Recorded Future analysts have analyzed how the dark web (TOR) is being used for the good, the bad, and the ugly. We focus on a few use cases: Threat actors and their poor OPSEC across open/deep/dark web Specific market places and poor obfuscation and configuration of services Uniquely identifying data points for hidden services How and where hidden sites/services are commonly flagged on the open Web *A discussion of what might be a good use of TOR (social dissent), bad (child exploitation), and ugly (focus on data around terror support networks) We leverage open source collections and analysis tools, custom network scanning tools, and private sources in our research.