http://bentasker.i2p/posts/blog/security/346-don-t-use-web2tor.html
For example, when accessing https://6zdgh5a5e6zpchdz.onion.cab/ , the onion.cab service injects ( piwik ) Analytics code into the page: var _paq = _paq || [];
_paq.push(["setCookieDomain", "*.onion.cab"]);
_paq.push(["trackPageView"]);
_paq.push(["enableLinkTracking"]);
_paq.push(["setDomains","*.onion.cab"]);
(function() {
var u=(("https:" == document.location.protocol) ? "https" : "http") + "://onion.cab/";
_paq.push(["setTrackerUrl", u+"pwk.php"]);
...