How do webservers know that the request comes from a tor network?

Question

When I use tor, certain websites are not accessible. Somehow the website knows that I'm using tor. But how? It is just supposed to see an unencrypted request from the exit node ... Or are all the relay servers known and therefore blocked in advance?

Answer 1

I wrote a blog post about this here. Here's the gist:

Let me show you what it looks like from the internet’s point of view when I go to a simple website using a normal Browser (Brave):

111.222.333.444 – – [18/Dec/2019:16:29:05 +0000] “GET / HTTP/1.1” 200 7094 “-” “Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36”

The 111.222.333.444 would be my IP address. With that, anyone can get a lot of information about me.

Let’s see what it looks like when visit my website using the Tor Browser:

45.66.35.35 – – [18/Dec/2019:16:49:41 +0000] “GET / HTTP/1.1” 200 7094 “-” “Mozilla/5.0 (Windows NT 10.0; rv:68.0) Gecko/20100101 Firefox/68.0”

The IP address is not mine. It belongs to an exit node which is run by a Tor volunteer. These IP addresses are publicly known and are often banned from many websites.

That is how a website knows you are using Tor. They match that IP up with a list of known Tor exit nodes. You are still anonymous but they can see that you are a Tor user. If you are wondering why they don't just hide the exit nodes, the answer is here.