tunnel that will handle 500 messages / minute, where the endpoint will inject dummy messages if there are insufficient messages, etc)



Freenet is a fully distributed, peer to peer anonymous publishing network, offering secure ways to store data, as well as some approaches attempting to address the loads of a flash flood. While Freenet is designed as a distributed data store, people have built applications on top of it to do more generic anonymous communication, such as static websites and message boards.

Compared to I2P, Freenet offers some substantial benefits – it is a distributed data store, while I2P is not, allowing people to retrieve the content published by others even when the publisher is no longer online. In addition, it should be able to distribute popular data fairly efficiently. I2P itself does not and will not provide this functionality. On the other hand, there is overlap for users who simply want to communicate with each other anonymously through websites, message boards, file sharing programs, etc. There have also been some attempts to develop a distributed data store to run on top of I2P, (most recently a port of Tahoe-LAFS) but nothing is yet ready for general use.

However, even ignoring any implementations issues, there are some concerns about Freenet’s algorithms from both a scalability and anonymity perspective, owing largely to Freenet’s heuristic driven routing. The interactions of various techniques certainly may successfully deter various attacks, and perhaps some aspects of the routing algorithms will provide the hoped for scalability. Unfortunately, not much analysis of the algorithms involved has resulted in positive results, but there is still hope. At the very least, Freenet does provide substantial anonymity against an attacker who does not have the resources necessary to analyze it further.

Morphmix / Tarzan

[Morphmix] [Tarzan]

Morphmix and Tarzan are both fully distributed, peer to peer networks of anonymizing proxies, allowing people to tunnel out through the low latency mix network. Morphmix includes some very interesting collusion detection algorithms and Sybil defenses, while Tarzan makes use of the scarcity of IP addresses to accomplish the same. The two primary differences between these systems and I2P are related to I2P’s threat model and their out-proxy design (as opposed to providing both sender and receiver anonymity). There is source code available to both systems, but we are not aware of their use outside of academic environments.

Mixminion / Mixmaster

[Mixminion] [Mixmaster]

Mixminion and Mixmaster are networks to support anonymous email against a very powerful adversary. High-latency messaging applications running on top of I2P (for example Syndie or I2PBote) may perhaps prove adequate to meet the threat model of those adversaries, while running in parallel along side the needs of low latency users, to provide a significantly larger anonymity set. High-latency support within the I2P router itself may or may not be added in a distant future release. It is too early to say if I2P will meet the needs of users requiring extreme protection for email.

As with Tor and Onion Routing, both Mixminion and Mixmaster take the directory based approach as well.



JAP (Java Anonymous Proxy) is a network of mix cascades for anonymizing web requests, and as such it has a few centralized nodes (participants in the cascade) that blend and mix requests from clients through the sequence of nodes (the cascade) before proxying out onto the web. The scope, threat model, and security is substantially different from I2P, but for those who don’t require significant anonymity but still are not satisfied with an Anonymizer-like service, JAP is worth reviewing. One caution to note is that anyone under the jurisdiction of the German courts may want to take care, as the German Federal Bureau of Criminal Investigation (FBCI) has successfully mounted an attack on the network. Even though the method of this attack was later found to be illegal in the German courts, the fact that the data was successfully collected is the concern. Courts change their minds based upon circumstance, and this is evidence that if a government body or intelligence agency wanted to, they could gather the data, even if it may be found inadmissible in some courts later)

MUTE / AntsP2P

[MUTE] [AntsP2P]

Both of these systems work through the same basic antnet routing, providing some degree of anonymity based on the threat model of providing plausible deniability against a simple non-colluding adversary. With the antnet routing, they first either do a random walk or a broadcast search to find some peer with the data or identity desired, and then use a feedback algorithm to optimize that found path. This works well for applications that merely want to know what other people around them have to offer – “How are y’all doing” vs. “Hey Alice, how are you” – you basically get a local cluster of nodes that can share files with and maintain some degree of anonymity (though you don’t have much control over who is in that group of peers).

However, the algorithm does not scale well at all – if the application wants to speak with a particular peer it ends up doing a broadcast search or random walk (though if they are lucky enough for that to succeed, the antnet routing should optimize that found connection). This means that while these networks can work great at small scales, they are not suitable for large networks where someone wants to get in touch with another specific peer. That does not mean that there is no value in these systems, just that their applicability is limited to situations where their particular issues can be addressed.


This was a closed-source network targeted at Iranian users. Tor did a good writeup on what to look for in a circumvention tool. Suffice it to say that being closed source and publicly targeting a specific country are not good ideas. I2P is, of course, open source. However, that source, and our technical documentation, need much more review.

Paid VPN Services

Only your Cable company knows for sure…


Dark Web Stats – emails and languages

gAtO StAts – of the dark web show us many things – below are some stats on just over 2,000 sites and 130 EMails that my crawlers have found. By the way .it has the most sites taken DOWN by FBI-DOJ and it’s still up there re-building – one site goes down and 6 replace it – why are they using .it I don’t know also Portuguese has 70 sites in the Dark Web – WoW so have fun Gatico’s – gAtO OuT


Dark Web Email stats — Generated on 2015-03-10

Out of 129 Unique emails

  • .onion                              10
  • .ch                                    2
  • .org                                  13
  • .tld                                   2
  • .org                                  13
  • .com                                70
  • .net                                  13
  • .ru                                    4
  • .it                                    50
  • .edu                                1
  • .info                               5
Dark Web Sites Alive

Dark Web Sites Alive

Dark Web Sites – out of 2,919 dark websites most are English  –Generated on 2015-03-10

  • Arabic Sites               4
  • Czech                           2
  • Danish                         5
  • German                       53
  • Spanish                       48
  • Finnish                        15
  • French                         59
  • Hungarian                    7
  • Italian                         152
  • Japanese                      4
  • Korean                         1
  • Norwegian bn             1
  • Norwegian nn            9
  • Dutch                         23
  • Polish                         12
  • Portuguese                70
  • Russian                     168
  • Swedish                    10
  • Turkish                      9
  • Ukrainian                  5
  • Chinese                      1

i2p sites in the Dark Web

gAtO FoUnD – these few i2p sites from my Dark Web crawlers – there is also a lot of tunneling from Tor to i2p to keep thing really secure – why not use 2 network to hide your stuff.  You can find a lot of Russian sites that do business in the Dark Web – i2p is better at security of course they use it to hide better.

