Can I detect when someone is connecting to my server via Tor?

Question

I run a web server. Can I distinguish between traffic that has been routed via Tor and that which hasn't?

Answer 1

Yes. There are two ways to recognize Tor users.

The first way is through their IP address -- the list of Tor relays is public, so you can check whether the user is coming from a known Tor relay. It's actually a little bit trickier than that though, first because every Tor relay has an exit policy (so only some relays will allow users to reach your site), and second because some Tor exit relays are multi-homed, meaning they list (and listen on) a different IP address than the one they use for outgoing traffic. We offer a "bulk exit relay list" service that you can use to fetch a list of recent IP addresses whose exit policies allow connections to your site: https://check.torproject.org/cgi-bin/TorBulkExitList.py

And as Jens points out, if somebody visits your website from an IP address that also runs a Tor exit, you won't be able to tell the difference. That's especially important in places where many users are NATed behind a single shared IP address.

The second way is by looking at various application-level characteristics. Torbutton, and the changes in Tor Browser, are designed to make all Tor users blend together, but they're not designed to make every Tor user indistinguishable from all other normal web browsers. So you can probably build a signature based on the differences that the Tor Browser introduces (tells you the time zone is GMT, doesn't answer certain JavaScript queries, doesn't answer certain history requests, etc) to make a pretty good Tor user recognizer. Of course, if the user isn't using Tor Browser, then this one wouldn't work.

I should also point out that being able to distinguish Tor users doesn't break their anonymity. The goal of Tor is to prevent any single point from learning that this user went to that destination. You're not learning the location of the user here -- only that she is one of the million+ Tor users.

And finally, there's a FAQ entry that's relevant too: "You should hide the list of Tor relays, so people can't block the exits."

Answer 2

The list of Tor relays is public and can be accessed via different means. So you can basically check if the current connecting client is listed as relay or not. This gives you a first, good approximation.

However someone can run a relay and use this computer for everyday web surfing which is not routed through Tor. In this case the above mentioned check will say yes because the IP belongs to a relay, but the user didn't use Tor.

Answer 3

You can detect Tor users using TorDNSEL - https://www.torproject.org/projects/tordnsel.html.en.

Or you can just use https://github.com/assafmo/IsTorExit.

Answer 4

You can check your visitors' IP addresses against a dataset or use an API service. There exists an official and public list available at the following address: https://check.torproject.org/torbulkexitlist

Although it is accurate, only IPv4 IPs are included. If you need a full list (including IPv6 exit nodes) updated frequently I suggest trying out Ipregistry: for any IP address you get an answer with a field security.is_tor_exit that contains a boolean as value indicating whether the IP is used as a Tor exit node or not.