Have you ever wondered which clearnet web domains (as in not onions) are the most popular among users of The Onion Router project (Tor)? Is there any evidence to support the popular mainstream opinion that Tor is predominantly used by people with malicious and criminal intent? To add some spice to this question in 2026, I’ve aggregated non-identifiable data based on DNS queries made by my five Tor exit relays.

It’s a dirty job, but somebody’s got to do it. Well, actually, that’s not quite true. I’ve been mirroring this blog as an onion site since 2016, so I figured it was time to contribute a little time, effort, and money towards the infrastructure of the Tor network. Besides, running Tor relays has always been on my bucket list, and I am getting old. No more time to waste ;)

My plan was to have a Zimbra e-mail server running in VirtualBox using the internal networking model with a local domain. To make this work, I have a virtual pfSense box running on the same internal network to provide “outside” access. Additionally, pfSense is also running a DNS resolver so I figured it would be a trivial matter to add the local records I needed.