The Dark Web is not only Tor but i2p as well. I hope this helps any researcher or educator play in the Dark Web better. Some of the content is nasty so be careful – gAtO oUt

I2P Links


eepsites – This search engine has been around for a long number of years. Also available on the clearnet via http://eepsite.com “This site provides a web interface to a database about files available within the anonymous I2P network. A dedicated, automated web crawler keeps the database up-to-date.” http://eepsites.i2p

eye.i2p – Supports somewhat advanced query options. http://eye.i2p

epsilon.i2p – “Epsilon Search is a search engine that indexes eepsites on I2P.” http://epsilon.i2p


Oniichan – Chan run by chisquare. Many categories, active-ish. http://oniichan.i2p

Anch  – “This site was made by anarchists and for anarchists. This site is  russian-speaking, except /int/, which is international.” http://anch.i2p


augenscheinlich – A blog in Germany about Net politics, surveillance, secret services, leaks, and so forth. Frequently updated as of this writing.


str4d – Home of str4d. It has guides, a blog, links, notes, and infographics. http://str4d.i2p

killyourtv.i2p – KillYourTV’s home. Including How-Tos, a blog and a description of his services.


Shadow Life – “Enjoy your stay below the radar”. Well written and lenghty posts on anonymity. Would recommend.


Cheech-Wizard – Blog of resident I2P user Cheech-Wizard, serving comics, music and thoughts.


Dark Like My Soul – fancycakes’ blog. Interesting and useful blogposts.


SIGINT – Personal site/blog of sigint.


dcherukhin – Personal blog and link list of a Russian man named Dmitriy Cherukhin. Appears to be an academic.


Raegdan’s Refuge – Yet another Russian blog.


The Anon Dog – Daily updated links to (news) articles on politics, security, revolts, etc. “h4364r’s Anonymous Daily on I2P”


Actap’s Home page – “I’m Actap from Russia. Increasing Internet censorship level in my country brought me here.” Hosts a constantly updated list of sites banned in Russia.


?labs – Anja’s “little corner on cipherspace”.


Chiron’s I2P Eepsite – Entertaining homepage of a seemingly disorganised and at times angry German I2P user with limited grasp of the English language. He has added a puzzle to his website which leads to his personal information. Confirmed to be the manliest man on I2P. Rumored to be the operator of the I2P mainframe.


sighup’s eepsite – “Homepage of sighup”. A blog, IRC logs of some irc2p channels, contact information, and some other stuff.


darrob.i2p – Personal site of darrob. Some Tahoe-LAFS related stuff.


peek-a-boo eepsite – ReturningNovice’s eepsite.


justme.i2p – Home of RandomI2PUser. Some books, music and programs available.


Meeh’s home – One or two tutorials and a description of the services run by Meeh.


Home of a Japanese I2P user.


lurker.i2p – “A non-organic lifeform”. Home of Frost, the operator of ZeroFiles. Has a blog and a hosts.txt file. http://lurker.i2p

Complication – A really old personal site. Interesting snippets from the beginning of I2P when there were just a handful of users. Hasn’t been updated in a couple of years.


Man  of Perdition – “Things your goverment & church don’t want you to   know.” Do not enter without triple-layered tinfoil hat.


Freshcoffee – Plain and simple but well crafted home of cervantes. Lists some cryptographic keys.


Schwarzwald – Quite an empty website.


Doom – Yet another empty personal website. It lists a GPG key.


luminosus – Lists some contact information.


Cable Viewer – “A Cat’s Mirror of Wikileaks Cablegate site.”


main.paraZite – A mirror of the (in)famous “paraZite”


I2P Planet – “planet.i2p is an RSS aggregator for I2P trackers, blogs, and other feeds.”


hashparty – “Home of hashparty, the blackhat hash cracking feast!”


Cool looking site in Spanish about privacy, government control, GSM, mobile phones, privacy, security, hacks, IMSI-catcher, etc.




Buråsskolan – A Swedish site (or rather, a page) about cryptoanarchy (I suppose).


anarchydocuments.i2p – A mirror of texfiles.com’s “Anarchy and General Mayhem” section.


Abusos judiciales en España – Info about abuse by courts and lawyers in Spain.


Info Security – A Russian blog on information systems security. Seems dead.


Anarplex – Darknets and cipherpunked agorism.


Lenta.i2p – Very active news blog on Russian affairs.


FreeZone – A Russian blog.


SLS.i2p – Yet another Russian blog. Seems to cover politics.


Antheogen – A Russian site about psychoactive funghi (I think)



PaTracker 1.7 aka Postman’s I2P tracker, or simply Postman. I2P’s main torrent tracker. Has been up for years. Very active, very reliable. Lots of good stuff.


DifTracker – A large body of French content


exotrack.i2p – Deserted but functional.


Myttk – A Russian torrent site.


Welterde – Opentracker that has been up for a number of years.


Chisquare’s opentracker announce URL


An opentracker run by KillYourTV


A Russian opentracker.


Les Hérétiques – Very well-designed collection of French literature, including detailed descriptions. Mostly (only?) EPUB files.


lib.i2p – A modest (~500) collection of Russian ebooks.


Free Book Library – 20045 books, 410 comics, 33 magazines, 134 textbooks. Warning: Facebook Like button on page!


Gusion – A modest collection of ebooks (~290). Mostly fiction. Uses the Calibre ebook management software.


Library  Genesis – I2P leaf of the Library Genesis project (now nearing 1 million ebooks).


Document Heaven – “Document Heaven wants to be an eepsite, which collects links and magnet links to scientific or otherwise interesting non-fictional papers, documents and books. This eepsite is hosted in the spirit of the Guerilla Open Access Manifesto.”


