Since darknet marketplaces became popular, many came online and went offline after a short time, often taken down by law enforcement or performing exit scams. In order to succeed in running a darknet marketplace, operators need to earn trust from the users of their platform. However, in anonymous environments like darknet marketplaces, it can be difficult to determine which technical measures or policies intended to build trust can actually be trusted.In this paper we evaluate the trustworthiness of the darknet marketplace UnderMarket 2.0. By scraping and analyzing data from the marketplace, we reveal that numerous fraud indicators exist. We show in a further evaluation that UnderMarket 2.0 intentionally uses various measures to gain trust in order to defraud customers.

Descriptives of the darknet, and in particular of the Tor network, appear inconsistent and implausible in nature. In order to gain insight into how these conflicting results are produced, the goal of this study is to review previous research on the matter with regard to terminology used, methodology of sample collection and the analysis of the data. Our results indicate six critical aspects that in particular pertain to (A) an inconsistent use of terminology, (B) the methodology with which the sample was gathered, as well as the handling of (C) short-lived services, (D) botnet command and control servers, (E) web services with undetermined content and (F) duplicates of onion services. Further, we include a small case study on darknet marketplaces to demonstrate how reports concerning the number of a certain category can easily mislead. Through the implications of these aspects the presented description of Tor does not necessarily reflect the actual nature of Tor.

In the Tor-network are many single-vendor marketplace web sites with a wide range of offers. Some of these vendor websites could be hosted by the same operators. In this paper, a method is presented to find out similarities between these vendor websites to discover possible operational structures between them. In order to accomplish this, similarity values are determined between the darknet websites by combining various features from the different categories structure, content and metadata. A dataset is determined by a first execution of the method and manual validation. Based on this data set, important features are extracted using decision trees. The features of the category structure HTML-Tag, HTML-Class, HTML-DOM-Tree as well as the metadata features File Content and Links-To have proven to be particularly important and can very effectively highlight similarities between darknet web sites. Supported by the similarity detection method, it was found that only 49% of 258 single-vendor marketplaces were unique, i.e. no similar sites existed. In addition, it was possible to find several duplicates of vendor websites, which made up 20%.

Tor is a widely-used anonymity network with more than two million daily users. A special feature of Tor is the hidden service architecture. Hidden services are a popular method for anonymous communication or sharing web contents anonymously. A specialty in Tor is that all data packets that are sent are structured completely identical for security reasons. They are encrypted using the TLS protocol and have a fixed size of exactly 512 bytes. In an earlier implementation, Tor was an example of networks without generated traffic noise to make traffic analysis more difficult. In this work we describe a method to deanonymize any hidden service on Tor based on traffic analysis, which is a threat to anonymity online. This method allows an attacker with modest resources to deanonymize any hidden services in less than 12.5 days.