Observing Hidden Service Directory Spying with a Private Hidden Service Honeynet

Tor's location hidden services (HS) are a tool for anonymous publishing, with the feature that the sites cannot be brought down without taking down the whole Tor network. People run HSs for a multitude of reasons. Some like them to be public, but others want to keep them their existence as private. We have run private unannounced HSs to detect whether the HS directory is spied on. Our results show that the hidden service directory is monitored for new addresses. This paper details the observations made from the scanning activity.