Cheech-Wizard – An index of music and comics uploaded by Cheech-Wizard to Postman.


amidoinitrite – Manga, music, books, Youtube.


lyncanthrope.i2p – French movies and music


openmusic.i2p – An open directory with some gigabytes of music. http://openmusic.i2p

mp3arc – Fairly big open directory of “hard music”. At least 800 albums (haven’t counted them). Sorted by artist. http://mp3arc.i2p

Anonymix – “Multitracks, Acapellas, Instrumentals, and More” for download. Requires registration. http://anonymix.i2p

leecher.i2p – Some popular TV series including The Walking Dead, The Simpsons, South Park, and more. http://leecher.i2p

serien.i2p – An index of German TV series available via torrents. http://serien.i2p


VEscudero’s Service for Buying and Selling Bitcoins – Very well established and reputable Bitcoin trader. http://bitcoiner.i2p

LTC Guild – Litecoin mining pool. http://ltcguild.i2p

Darsek – “virtual card, internet payment processor and money transfer system”. http://darsek.i2p

?x5 – “?x5 Investment Fund is an Offshore entity outside your jurisdiction, managed by veteran investment gurus.” http://pix5.i2p


ChemHack’s – “Apothecary and Potions”. Currently selling homemade GHB and Suboxone http://chemhack.i2p

Darknet Products – Selling virtual machines and bootable USBs. http://darknet-products.i2p


id3nt – I2P’s main microblogging service. http://id3nt.i2p

Jisko – Another microblogging service. Hasn’t been around as long as id3nt, but has frequent and constant activity. http://jisko.i2p

Visibility – Fully functional social network. Active (read: not dead), but could do with more users. “You can add friends, upload files, share images, write blogs, create pages, add bookmarks, create polls, and more…” http://visibility.i2p


I2Play – “Welcome! I2Play provides anonymous gaming services over I2P. Admittedly the selection of games that can be played over I2P is reasonably small due to the requirement that they be tolerant of lag, but that doesn’t stop us trying!” OpenTTD and Tetrinet. http://i2play.i2p

I2P Chess Client – “Here you can play chess with other users and robots either in casual  play or for ranking.  Also, you can interact with the users through the  chat rooms. You don’t need to install any other program, you just need  to register using the link, enter and play!” http://chess.i2p


ZeroFiles – A file and image host with a 10mb upload limit. http://zerofiles.i2p

Gallery – Not exactly an image host pur sang, but it hosts images. About 40k of them. http://gallery.i2p

open4you – A Russian/English site offering free hosting. http://open4you.i2p

Blackhosting – A Russian hosting provider that accepts Bitcoin. http://blackhosting.i2p/en/


ZZZ – The main developers forum of I2P. http://zzz.i2p

i2p2.i2p – I2P’s project page. Go here for the nitty gritty on how I2P works. http://www.i2p2.i2p

trac – I2P bug reporting and general ticket creation. http://trac.i2p2.i2p

stats.i2p – “The home for I2P statistics”. Has been around since forever. http://stats.i2p

BigBrother – Distributed network statistics gathering. http://bigbrother.i2p

sponge – Home of I2P for Android, Seedless, and sponge himself. http://sponge.i2p

echelon – Your #1 source for I2P plugins. http://echelon.i2p

Plugins – “An app-store for I2P plugins” http://plugins.i2p

I2P Plugins – Yet another source of plugins. http://stats.i2p/i2p/plugins

AyuDownloader – “AyuDownloader is an Plugin using the EepGet class from i2p developers to download larger files easy from Eepsites.” http://ayudownloader.i2p

Ipredia – “Home of IprediaOS”. An operating system for I2P. “IprediaOS  is a fast, powerful and stable operating system based on Linux that  provides an anonymous environment. All network traffic is automatically  and transparently encrypted and anonymized.”  http://ipredia.i2p

Projects.i2p – Projects.i2p is a community-focused projet management site for I2P  coding projects, providing optional wikis, forums, document management, bug tracking and much, much more. If you’d like to host a project here, please contact one of the site admins, either on I2P’s IRC network, or via e-mail. http://projects.i2p

Repo – “This site is a central information hub for repository hosting services around I2P.” http://repo.i2p

git.repo.i2p – A public, anonymous Git hosting site. http://git.repo.i2p

Deadman – iMule repository. http://deadman.i2p


ExitProxy – Run by Russians. Multiple IPs available. http://exitproxy.i2p

Meeh’s Tor outproxy – “I have a outpoxy free for use. With this you should be able to access both .i2p/.onion and clearnet sites.”



PasteThis.i2p – Has been up for at least a year. Stable and actively used. http://pastethis.i2p

ZeroBin – “ZeroBin is a minimalist, opensource online pastebin where the server has zero knowledge of pasted data. Data is encrypted/decrypted in the browser using 256 bits AES.” http://zerobin.i2p


Salt Wiki – The main I2P Wiki as of writing. A valuable resource with a big and broad variety of information. Also available as a Tor hidden service http://salt.i2p/wiki/index.php/Main_Page

Satori – “This is a wiki dedicated to cryptographic, anonymity, and security information.” http://satori-wiki.i2p

The Darknet Wiki – Seems underdeveloped and deserted. http://darknet-wiki.i2p

wiki.meeh.i2p – Good resource with information not found elsewhere. “This is a wiki for i2p and how to use its functions and services.” http://wiki.meeh.i2p

rus.i2p – Main Wiki for Russian I2P users. http://rus.i2p

??????????? – Another Russian Wiki. This one seems oriented towards more technical subjects. http://progromore.i2p

WikiI2p-ES – A wiki for latinos. http://lawiki.i2p/wiki-es

I2P Tutorials – Tutorials in German. http://tutorials.i2p

I2P/Tor Workshop Notes – “By the less than anonymous Adrian Crenshaw”. http://irongeeks.i2p

PrivacyHawk – A useful resource for tutorials on a variety of topics. “Welcome to PrivacyHawk’s Growing List of  Tutorials”. http://privacyhawk.i2p


stats.i2p – The oldest and most popular addressbook service of I2P. Curated. http://stats.i2p

I2P Name Registery – Second most popular addressbook service. “Domain name registrations will not be rejected based on content.” http://inr.i2p

I2Host- Yet another jumper service. http://i2host.i2p


Postman’s mail service aka mail.i2p. Has been online since 2004 with no breaks. Solid email provider. http://hq.postman.i2p

Mumble server by TronDev. Voice chat for the darknet. http://salt.i2p/wiki/index.php/TronDev_Mumble_Server

i2p-bote – Distributed secure email – http://i2pbote.i2p or http://plugins.i2p/i2pbote

Inscrutable XMPP – Also available as a Tor hidden service. Includes information on connecting to Inscrutable XMPP with various clients. http://inscrutable.i2p

Salt XMPP – See the wiki for a tutorial, configuration, client list, etc. Also available as a Tor hidden service. http://salt.i2p/xmpp.html + http://salt.i2p/wiki/index.php/Salt_xmpp

Inscrutable and Salt have S2S (between one another) and multi-user chat.

Haste XMPP – Also available as a Tor hidden service and on the clearnet http://haste.i2p

I2P Chat – A web chat run by who.i2p. Almost only Russians in here. http://who.i2p/chat/

Salt NNTP – Text only NNTP server. Also available as a Tor hidden service. http://salt.i2p/nntp.html + http://salt.i2p/wiki/index.php/Salt_nntp (tutorial)


Marcadores – A link list by a Latino user – http://marcadores.i2p

Null – Link list (and blog) by 77@0x7@0x01. Nice retro design. http://null.i2p

The Anon Dog – Excellent link list with descriptions. http://theanondog.i2p/cgi-bin/eepsites.py

Who is up? – Uptime checker by a Russian. http://who.i2p

Perv – One of the older uptime checkers. http://perv.i2p

identiguy aka eepstatus – Stable. http://identiguy.i2p


forum.i2p – I2P’s oldest forum. The most active forum in the I2P anglosphere. http://forum.i2p

forum.salt.i2p – Salt’s forum. http://forum.salt.i2p

forum.rus.i2p – Main forum for Russian I2P users. Very active. http://forum.rus.i2p

The Holocaust Forum – “Open and civilized debate on the Holocaust”. http://holocaust.i2p


Salty Pad – An I2P Etherpad instance. http://oniichan.i2p/ep/pad/

Infinote – For use with an Infinote client. Might be better than Etherpad. No Javascript required. http://str4d.i2p/services/infinote/


KillYourTV’s SKS OpenPGP Keyserver http://killyourtv.i2p/sks

Inscrutable’s SKS OpenPGP Public Key Server http://keys.inscrutable.i2p

Echelon’s I2P OpenPGP Public Key Server. http://keys.echelon.i2p


Tabak – 1 page of information on.. tabacco. In Russian. An i2p-bote address is listed too. http://tabak.i2p

Anonet2 – The Anonet darknet. http://anonet2.i2p

q.i2p – “The I2P URL-Shortener” http://q.i2p

INTUIT.ru – A mirror of intuit.ru, which is.. something. In Russian. http://intuit.i2p

A hit counter for your eepsite. http://who.i2p/counter.html

BitTot – Yeah.. don’t tell Putin about this. http://bitot.i2p

La lique des trolles – I don’t have a clue what this is about. Some French closed forum. http://dumpteam.i2p

zzzot – See for yourself. http://encryptedphreak.i2p

MPAA NOTICE. http://mpaa.i2p

Does what it says on the tin. http://nyancat.i2p

SYNDIE (An open source system for operating distributed forums):

syndie-project.i2p – Syndie project website http://www.syndie.i2p

Syndie Documentation Project – A project to revive Syndie’s documentation and make the software easier to use. http://fomjl7cori4juycw55kdlczpgzzhme6nox6zykokuiov6t5lxhvq.b32.i2p







A table of known Syndie archives. http://wiki.meeh.i2p

Syndie Gateway. http://mosfet.i2p


The I2P IRC network aka irc2p – The biggest, most well known, most active IRC network in I2P. It works out of the box. Simply start I2P and point your IRC client to irc://

Nameless – An IRC network with some interesting anonymity enhancing features. Servers: irc.stream.i2p, irc.puredev.i2p, irc.philabs.i2p, irc.dlms.i2p

Single server networks belonging to particular users:





Dark Web and Bitcoin Intelligence Project

Dark Web Intelligence- The Digital Undergound

Project Athena

Executive Summary

I have over 400,00 of Dark Web URL and Web-content plus 2-3 million URL and content of historical data from a few years back – available today.  

Project Athena will offer customers the ability to monitor Dark Web activities and provided alerts and warnings when credit cards or banking account information (or any other keyword you choose) is posted for sale or dumped in the Tor and i2p network dark marketplaces. We also offer the optional service for attainment of compromised data from dark web sellers, this is optional and customers are encouraged to seek legal advice before requesting this service.

We follow the money in the Dark Web, Project Athena will also track Bitcoin usage in the dark web. Since it is the prime source of all dark web transactions, this data combine with our Bitcoin Blockchain tools will give you the data and insight into any cyber investigation.

We use cyber sock puppets in the dark web marketplaces to gather intelligence and target data. These persona’s called cyber sock puppets play a role and team up to gather information. We can also provide you with training and manuals on setting up a Deep Web Investigation Environment with all our tools and how to social-engineering with sock puppets to gather cyber intelligence.

These are all passive methods of investigations, but we can also perform active probes into dark web websites which are very different in the code below and how what network protocol allows.

The Artemis Search engine does 2-two things, one is search of the data from the crawlers and the web crawlers that are basicly BotNets that you send out to gather intelligence in the networks. We gather network data, metadata and website content and extract the URL, Email, Bitcon Addresses, ip2 Addresses and many other type of data, but we can do custom keyword for any investigation subject matter that you may need to use.

Project Athena web crawlers tool -Artemis- scrape the Dark Web (Tor-i2p Network) for metadata and content information of any website we find. This data is stored in Databases so it can be used as a front end to any analytical software to extract the dark web players and websites or any data point you are looking for. It can also provide a simple dark web search engine for investigation into dark web activities.

Since the Tor and i2p network hide websites and information, we must be creative in using our crawlers with keywords to find active websites that are part of the target investigation and then dig deep into them extracting every cyber breadcrumb they have. This is all passive crawlers so no violations are committed.

Bad Guys Methods: Some sites only go up for a few hours every day, some sites use graphics only so our search crawlers can not pick them up their web content, they even imbed content in the graphics so even if you have the graphics without the right password you cannot decode the graphics. Some other sites are Login only sites, getting into those sites is by recommendation only so establishing cyber sock puppets and having them be accepted is the only way to get into these private stolen goods websites. We also do active operations with sock puppets to find new websites by social-engineering methods.

We design and develop cyber dark web sock puppets as aliases and define roles for them to play. These active sock-puppets can be your best way to gathering intelligence to real sites that are selling goods and services or known wire transfer for terroist organizations. In the dark web websites are called hidden services, so finding them without active sock puppets operations is almost inpossible.

The Dark Web is tied to Bitcoin as a monetery value transfer network and one of our new cyber financial data point we will focus on. With our new Bitcoin BlockChain tools working with our Artemis crawlers we can map Bitcoin transactions sometimes down to an IP address.

Bitcoin mapped to the Dark Web

Bitcoin mapped to the Dark Web

Business Case:

The business purpose is to offer a service to banks, financial intuitions, and private persons to monitor activity on the Dark Web to provide alerts and warnings when credit cards and banking accounts are compromised and posted for sale.

Granted, some clients, and potential clients, initially, may not want “the service” to be involved in buying compromised cards back, but they might at some point in the business relationship. BitCoin tracking is important, as you well recognize, to develop the human side of the investigation and would involve creating Sock Puppets and employment of other anti-fraud investigation techniques.

But, for initial marketing efforts, being able to “get a meeting” with a bank executive by letting he or she know that there are indications that bank accounts and credit information is being sold is a first step. Then the pitch would be,

“Let us monitor the Dark Web for you, to provide alerts and warnings so you can respond appropriately, and in a timely manner!”


Table of Contents

Dark Web Intelligence……….. 1

Project Athena……….. 1

Executive Summary – Project Athena:……. 6

Business Case:……. 7

Bitcoin – Financial Side of the Dark Web :……. 8

A Private http://blockexplorer.com type blockchain to DB tool…… 8

Bitcoin Account Types:….. 8

Dine and Ditch Wallet:….. 9

Store-Hold Wallet:….. 9

Web-Wallet….. 9

Step by Step list – Dark Web Intelligence focus……. 9

Technology Required – Dark Web Tools……. 10

  • Tor….. 10
  • 2 private Tor-Relays – entry and exit….. 10
  • Artemis – Tor Search Engine -w/ Privoxy and Popili Proxies….. 10
  • BlockChain 2 DB tool – to keep all Block-Chain queries PRIVATE….. 10
  • IRC – OnionCat – BitMessenger….. 10
  • Bitcoin….. 10
  • VPN….. 10
  • i2p….. 10
  • secure email….. 10
  • PGP key for encryption….. 10
  • 3-5 Dark Web Sock Puppets – Buyer/Hacker/wingMan – Roles….. 10

Phase I……. 10

Phase II……. 10

Phase III……. 10

Active Buy….. 11

Extract CC Data….. 11

Dark Web data Collection -Tor- Bitcoin – E-Mails & I2P -……. 11

Understanding the Block Chain……….. 12

The Value of Decentralized Consensus……. 12

Decentralized Applications: The Next Big Thing……. 13


Sock Puppet  – Gaining Anonymous Access into the Dark Web – ??……. 15

Create Your Own User Names….. 15

Setting-Up Your Sock Puppet Environment….. 15

Best Usage Practices of Sock Puppet Identities….. 15

Setting-Up Onion Mail:….. 15

Create Your Own User Names?….. 15

Motivation – WHY do you need a Dark Web Sock Puppet (SP):……. 15

Dark Web Methods:……. 16

Dark Web Communication:……. 16

IRC – Private Message – BitMessenger -……. 16

Sock Puppet -> Start Here: ?……. 17

STEP 1: Research Intelligence Exchange:….. 17

STEP 2: Setup an email account for your sock poppet using onion mail:….. 17

STEP 3: Copy and paste site information about PGP public:….. 17

STEP 4: Setup PGP:….. 17

STEP 5: Transfer file:….. 17

STEP 6: Establish Your Presence on a Private Message Board:….. 17

STEP 7: Set-Up a secure public Jabber/XMPP federated server on hyperboria using rows.io….. 17

Best Usage Practices of Sock Puppet Identities ?Protecting Your Sock Puppet:….. 18

Completing Your Research- Operation:….. 18

Setting-Up Onion Mail:……. 19

[1.0] What’s Onion Mail:….. 19

[1.1] Why should I use Onion Mail?….. 19

[2.0] Sending emails….. 19

[2.1] Special addresses:?….. 20

[3.0] Communicating with the server:….. 20

[3.1] Spam List:….. 21

[4.0] Dealing with unwanted messages with X-Notice headers:….. 21

[5.0] Create your OnionMail address:….. 22

[6.0] Use PGP messages:….. 22

[7.0] Virtual M.A.T. Protocol and simple mail addresses:….. 22

[8.0] Virtual M.A.T. in Tor network:….. 23

[9.0] User configuration:….. 23

[10.0] Mailing lists:….. 23

[11.0] How to know the user limits:….. 24

[12.0] iam.onion addresses and server address:….. 24

[13.0] Special Mail RULEZ files:….. 24

[14.0] Rulez files as newsletter:….. 25

Dark Web Sock Puppet Setup……….. 26

Sock Puppet  -Insertion into the Dark Web -……. 26

Sock Puppet Information….. 26

Start inserting your Sock Puppet into this webSite :….. 26

email setup in the Dark Web –Onion Mail:….. 26

Dark Web Communication:……. 26

Paste Site:….. 26

Reason-:….. 27

PGP setup:……. 27

Reason-:….. 27

File transfer:……. 27

Reason:….. 27

Private Message Board:……. 27

Reason:….. 27

Jabber:……. 27

Reason:….. 27

Sock Puppet ways & methods:……. 28

Project Athena mission is to collect all Dark Web metadata & financial information and map it out………… 29

Dark Web Stats Pre-Crawl Feb 4, 2015:….. 29

Bitcoin Big Winner in the Dark Web….. 29

USSOCOM Monitoring Bitcoin in the clear web NOT the Dark Web:….. 29

Your secret ownership is encrypted:….. 30

Tax Problem:….. 31

The POWER of the Block-Chain:….. 31

Why we need Dark Web Bitcoin Data:….. 31

Dark Web Tool Setup……….. 33

Overview of Tool Setup for Dark Web Collection project……. 33

Technology Required -……. 33

  • Tor….. 33
  • 2 private Tor-Relays – entry and exit….. 33
  • Artemis – Tor Search Engine -w/ Privoxy and Popili Proxies….. 33
  • BlockChain 2 DB tool – to keep all Block-Chain queries PRIVATE….. 33
  • IRC….. 33
  • Bitcoin….. 33
  • VPN….. 33
  • i2p….. 33
  • secure email….. 33
  • PGP key for encryption….. 33
  • 3-5 Dark Web Sock Puppets – Buyer/Hacker/wingMan – Roles….. 33

Why use Amazon VPS service for my crawlers:….. 33

notes for setting everything up for Dark Web crawlers and Artemus search engine…….. 34

