Security researchers at Trend Micro used Tor honeypots to conduct a six-month study of the attack landscape of the Dark Web. Researchers operated a honeypot setup simulating several underground services on Dark Web in order to analyze the way they were targeted. The services running on honeypots were deliberately affected by a number of vulnerabilities to allow attackers to hack them. The researchers recorded all logs after every successful attack and restored the environment to a clean state each day. Many attacks originated from Tor proxies like Tor2web that allows reaching hidden services from the clear web.”]
Source: http://securityaffairs.co/wordpress/59962/deep-web/dark-web-attack-landscape.html