Tor onion services can be accessed and hosted anonymously on the Tor network.We analyze the protocols, software types, popularity and uptime ofthese services by collecting a large amount of .onion addresses. Websites arecrawled and clustered based on their respective language. In order to alsodetermine the amount of unique websites a de-duplication approach is implemented.To achieve this, we introduce a modular system for the real-timedetection and analysis of onion services. The overall data

more »

... vealsthat a large amount of permanent services provide no actual content for Torusers. A significant part consists instead of bots, services offered via multipledomains, or duplicated websites for phishing attacks. The total amount ofonion services is thus significantly smaller than current statistics suggest