What does Tor do to the IP address a service sees?¶

Tor routes traffic through a series of relays. A destination service normally sees the address of a Tor exit relay, not the user's ordinary connection.

The short version¶

Tor changes the address visible to the destination service. Seeing a Tor exit address may explain the route, but it does not by itself prove who used Tor or why.

The route¶

For ordinary web traffic, the useful simplified model is:

user connection → Tor relays → exit relay → destination service

The destination service records the exit relay as its immediate source. Other systems may record different parts of the route.

What the destination may record¶

The service may record:

• a Tor exit IP address;
• time, port and protocol details;
• an account or session;
• messages, uploads or other activity; and
• warnings or access controls triggered by the exit address.

The exit address can be shared by many users. It is not a subscriber address for one household.

What may remain elsewhere¶

Depending on the facts, relevant material may include:

• the destination account and its recovery details;
• activity and timing on the destination service;
• device or browser evidence;
• other communications or payment records; and
• records from an organisation that can lawfully explain a particular event.

Do not assume a particular record exists or can be obtained. The purpose of this card is to explain the visible address, not to provide operational instructions for using or evading Tor.

A worked interpretation¶

The platform recorded a connection from a known Tor exit address. This supports the conclusion that the platform saw Tor infrastructure at that time. It does not, without more evidence, identify the user or establish the purpose of the connection.

See what the recording system could see and what records might exist for this type of infrastructure.