YOUTUBE – Video……. 35

torrc configuration file:….. 36

artemis is installed….. 37

sudo apt-get install tor….. 39

To run TOR as a different USER….. 39

checking if Tor is working….. 40

curl information for the crawlers:….. 41

How to use SOCKS proxy….. 44

tor tor-geoipdb privoxy:….. 44

Proxy setup Tor….. 46

CookieAuthentication 1….. 51

info httpproxy:….. 51

setup Privoxy port:….. 54

Onion00 and torStatus – PRIVATE Tor Public Node list for research….. 59

OnionOO setup……. 59

  1. Installing the metrics database….. 60

1.1. Preparing the operating system….. 60

Make Sun’s Java the default…… 62

1.2. Configuring the database….. 62

1.3. Importing relay descriptor tarballs….. 64

1.4. Importing relay descriptors from a local Tor data directory….. 65

1.5. Importing GeoIP information….. 65

1.6. Pre-calculating relay statistics….. 66

1.7. Generating network status information….. 66

1.8. Importing sanitized bridge descriptors….. 67

1.9. Importing Torperf performance data….. 67

1.10. Importing GetTor statistics….. 68

1.11. Migrating from an earlier metrics database schema….. 68

1.11.1. Migrating from metrics-web 0.0.1….. 69

  1. Installing the graphing engine….. 70
  2. Installing the metrics website….. 71

3.1. Configuring Apache HTTP Server….. 72

3.2. Configuring Apache Tomcat….. 73

999……….. 75



Visualization of Bitcoins in the Dark Web

gAtO is – working on a new toy for my Artemis Tor Search engine. I found these cool open source tools -CirCos data visualization- to map out my data visually and creating some cool points for any research.

Bitcoin mapped to the Dark Web

Bitcoin mapped to the Dark Web

Follow the money -> so a Bitcoin map of all the Tor websites I find may be cool, but we can also map it with email and PGP keys and Litecoin and other currencies. Anything we collect from the crawlers which is metadata and content we will be able to map it out on as many data points(keywords) and you want. Bitcoin and the Dark Web – Oh yeah I wrote a book–> – gAtO was right and WROTE the book 1 ½ years ago – Bitcoin in the Dark Web. – Now were going to add sock puppets and some social engineering to find the really good data in the Dark Web – Oh yeah DARPA MEMEX nice try I even have historical Dark Web data and my tools work today-  Were also collecting i2p data so it should be good for any cyber hunter – gAtO oUt.


Multiple Bitcoin wallets for a Business with Multiple Locations

gAtO wOrKiNg – on the business side, so I needed to create this Presentation to explain how my hd-wallet would work in a business.

Let’s say you have 8 Hair Salons and you wanted each store to have Bitcoin as a source of payment. Easy with my HD-wallet system you can safely deploy different Bitcoin wallets to all the stores and still maintain control of all the Bitcoins that your 8 Hair Salons take in. 

My KickStarter Project- https://www.kickstarter.com/projects/949677390/bitcoin-business-wallet

Your accountant will love the reporting of every BitcoinUserWalletTransaction – and of course the BIG question – Who do you call when your Bitcoin transaction does not work. We give you the tools to query the blockchain and get the answers to solve the problems.

Security – Privacy – Control – Management – Accountability

Simple GUI interface so anyone can use it – No Bitcoin Programing NeededEasy deployment all in your server, so you have total security. I also included Intelligent Multi-Sig Workflow to make Multi-sig wallets easy to use, approve and use by everyone.  Any input would be welcome – gAtO OuT 

Slide 1
Slide 2
Slide 3
Slide 4
Slide 5
Slide 6
Slide 7
SLide 8
SLide 9
Slide 10
Slide 11
SLide 12
SLide 13
SLide 14
Slide 15
Slide 16


3 Multi-Sig wallets for the price of 1 -maybe more

3 Multi-Sig wallets for the price of 1 -maybe more

a new Multi-Sig address scheme -Maybe- let me back-up —//|| A transactions has 2 parts – the LOCKING (INPUTS) of the ownership of the coins and the UN-LOCKING (OUTPUTs) of the ownership of the coins. multi-sig or not all TX are the same in the Bitcoin protocol.


Multi-Sig Sub-Wallets give business safety, management and accountability with my HD-BIP32 Business wallet

gAtO tEsTing  – my HD-wallet system adding multi-sig wallets to the mix. One of the strange but wonderful things I found is when you create a multi-sig wallet, the order of the INPUTS creates different addressed and redeemScripts. So I test it at the BitcoinD command line just to make sure.

A Mutli-sig wallet is different because it’s created out of other sub-wallets,  but the order in INPUTS makes a difference but the strange thing is to cash the multi-sig and sign them, you can still use any other of OUTPUTs – this test shows that any combination of signed OUTPUTs will unlock all 3 different multi-sig addresses for the price of 1.

I included the example below for you to test: Science is repeatable by anyone and so is the crypto and the math of Multi-sigs-

What I did was change the order of the sub-wallet INPUTS   – _01 – _02 – _03 – and – _02 – _03 – _01  -but the biggest surprised was when I tried to cheat –_03 – _01 –  _03  –   I used the 3rd wallet twice and it generated a Multi-sig. So in affect I just created a Multi-sig that only one (1) wallet has to sign it and it counts and 2.

By all rights the – _03 – _01 –  _03   – or any double of the sub-wallets defeats the purpose of 2 out of 3 signatures but working out new smart transactions multi-sig or not. Soon we will be able to do 3 out of 15 multi-sigs and other cool transactions stuff.

The other cool thing is my HD-wallet system will be able to manage, communicate and create any combination of multi-sig 2-n-3 sub-wallets for today, but as Bitcoin and others like Litecoin, DogeCoin or even an NxT transaction systems for really smart intelligent digital contracts. Business that work in this new digital coin game need a HD-BIP32 wallet system that works with their system. Without accountability even multi-sig wallets will not solve things in business. But when you can create and manage all transactions multi-sigs or regular sub-wallets, with accounting being able to safely get reports of all sub-wallets of all Multi-sig wallets and the coins or contracts they hold.

