Recently I have noticed both of my web browsers making connections to Google and Amazon after I shut them and clear cache and cookies. So I just tried this with Tor and found a connection to:
Amazon Technologies Inc.

Since Tor is set for maximum privacy and with no JavaScript, I am wondering why an outgoing connection is occurring when Tor is closed?

  • 1
    That appears to be an Amazon EC2 Web Service server (so it could actually belong to anyone, rather than being something officially run by Amazon). How are you showing that these connections exist? From within the browser somehow, or using some other tool? Oct 16 '15 at 15:39
  • I use a small program called ip traffic spy. When I see modem lights working while not doing anything, I use that to see what URLs are outgoing. I also use it to see if outgoing TOR connections are encrypted. I have run a check on my PC using a word search facility and I can't find what file this IP is located in. Sorry I forgot to mention that it was only the ip number which the traffic spy detected. I then looked that up on 'who-is'.
    – user9652
    Oct 19 '15 at 9:56
  • How did you 'find this connection'? Are you using netstat? You can run netstat -ano (Windows and linux) and see all connections and their associated Process ID. If you are running TOR when you do this that Amazon connection may be a connection into the Tor network. Also, are you sure you have closed all browsers and software? You may have something periodically checking for updates in the background or sending some other kind of data.
    – N10
    Nov 19 '15 at 7:44
  • I don't think any reasonable conclusions can be drawn from any of the information provided here. The fact that traffic appears to happen when Tor Browser closes is not indicative of it being related to Tor Browser and the possible sets of other software that might monitor other processes and report to some EC2 instance (anti-virus through to spyware or malware) is far too broad. Unless this can be reproduced on a clean box I don't think this is something can be be answered. Too broad.
    – cacahuatl
    Jun 19 '16 at 1:02

During the time when you asked the question the IP address was a Tor relay. The Exonerator service can tell you about the state of the Tor network in the past.

This means it was perfectly OK for your Tor client to initiate a connection to Amazon. Tor had for some time a cloud project where one could spin up a relay at Amazon cloud.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.