# Tor Hidden Services: A Systematic Literature Review
## 5 Results and Discussion
### What Are the Main Research Areas and the Main Findings Regarding HS?
#### 5.1.2 Content Classification  
The second topic most often addressed by researchers is the classification of content hosted or offered in hidden services. It is interesting to mention that, as far as we know, the first article that deals with this topic was written in 2013, although Tor was offering hidden services in 2004. In this first paper on content classification [31], [PERSON] used three databases that listed extensive numbers of hidden services. They obtained a total of 1171 individual entries, which they then reviewed and manually classified into 23 categories. They concluded that 45% of all available HS host unethical or illegal content. [PERSON] et al. [32] also did a search for.onion addresses and as a first step found 8153 addresses, but of these, only 1813 were functional services and these were sorted into 18 categories. The results were similar to [PERSON]'s research we explained above, since they found that 44% are dedicated to illegal services, and the remaining 56% are dedicated to different subjects that do not pose any real danger--for example, policy and anonymity forums, information resources, pages similar to WikiLeaks, and pages that provide different anonymous services, such as mail or anonymous hosting. In addition, [PERSON] et al. [32] tried to determine which the most popular Hidden services were. Their article gave the first place to an HS belonging to a zombie network structure called \"Goldnet\". Similarly, [PERSON] et al. [25] suggested that although the list of top 10 HS included services related to BotNets, the most popular HS at that moment was Silk Road, which was shut down by the FBI in 2013. In the same way but with different results, [PERSON] and [PERSON] [34] found that the first place was given to HS related to abuse, although for ethical reasons they did not specify what types of abuse, nor make their.onion addresses public. The latest study, which is from 2019, shows that the most popular service is dedicated to drugs and narcotics [44]. Although none of them agreed on what is truly the most popular and influential HS, it can be inferred that the best-positioned services are those related to illicit content. Different means of classification were presented by several authors [33, 38, 43]. They applied data mining techniques based on classification models to over a thousand hidden Tor services, to model their thematic organisation and linguistic diversity. Their results indicate that most of the hidden services display illegal or controversial content. In contrast, [PERSON] and [PERSON] [34] returned to manual study and classification, suggesting that given the variety and complex technical nature of some content, automatic classifiers would be insufficient, due to the difficulty of interpreting the context completely. Other documentation of a manual classification reviewing 3480 HS was prepared by [PERSON] and [PERSON] [42], but they claimed that only 38% of the servers found offer illegal services. On the other hand, [PERSON] et al. [37] presented ATOL (Automated Tool for Onion Labeling), a classification tool which includes a new discovery mechanism using keywords and a classification framework using image recognition, which was also used and replicated by [PERSON] et al. [39]. Another article showing a classification mechanism using image recognition was written by [PERSON] et al. [41]. They applied improved techniques, selecting only the regions with the most outstanding information, through what is known, in machine learning, as the bag of visual words. These investigators focused on classifying services that host suspicious or illegal content, in an attempt to collaborate with entities that combat crimes involving human trafficking and child pornography. Another scientific article showed that the vast majority of hidden services are offered in English, approximately 73.28%, and only 2.14% are offered in Spanish [40]. In the same article, the authors highlighted that there is a clear connection between the normal Internet or surface web and many hidden services.