I’ll get of my soapbox –mEoW – play with the examples below – the cool thing it works, the beauty of crypto and math is you can’t cheat – it works or it doesn’t –

A new Multi-Sig address scheme – maybe -yes/no but by using multi-sig wallets the right way we Bitcoin can become safer – in my HD-BIP32 wallet you will be able to manage thousands if not millions of Multi-sig sub-wallets with 1 application – gAtO -oUt 



_01 sw_key_pair_as_sec: 03a7d8fbe19c3b9aba3b21cab655253bb954702e938312ff9141ee76700a3316ea

_02 sw_key_pair_as_sec: 022bcd0edd96fffae1d59853a5139948e632968d16240ee8bbedd8e964368ace1f

_03 sw_key_pair_as_sec: 02396b913639612c603471a39c780a49afabf9a45ea62d1edfda77e2e086061685

_01 – _02 – _03

bitcoind createmultisig 2 ‘[“03a7d8fbe19c3b9aba3b21cab655253bb954702e938312ff9141ee76700a3316ea“, “022bcd0edd96fffae1d59853a5139948e632968d16240ee8bbedd8e964368ace1f”, “02396b913639612c603471a39c780a49afabf9a45ea62d1edfda77e2e086061685“]’


“address” : “3MbDdx56fVjgsMWW7VmZhnxas4UJxAQbgf“,

“redeemScript” : “522103a7d8fbe19c3b9aba3b21cab655253bb954702e938312ff9141ee76700a3316ea21022bcd0edd96fffae1d59853a5139948e632968d16240ee8bbedd8e964368ace1f2102396b913639612c603471a39c780a49afabf9a45ea62d1edfda77e2e08606168553ae”


 _02 – _03_01

bitcoind createmultisig 2 ‘[“022bcd0edd96fffae1d59853a5139948e632968d16240ee8bbedd8e964368ace1f”, “02396b913639612c603471a39c780a49afabf9a45ea62d1edfda77e2e086061685“, “03a7d8fbe19c3b9aba3b21cab655253bb954702e938312ff9141ee76700a3316ea“]’


“address” : “3McoaAaTQR8NX4u1y1BxHf3FrWxqjzycHj“,

“redeemScript” : “5221022bcd0edd96fffae1d59853a5139948e632968d16240ee8bbedd8e964368ace1f2102396b913639612c603471a39c780a49afabf9a45ea62d1edfda77e2e0860616852103a7d8fbe19c3b9aba3b21cab655253bb954702e938312ff9141ee76700a3316ea53ae”


_03_01 –  _02

bitcoind createmultisig 2 ‘[“02396b913639612c603471a39c780a49afabf9a45ea62d1edfda77e2e086061685“, “03a7d8fbe19c3b9aba3b21cab655253bb954702e938312ff9141ee76700a3316ea“, “022bcd0edd96fffae1d59853a5139948e632968d16240ee8bbedd8e964368ace1f”]’


“address” : “3LYZsV7NaMaGhdbtdwvBwFJcs63QiYzzeF“,

“redeemScript” : “522102396b913639612c603471a39c780a49afabf9a45ea62d1edfda77e2e0860616852103a7d8fbe19c3b9aba3b21cab655253bb954702e938312ff9141ee76700a3316ea21022bcd0edd96fffae1d59853a5139948e632968d16240ee8bbedd8e964368ace1f53ae”


_03 – _01 –  _03

bitcoind createmultisig 2 ‘[“02396b913639612c603471a39c780a49afabf9a45ea62d1edfda77e2e086061685“, “03a7d8fbe19c3b9aba3b21cab655253bb954702e938312ff9141ee76700a3316ea“, “02396b913639612c603471a39c780a49afabf9a45ea62d1edfda77e2e086061685“]’


“address” : “3FEAsZ8KDvodHmTQy2rnWKknQWKCuazdLC“,

“redeemScript” : “522102396b913639612c603471a39c780a49afabf9a45ea62d1edfda77e2e0860616852103a7d8fbe19c3b9aba3b21cab655253bb954702e938312ff9141ee76700a3316ea2102396b913639612c603471a39c780a49afabf9a45ea62d1edfda77e2e08606168553ae”




Looking for Investors in my BIP32 Business wallets.

gAtO bAcK – I am almost finished with my BIP32 Business wallet and I need investors to finish it up and make it pretty and then get it into the business community so they can also have a Bitcoin Business wallet designed for business not an individual.

If you want to see a video of the wallet demo just come on over and check out my Wallet Demohttp://youtu.be/gOPdFPHNByk If you have any comment or suggestions please contact me. – gAtO oUt


Tor Traffic Confirmation Attack

Tor Traffic Confirmation Attack -Roger Dingledine Report
  On July 4 2014 we found a group of relays that we assume were trying
  to deanonymize users. They appear to have been targeting people who
  operate or access Tor hidden services. The attack involved modifying
  Tor protocol headers to do traffic confirmation attacks.gato_signal_02

  The attacking relays joined the network on January 30 2014, and we
  removed them from the network on July 4. While we don't know when they
  started doing the attack, users who operated or accessed hidden services
  from early February through July 4 should assume they were affected.

  Unfortunately, it's still unclear what "affected" includes. We know
  the attack looked for users who fetched hidden service descriptors,
  but the attackers likely were not able to see any application-level
  traffic (e.g. what pages were loaded or even whether users visited
  the hidden service they looked up). The attack probably also tried to
  learn who published hidden service descriptors, which would allow the
  attackers to learn the location of that hidden service. In theory the
  attack could also be used to link users to their destinations on normal
  Tor circuits too, but we found no evidence that the attackers operated
  any exit relays, making this attack less likely. And finally, we don't
  know how much data the attackers kept, and due to the way the attack
  was deployed (more details below), their protocol header modifications
  might have aided other attackers in deanonymizing users too.

  Relays should upgrade to a recent Tor release ( or, to close the particular protocol vulnerability the
  attackers used -- but remember that preventing traffic confirmation in
  general remains an open research problem. Clients that upgrade (once
  new Tor Browser releases are ready) will take another step towards
  limiting the number of entry guards that are in a position to see
  their traffic, thus reducing the damage from future attacks like this
  one. Hidden service operators should consider changing the location of
  their hidden service.

  We believe they used a combination of two classes of attacks: a traffic
  confirmation attack and a Sybil attack.

  A traffic confirmation attack is possible when the attacker controls
  or observes the relays on both ends of a Tor circuit and then compares
  traffic timing, volume, or other characteristics to conclude that the
  two relays are indeed on the same circuit. If the first relay in the
  circuit (called the "entry guard") knows the IP address of the user,
  and the last relay in the circuit knows the resource or destination
  she is accessing, then together they can deanonymize her. You can read
  more about traffic confirmation attacks, including pointers to many
  research papers, at this blog post from 2009:

  The particular confirmation attack they used was an active attack where
  the relay on one end injects a signal into the Tor protocol headers,
  and then the relay on the other end reads the signal. These attacking
  relays were stable enough to get the HSDir ("suitable for hidden
  service directory") and Guard ("suitable for being an entry guard")
  consensus flags:
  Then they injected the signal whenever they were used as a hidden
  service directory, and looked for an injected signal whenever they
  were used as an entry guard.

