Pivot map
Pivot from here
Outputs from Tor Bot can become inputs for the next tool. These are the most relevant follow-on pivots in the library.
A global, open, stable, and secure Internet that serves the entire Asia Pacific community
ARIN is a nonprofit, member-based organization that administers IP addresses & ASNs in support of the operation and growth of the Internet.
AbuseIPDB provides IP reputation data and community abuse reports for identifying malicious hosts in network and threat investigations.
AccountKiller provides direct deletion links and step-by-step instructions for removing accounts on hundreds of websites and social platforms.
Lookup email addresses and mailing addresses with reverse email search to identify people and organizations in OSINT investigations.
Addresses.com provides US residential address lookups, reverse phone searches, and people finder tools for locating individuals.
Ancestry search provides access to billions of historical records including census data, vital records, immigration documents, and family trees.
Canada411 is Canada's people directory for finding individuals by name, providing addresses and phone numbers for OSINT investigations.
AccountKiller provides direct deletion links and step-by-step instructions for removing accounts on hundreds of websites and social platforms.
Lookup email addresses and mailing addresses with reverse email search to identify people and organizations in OSINT investigations.
Addresses.com provides US residential address lookups, reverse phone searches, and people finder tools for locating individuals.
Algo VPN automates deployment of a personal WireGuard or IKEv2 VPN server in the cloud for private, secure OPSEC browsing.
Investigator Use
TorBot is an open-source Python tool available on GitHub that automates the crawling and analysis of Tor hidden services. Developed by DedSecInside, it connects through the Tor network to crawl .onion websites, extract links, gather page metadata, and build a map of a target dark web site's structure and external link network.
For OSINT investigators working on dark web cases, TorBot addresses the time-intensive challenge of manually navigating and mapping complex dark web sites. When investigating a dark web marketplace, forum, or communication platform, understanding the site's full structure — including pages, linked resources, external references, and embedded content — requires systematic crawling that TorBot automates.
Key capabilities include: recursively following links from a starting onion URL to map the full accessible site structure, extracting contact information (email addresses, Bitcoin addresses, PGP keys) embedded in pages, identifying external links from the target site that may reveal affiliated infrastructure, and gathering page titles and metadata for rapid site characterization.
The link extraction capability is particularly valuable for network analysis. When TorBot crawls a dark web forum and extracts all external links, investigators can identify which other dark web sites the target links to — potentially revealing affiliated markets, mirror sites, or operator-controlled infrastructure.
Bitcoin address extraction is useful for cryptocurrency tracing. When TorBot finds Bitcoin addresses embedded throughout a dark web site, investigators can feed those addresses into blockchain analysis tools to map the financial infrastructure of the operation.
Operational security requirements: TorBot must be run with all traffic routed through Tor. Use in an isolated investigation environment. Only crawl sites within your investigative scope and legal authority. Dark web crawling can generate logs on target servers — operations on sensitive targets should be conducted with appropriate tradecraft.
Document the starting URL, crawl scope, timestamp, and all findings. Preserve the raw output files for case records.
Before You Pivot
Capture the target, search terms, and why this source is relevant before you leave the page.
Archive volatile pages, save screenshots, and keep timestamps for anything that may change.
Treat one tool as a lead source. Confirm important findings with independent sources.
Related tools
Ahmia indexes Tor hidden services, enabling investigators to search .onion sites by keyword without the Tor browser.
BlackWeb is a community-maintained blacklist of malicious and spam domains for network filtering and threat infrastructure identification.
IACA Dark Web Tools is a law enforcement-oriented collection of resources for searching Tor hidden services and dark web content.
Onioff inspects .onion URLs to verify availability, extract page metadata, and map Tor hidden service content for dark web OSINT.
Find the best onion links list here. Working onion links for 2025 with the best dark web links to explore. All working and updated.
OnionScan investigates dark web sites for misconfigurations, operator errors, and links to clearnet infrastructure revealing real identities.