I'm looking at the results from the following URL and would like to know how does the Tor Project website "know" that Tor is being used or not.


I would set up a packet sniffer, but since I'm not an exit node I'm not sure if that would make much of a difference.


3 Answers 3


In one line: they have a list of all the exit nodes (something like that).

more detailed:

I have seen this post demonstrates how to detect a Tor connection in php

function IsTorExitPoint(){
    if (gethostbyname(ReverseIPOctets($_SERVER['REMOTE_ADDR']).".".$_SERVER['SERVER_PORT'].".".ReverseIPOctets($_SERVER['SERVER_ADDR']).".ip-port.exitlist.torproject.org")=="") {
        return true;
    } else {
       return false;

function ReverseIPOctets($inputip){
    $ipoc = explode(".",$inputip);
    return $ipoc[3].".".$ipoc[2].".".$ipoc[1].".".$ipoc[0];

A good references explain what it does are available here:


From Tor offical doc that descirbes the TorDNSEL method that mitigates the drawbacks of the old method of testing exitnodes ip list:

It is useful for a variety of reasons to determine if a connection is coming from a Tor node. Early attempts to determine if a given IP address was a Tor exit used the directory to match IP addresses and exit policies. This approach had a number of drawbacks, including false negatives when a Tor router exits traffic from a different IP address than its OR port listens on. The ​Tor DNS-based Exit List was designed to overcome these problems and provide a simple interface for answering the question: is this a Tor exit?

In ruby you have a cool Tor.rb gem that implements this technique:

Tor::DNSEL.include?("")               #=> true
Tor::DNSEL.include?("")                     #=> false
  • 4
    Could you update your php function to support IPv6?
    – matt
    Commented Dec 22, 2014 at 12:54
  • If you are not using Tor AND are not running a Tor exit node, it knows you are not using Tor. If your traffic comes from an exit node, it doesn't know whether you are using Tor or not.
    – WGroleau
    Commented Dec 5, 2015 at 0:09
  • Does this work for all addresses in the Tor Network? Is it possible for someone to "avoid detection" by Tor?
    – Pacerier
    Commented May 24, 2016 at 12:53
  • 1
    @Pacerier I believe that everything's possible :)
    – 0x90
    Commented May 24, 2016 at 12:56
  • 1
    Note that the technique has changed a bit: lists.torproject.org/pipermail/tor-project/2020-March/…
    – forest
    Commented May 6, 2022 at 20:34

They know what are the Tor exit nodes addresses. So they just check your address and see if it matches with one of the exit nodes.

Exit nodes are known to the whole Tor network, if you decide to run one exit node, then you should advertise it right? Or else no one will use it. Then people will know your IP is a Tor exit node. Simple.

  • 4
    You have to advertise your Tor relay IP address, but Tor users have no need to know your exit IP address.
    – curiousguy
    Commented Jun 17, 2012 at 21:46
  • @Aki What about NAT'ed addresses? Or can TOR exit nodes not be NAT'ed? Commented Oct 24, 2012 at 4:47
  • 2
    Yup I just tried this: When running an exit node myself, I can go to check.torproject.org in any unconfigured browser and it will happily report I'm using Tor.
    – Luc
    Commented Aug 15, 2013 at 23:24
  • @Aki, When you say "Exit nodes are known to the whole TOR network", do you mean that it is technically impossible for a node to avoid detection by Tor Project's IP listing?
    – Pacerier
    Commented May 24, 2016 at 12:55
  • @Pacerier, yes the exit nodes are often monitored. Tor provides anonimity but if you log into facebook through it then it's quite easy to map all your traffic to your identity. This is why there are VM projects for TOR or Browser bundles with privacy plugins. All exit nodes are by design advertised: check.torproject.org/exit-addresses.
    – Aki
    Commented May 27, 2016 at 1:24

You can check if a connection is a tor exit point by using TorDNSEL; Thus a script can be coded to check every connection.

"TorDNSEL is an implementation of the active testing, DNS-based exit list for Tor exit nodes. "

  • 1
    Can you translate the implementation notes in the TorDNSEL README file? "TorDNSEL can perform active exit testing by launching an HTTP request to itself through every exit node with a suitable exit policy. This allows it to detect exit nodes configured to send outbound connections through a different IP address from the one they advertise in their descriptors. When configured to run exit tests, it tests through a particular exit node each time the node publishes a new descriptor. All running nodes are tested periodically between descriptor uploads." Commented Mar 4, 2012 at 6:24
  • @logicalscope - Well yes, it makes sense. TorDNSEL, being a TOR node itself (part of TOR network), issues a HTTP request to other available TOR nodes that targets it's public IP HTTP server. Exit nodes accept this request as outbound traffic, forward it on TorDNSEL's behalf, and all TorDNSEL needs to do is collect IPs that forwarded that request. The list it ends up with is public IPs of current TOR exit nodes.
    – TildalWave
    Commented Jan 30, 2013 at 2:30
  • @TildalWave, I don't get why this method is foolproof. Why must Exit nodes forward the request? Can't they be modified to ignore it?
    – Pacerier
    Commented May 24, 2016 at 12:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .