I think the "why I now think Tor is the devil" question is answered in the opening—because it has illegal/immoral stuff on it. I'm not sure why anyone would be surprised about this though...

EDIT: In fact, I don't think that the security scanner was even that effective: "around 5-10% of the registered users chose to run the scanner" (later, he changes this to 4-7%) and that "some of the users who opted to run the software appeared to be government or private researchers". I don't know what percentage of people using Tor for illegal activity would be incautious enough to run some random program on their computer, but I would be surprised if it was very high.

I think it would certainly depend on the type of "illegal activity"; it's quite plausible that those looking for drugs or counterfeiting are going to have much higher suspicion and opsec than porn-driven pedophiles, leading to the difference in number of registrations at each honeypot.

might be a typo, but just in case - a 'tenet' is a rule or principle, a 'tenant' is an occupier.

The exit node IP is not totally useless. It's enough to prompt a knock on your door by the authorities. Granted, once they recognize you're running an exit node there's nothing they can do (otherwise Charter could also be held liable) but still, it can prompt an action by the authorities.

My guess that they some were researchers: at least one came from a university IP address while others were very bare-bone machines with minimal running services, possibly virtual machines or test boxes.

The Tor project does a lot of work to make operating an exit node safer and less likely to prompt the authorities to intervene. This is good, because even if the authorities did want to talk to exit node providers, those people _couldn't_ provide any useful logs.

> First, the pedo site saw magnitudes more traffic than the counterfeiting or drugs websites – in the order of 100 times more traffic than the other two combined.

When someone wants to use the DNMs, they start at http://deepdotweb.com/ , http://thehub7gqe43miyc.onion/ , http://darknetmarkets.reddit.com/ or http://www.gwern.net/Black-market%20survival ; these are curated community lists, which people use to avoid falling for phishing links and scams.

Just look at the traffic stats for the one subreddit: https://www.reddit.com/r/DarkNetMarkets/about/traffic/ !

DNM users do not start at a random .onion because that is a recipe for being the latest victim of 'Drug Market' and other longstanding onion scams.

OP appears to have made no effort to get his honeypot into any of the standard sources of DNM info, and accordingly, he got no traffic. This is exactly as one would hope, and says more about how badly he bungled the drugs honeypot (and conversely, how pathetic the security of the pedo community is) than about any ratio of pedos to drug buyers.

(This is a similar problem as the paper which counts .onions and argues that pedophiles are 99% or whatever of hidden-service traffic; the differing communities using hidden-services simply don't work the way that OP or that paper assumed for ease of making wild claims. Counting onion addresses does not work because the pedo sites tend to change onions constantly while the huge blackmarkets like Agora stick at a single onion like agorahooawayyfoe.onion for months or years; counting visits to a lame honeypot like OP's does not work because with no advertising, vetting, or sellers, no one would bother with his honeypot when they could use Agora, Nucleus, Abraxas, or other established markets with broad offerings.)

The biggest thing he demonstrated is that a percentage of pedos would run an executable from some guy on Tor if he asks nicely. How can it be hard for the FBI to catch those guys?