It wouldn't surprise me if this was limited to system logs and simple request logs. All the source IPs coming from Tor gateways are going to be from localhost.

It wouldn't surprise me if this was limited to system logs and simple request logs. All the source IPs coming from Tor gateways are going to be from localhost. By default in Apache and Nginx logs also include the user agent but diligent dark web operators disable that. System logins, auditd, supporting services logs, etc all may provide clues as to what happened.