The Dark Web, primarily Tor, has evolved to protect user privacy and freedom of speechthrough anonymous routing. However, Tor also facilitates cybercriminal actors who utilize it for illicitactivities. Quantifying the size and nature of such activity is challenging, as Tor complicates indexing bydesign. This paper proposes a methodology to estimate both size and nature of illicit commercial activityon the Dark Web. We demonstrate this based on crawling Tor for single-vendor Dark Web Shops, i.e., niche storefronts operated by single cybercriminal actors or small groups. Based on data collected fromTor, we show that just in 2021, Dark Web Shops generated at least 113 million USD in revenue. Sexualabuse is the top illicit revenue category, followed by financial crime at a great distance. We also compareDark Web Shops' activity with a large Dark Web Marketplace, showing that these are parallel economies. Ourmethodology contributes towards automated analysis of illicit activity in Tor. Furthermore our analysis shedslight on the evolving Dark Web Shop ecosystem and provides insights into evidence-based policymakingregarding criminal Dark Web activity. |