ExoneraTor

or: a website that tells you whether a given IP address was a Tor relay


Just because you see an Internet connection from a particular IP address does not mean you know who originated the traffic. Tor anonymizes Internet traffic by "onion routing," sending packets through a series of encrypted hops before they reach their destination. Therefore, if you see traffic from a Tor node, you may be seeing traffic that originated from someone using Tor, rather than from the node operator itself. The Tor Project and Tor node operators have no records of the traffic that passes over the network, but we do maintain current and historical records of which IP addresses are part of the Tor network.


ExoneraTor tells you whether there was a Tor relay running on a given IP address at a given time. ExoneraTor can further indicate whether this relay permitted exiting to a given server and/or TCP port. ExoneraTor learns these facts by parsing the public relay lists and relay descriptors that are collected from the Tor directory authorities and the exit lists collected by TorDNSEL. By inputting an IP address and time, you can determine whether that IP was then a part of the Tor network.


Notice: This service has moved to: https://exonerator.torproject.org/

This material is supported in part by the National Science Foundation under Grant No. CNS-0959138. Any opinions, finding, and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect the views of the National Science Foundation.

"Tor" and the "Onion Logo" are registered trademarks of The Tor Project, Inc.

Data on this site is freely available under a CC0 no copyright declaration: To the extent possible under law, the Tor Project has waived all copyright and related or neighboring rights in the data. Graphs are licensed under a Creative Commons Attribution 3.0 United States License.