A third of all dark web domains are now v3 onion sites
Image: Rafael Garcin
Catalin Cimpanu November 23, 2021

A third of all dark web domains are now v3 onion sites

A third of all dark web domains are now v3 onion sites

Throughout 2020 and 2021, the Tor anonymity network has gone through a major change as the Tor software team has released a new version of its software that updated how .onion domains look and work.

More specifically, the Tor Project has done away with 16-character-long .onion domains, also known as v2 addresses, and replaced them with 56-character-long domains, known as v3.

The move, driven by a need to improve the Tor network’s privacy, security, and resilience to deanonymization attacks, was announced years in advance, and the entire process took more than a year to complete:

  • September 2020 – The Tor Project releases v0.4.4 of the Tor anonymity software that warns server operators that v2 domains will soon be obsolete.
  • July 2020 – Tor developers release Tor v0.4.6, which blocks server owners from registering v2 onion domains.
  • October 2021 – Stable versions are released for all Tor branches that remove support for v2 domains.
  • November 2021 – The Tor Project releases Tor Browser 11 that removes support for v2 domains.

But despite the Tor team’s best efforts to announce the move in advance, new numbers compiled and released by dark web monitoring company DarkOwl show that the Tor network is still made up in large part of servers running older v2 domains.

“In the last six weeks, DarkOwl’s Vision platform has observed an average of 104,095 active .onion services across both address schemes of which: 62% are v2 addresses and 38% are v3 addresses,” the company said last week.

v2-v3-onion
Image: DarkOwl

DarkOwl says it detected a spike in new v3 domains in July 2021, which coincided with the Tor team adding a fullscreen warning before accessing v2 domains in preparation for the browser’s v11 release this fall.

This resulted in more than 2,900 v3 domains being registered in the last two weeks of July alone.

However, as the Tor team noted in its own v2-to-v3 analysis in September, the number of v3 domains is trending up.

Currently, new v2 domains can’t be registered on the Tor network anymore, and users can access existing sites only by using an older version of the Tor Browser, where v2 domains are still loadable.

However, while the number of v3 sites is still below 50%, everyone expects v2 sites to go extinct in the coming year. The reason is that as most Tor node operators will update their servers to versions that will not support v2 domains, there will be no Tor relays capable of routing the traffic to these old-gen domains.

Catalin Cimpanu is a cybersecurity reporter for The Record. He previously worked at ZDNet and Bleeping Computer, where he became a well-known name in the industry for his constant scoops on new vulnerabilities, cyberattacks, and law enforcement actions against hackers.