  The way they injected the signal was by sending sequences of "relay"
  vs "relay early" commands down the circuit, to encode the message they
  want to send. For background, Tor has two types of cells: link cells,
  which are intended for the adjacent relay in the circuit, and relay
  cells, which are passed to the other end of the circuit.
  In 2008 we added a new kind of relay cell, called a "relay early"
  cell, which is used to prevent people from building very long paths
  in the Tor network (very long paths can be used to induce congestion
  and aid in breaking anonymity):
  But the fix for infinite-length paths introduced a problem with
  accessing hidden services:
  and one of the side effects of our fix for bug 1038 was that while
  we limit the number of outbound (away from the client) "relay early"
  cells on a circuit, we don't limit the number of inbound (towards the
  client) relay early cells:

  So in summary, when Tor clients contacted an attacking
  relay in its role as a Hidden Service Directory to publish
  or retrieve a hidden service descriptor (steps 2 and 3 on
  https://www.torproject.org/docs/hidden-services), that relay would
  send the hidden service name (encoded as a pattern of relay and
  relay-early cells) back down the circuit. Other attacking relays,
  when they get chosen for the first hop of a circuit, would look for
  inbound relay-early cells (since nobody else sends them) and would
  thus learn which clients requested information about a hidden service.

  There are three important points about this attack:

  A) The attacker encoded the name of the hidden service in the injected
  signal (as opposed to, say, sending a random number and keeping a local
  list mapping random number to hidden service name). The encoded signal
  is encrypted as it is sent over the TLS channel between relays. However,
  this signal would be easy to read and interpret by anybody who runs
  a relay and receives the encoded traffic. And we might also worry
  about a global adversary (e.g. a large intelligence agency) that
  records Internet traffic at the entry guards and then tries to break
  Tor's link encryption. The way this attack was performed weakens Tor's
  anonymity against these other potential attackers too -- either while
  it was happening or after the fact if they have traffic logs. So if
  the attack was a research project (i.e. not intentionally malicious),
  it was deployed in an irresponsible way because it puts users at risk
  indefinitely into the future.

  (This concern is in addition to the general issue that it's probably
  unwise from a legal perspective for researchers to attack real users
  by modifying their traffic on one end and wiretapping it on the
  other. Tools like Shadow are great for testing Tor research ideas out
  in the lab: http://shadow.github.io/ )

  B) This protocol header signal injection attack is actually pretty neat
  from a research perspective, in that it's a bit different from previous
  tagging attacks which targeted the application-level payload. Previous
  tagging attacks modified the payload at the entry guard, and then
  looked for a modified payload at the exit relay (which can see the
  decrypted payload). Those attacks don't work in the other direction
  (from the exit relay back towards the client), because the payload
  is still encrypted at the entry guard. But because this new approach
  modifies ("tags") the cell headers rather than the payload, every
  relay in the path can see the tag.

  C) We should remind readers that while this particular variant of
  the traffic confirmation attack allows high-confidence and efficient
  correlation, the general class of passive (statistical) traffic
  confirmation attacks remains unsolved and would likely have worked
  just fine here. So the good news is traffic confirmation attacks
  aren't new or surprising, but the bad news is that they still work. See
  https://blog.torproject.org/blog/one-cell-enough for more discussion.

  Then the second class of attack they used, in conjunction with their
  traffic confirmation attack, was a standard Sybil attack -- they
  signed up around 115 fast non-exit relays, all running on
  or Together these relays summed to about 6.4% of the
  Guard capacity in the network. Then, in part because of our current
  guard rotation parameters:
  these relays became entry guards for a significant chunk of users over
  their five months of operation.

  We actually noticed these relays when they joined the network, since
  the DocTor scanner reported them:
  We considered the set of new relays at the time, and made a decision
  that it wasn't that large a fraction of the network. It's clear there's
  room for improvement in terms of how to let the Tor network grow while
  also ensuring we maintain social connections with the operators of all
  large groups of relays. (In general having a widely diverse set of relay
  locations and relay operators, yet not allowing any bad relays in,
  seems like a hard problem; on the other hand our detection scripts did
  notice them in this case, so there's hope for a better solution here.)

  In response, we've taken the following short-term steps:

  1) Removed the attacking relays from the network.
  2) Put out a software update for relays to prevent "relay early" cells
     from being used this way.
  3) Put out a software update that will (once enough clients have
     upgraded) let us tell clients to move to using one entry guard
     rather than three, to reduce exposure to relays over time.
  4) Clients can tell whether they've received a relay or relay-cell.
     For expert users, the new Tor version warns you in your logs if
     a relay on your path injects any relay-early cells: look for the
     phrase "Received an inbound RELAY_EARLY cell".

  The following longer-term research areas remain:

  5) Further growing the Tor network and diversity of relay operators,
     which will reduce the impact from an adversary of a given size.
  6) Exploring better mechanisms, e.g. social connections, to limit the
     impact from a malicious set of relays. We've also formed a group to
     pay more attention to suspicious relays in the network:
  7) Further reducing exposure to guards over time, perhaps by extending
     the guard rotation lifetime:
  8) Better understanding statistical traffic correlation attacks and
     whether padding or other approaches can mitigate them.
  9) Improving the hidden service design, including making it harder
     for relays serving as hidden service directory points to learn what
     hidden service address they're handling:

  Q1) Was this the Black Hat 2014 talk that got canceled recently?
  Q2) Did we find all the malicious relays?
  Q3) Did the malicious relays inject the signal at any points besides
      the HSDir position?
  Q4) What data did the attackers keep, and are they going to destroy it?
      How have they protected the data (if any) while storing it?

  Great questions. We spent several months trying to extract information
  from the researchers who were going to give the Black Hat talk, and
  eventually we did get some hints from them about how "relay early"
  cells could be used for traffic confirmation attacks, which is how
  we started looking for the attacks in the wild. They haven't answered
  our emails lately, so we don't know for sure, but it seems likely that
  the answer to Q1 is "yes". In fact, we hope they *were* the ones doing
  the attacks, since otherwise it means somebody else was. We don't yet
  know the answers to Q2, Q3, or Q4.