Analysis of threat intelligence from the Web strips Tor anonymity and links its use to illegal services and specific malicious actors.