Police Seized Fake Tor Domains, Not the Real Sites

For privacy advocates, Tor remains a vital tool. For law enforcement, it presents persistent challenges. Tor’s ability to anonymize traffic and obscure server locations has long made it a preferred platform for darknet services and criminal marketplaces. Recently, authorities announced what they called a major success: the seizure of 414 domains associated with hidden services.

However, further analysis suggests the results were not as clear-cut as officials claimed. Australian technologist Nik Cubrilovic carried out a focused crawl of the darknet and concluded that only 276 addresses had actually been taken down. Of those, roughly 153 were not original hidden services at all but rather clones, phishing pages, or scam sites impersonating the targeted services.

Officials attributed their takedowns to exploitation of a rare vulnerability in Tor itself, a claim that Tor Project developers strongly dispute. In a public statement, the project explained that the most plausible explanation for the arrests and domain seizures was poor operational security by several operators. According to the Tor Project, a few compromised individuals likely provided information that led investigators to others during questioning.

Tor’s reputation as a robust anonymity tool has also made it a point of concern within intelligence communities. Documents released by Edward Snowden showed internal frustration at the NSA over the difficulty of monitoring users who rely on Tor. One internal memo stated bluntly, “We will never be able to de-anonymise all Tor users all the time.”

That said, some reporting suggests intelligence agencies may still collect IP addresses or other metadata related to Tor activity in certain circumstances. Critics warn that simply visiting or researching Tor-related content could result in some level of logging by network operators or monitoring entities. The extent and legality of such collection vary by jurisdiction and the specifics of the surveillance effort.

To understand how Tor came to occupy this contested role, it helps to look at its origins. Tor began as a research project developed and funded by the U.S. Naval Research Laboratory in the late 1990s to help government personnel protect their online identities. Over time, independent developers rebuilt and expanded the software. Today the Tor network and software are maintained and coordinated by the Tor Project, a nonprofit organization based in Massachusetts.

Andrew Lewman, the Tor Project’s former head of operations, told the BBC that the project monitors attempts to undermine Tor from inside intelligence agencies and sometimes receives warnings from insiders who report discovered weaknesses. Those alerts allow Tor developers to patch vulnerabilities and strengthen protections for users.

Debate over Tor’s role in privacy, security, and criminal activity continues. Supporters emphasize the importance of strong anonymity tools for whistleblowers, journalists, and dissidents operating under repressive regimes. Law enforcement highlights the network’s misuse by criminals and the investigative challenges it poses. The balance between enabling privacy and preventing abuse remains a central tension.

What do you think about Tor and other anonymizing services? Share your thoughts in the comments.