Tor Bot

TorBot is an open-source Python tool available on GitHub that automates the crawling and analysis of Tor hidden services. Developed by DedSecInside, it connects through the Tor network to crawl .onion websites, extract links, gather page metadata, and build a map of a target dark web site's structure and external link network.

For OSINT investigators working on dark web cases, TorBot addresses the time-intensive challenge of manually navigating and mapping complex dark web sites. When investigating a dark web marketplace, forum, or communication platform, understanding the site's full structure — including pages, linked resources, external references, and embedded content — requires systematic crawling that TorBot automates.

Key capabilities include: recursively following links from a starting onion URL to map the full accessible site structure, extracting contact information (email addresses, Bitcoin addresses, PGP keys) embedded in pages, identifying external links from the target site that may reveal affiliated infrastructure, and gathering page titles and metadata for rapid site characterization.

The link extraction capability is particularly valuable for network analysis. When TorBot crawls a dark web forum and extracts all external links, investigators can identify which other dark web sites the target links to — potentially revealing affiliated markets, mirror sites, or operator-controlled infrastructure.

Bitcoin address extraction is useful for cryptocurrency tracing. When TorBot finds Bitcoin addresses embedded throughout a dark web site, investigators can feed those addresses into blockchain analysis tools to map the financial infrastructure of the operation.

Operational security requirements: TorBot must be run with all traffic routed through Tor. Use in an isolated investigation environment. Only crawl sites within your investigative scope and legal authority. Dark web crawling can generate logs on target servers — operations on sensitive targets should be conducted with appropriate tradecraft.

Document the starting URL, crawl scope, timestamp, and all findings. Preserve the raw output files for case records.