I have used the below code from link to detect the browser is TOR or not.


But when the server is hosted on AWS, we didn't get the exact $_SERVER['SERVER_ADDR'] as the AWS is providing the private ip of machine or load balancer ips.

So is there any way to detect the AWS private ips from the TOR exit list to detect whether the user is using the TOR browser or not.

In this code, gethostbyname($user_ip.".".$_SERVER['SERVER_PORT'].".".$_SER‌​VER['SERVER_ADDR']."‌​.ip-port.exitlist.to‌​rproject.org")=="127‌​.0.0.2" , I did the $_SERVER['SERVER_ADDR'] to static public ip of AWS server and $user_ip to $_SERVER['HTTP_X_FORWARDED_FOR '] and code worked, but if I put actual private IP in the $_SERVER['SERVER_ADDR'] variable provided by AWS, code is not working.

1 Answer 1


There are a few things going wrong here.

  1. You're not reversing the IP octets, so if this ever was "working" it only looked like it was.

  2. You're using X-Forwarded-For which can be defined, arbirarily, by the client so this isn't trustworthy. A user can edit this header to trick your script into thinking that either they are using Tor when they're not or they're not using Tor when they are.

The code that you linked includes a ReverseIPOctets function, which is wrapped around the server and client IP addresses but any such functionality is not present in your above script which means it's checking the wrong IPs.

A private IP address will never work, it must be the public IP address. Tor Exits can only send traffic to public IP addresses so Tor DNSEL can only check against those. Private IP addresses are routed to after it's reached it's public destination is something that can't be accounted for, it must be checking it's public, internet routable IP address.

Another method would be to use the Tor bulk exit list, which you'd need to update regularly.

Note that none of these will determine if a user is using Tor Browser, simply that they are probably using Tor. These methods are heuristic and subject to false-negatives and false-positives.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .