The Tor network

Tor in the header shows where Tor traffic leaves the internet: every exit address with its network, country and prefix, by its share of all Tor exit traffic; the relays by hosting network; and a list of every running relay to match connections against. The data is the Tor Project's own — the relay list, fetched hourly, and the daily exit lists since November 2024 — placed with our routing and country tables. Both are public domain (CC0).

The map

The map shades each country by exit traffic — its share of all Tor exit traffic, where Tor users' traffic actually leaves — or, switched over, by exit addresses, how many there are. The two differ: the United States hold the most exit addresses, the Netherlands and Germany carry more of the traffic. Each country's tooltip gives both. Countries are where DB-IP locates each exit address. A click on a country — on the map or in the country table — narrows the page to it: the figures, the exit networks and prefixes, the relays and the exits reached through a VPN are then that country's, and shares remain shares of all Tor exit traffic. The line under the map says which country is chosen, links its country page, and clears the choice.

An address, a network, a prefix

An address that is or was a Tor exit answers as one: type TOR, no provider, the days it exited Tor traffic month by month, and the relays running there with their role and port. A network or prefix holding Tor exits or relays shows them in a Tor box, even where no VPN or proxy provider is known in it.

Tor over VPN

Some VPN providers route single servers into Tor (ProtonVPN's Tor servers, NordVPN's Onion over VPN). Our probing through such a server leaves from a Tor exit. That is Tor traffic of the VPN's customer, not an exit of the VPN: a sighting while the address was a Tor exit (its days on the Tor Project's exit lists, gaps in those lists of up to 60 days, and 30 days either side) counts for no provider anywhere — not in the attribution, not in the networks and figures of the provider, not in interpolation. It is shown as reached via instead.

Detection

A connection from inside your network to a relay's address and port is a Tor client, or software that brings its own Tor. Every running relay counts, not only exits: the guards are the first hop of every client. The list is on the Tor page as CSV and through GET /api/v1/tor/relays. At large hosters relays share their networks with ordinary customers: match address and port, never the whole network.