Livestreamed pedophilia, a massive stolen credit card market, but smaller than one might expect: This is the dark web

It’s not often that the average citizen goes on a tour of the corners of the dark web, which can be a sinister, dangerous, and dirty place. That’s why a team of Spanish researchers created an original robot that rummaged through its haunts in order to create one of the most accurate maps of the dark web to date. Its primary finding is that criminal content is not as extensive as it may seem. The majority of the dark web’s sites are mere mirrors that replicate the content of others so that they are easier to find.

The study marks the first time the magnitude of these dark mirrors has been quantified. “This is the first measurement of mirrors on this scale within the Tor network [the official name of the dark web]. It hadn’t been done before, because the methodology is not simple, because mirrors aren’t identical copies. You have to account for small changes that inherently occur when cloning a site,” says Guillermo Suárez-Tangil, a researcher at Imdea Networks and one of the study’s co-authors.

His team found a total of only 4,008 original, potentially criminal sites out of a total of 29,911. That means that only 16% of sites with suspicious content on the dark web are unique, with the vast majority being duplicates. This does not necessarily imply that the dark web is small, only that it is smaller than previously believed. At least, the part with dangerous content — because the dark web is much more than potential criminal activity.

Some of these sites may contain forums or menus with a huge number of pages and users: “Our bot is designed to access illicit content, so we can’t generalize about the entire dark web. We can say that the ecosystem of illicit content is more limited than previously thought. And each individual site can vary in size. Our crawler operates horizontally — it does not drill down to second or third-level linked pages,” explains Suárez-Tangil.

Accessing the dark web requires a different browser, Tor, which is a modified version of Firefox designed so that users remain anonymous. On its network, domains are not “.com” but rather “.onion” and they cannot be found using conventional search engines. Their addresses are not indexed, but rather, long strings of characters that frequently change and disappear. To navigate, users turn to specific search engines or link directories that function as manual indexes.

These indexes, which make up a category called “hosting,” are a source of suspicion on the dark web. Another is falsification, primarily the kind associated with the sale of stolen credit cards. “The ecosystem of the buying and selling of stolen credit cards is huge, and it is very volatile, because they work until they are canceled by their owners,” says Sergio Pastrana, a professor at Spain’s Carlos III University and co-author of the study.

Another shadowy area of the dark web is that of porn and explicit sexual content. This category is made up of the sale of access accounts, verified pages and other shady dealings on sites like OnlyFans and Pornhub — in addition to child pornography.

“What has surprised us most is finding sites that offer the livestreaming of videos featuring minors — not just pre-recorded material, but interactive webcams,” says Suárez-Tangil. “We detected 159 unique sites (505 of them including mirrors) distributing child abuse materials. Several remain active nearly three years later, and have been reported to law enforcement,” he adds.

The anonymity granted by Tor protects dissidents, but also criminals. But this is not the only obstacle law enforcement faces in stopping its horrific practices, which have long been reported. There is also an issue of jurisdiction, says Alfonso Rodríguez, a researcher at Imdea Networks and Carlos III University who is also a co-author of the study. “The websites may not be hosted within national territory, but rather, in countries with different legal frameworks, political priorities, or slower and more difficult mechanisms for international cooperation. That’s why it’s not just a matter of detecting a website and reporting it. Rather, it’s a global problem that requires cooperation.”

The study cannot provide any kind of profile of dark web users. “Our metrics do not track visits, so we don’t know if a site is visited by hundreds of people or just a few, nor what kind of users they are,” says Suárez-Tangil. However, they have been able to piece together a rough profile of some of those users, says Rodríguez. “Contrary to what most people think, the dark web isn’t inherently a perverse place. Even in the depths of the internet, child pornography is strongly frowned upon. In my experience, almost all sites labeled as pornography without child content explicitly — and sometimes even threateningly — stated that child content was strictly prohibited on this platform.”

Sign up for our weekly newsletter to get more English-language news coverage from EL PAÍS USA Edition