Tor Exit Nodes Mapped and Located | HackerTarget.com

Tor Exit Nodes are the gateways where encrypted Tor traffic hits the Internet. This means an exit node can be abused to monitor Tor traffic (after it leaves the onion network). It is in the design of the Tor network that locating the source of that traffic through the network should be difficult to determine. However if the exit traffic is unencrypted and contains identifying information then an exit node can be abused.

The torproject therefore is dependent on a diverse and wide range of exit nodes. This update to an older page is where I attempt to display the exit nodes diversity in a Google map with Geolocation. The map was built using Google Maps API v3, with Marker Clusterer.

The majority of exit nodes are likely not monitored and are “safe”, they are managed by good Internet citizens who believe in the aims of the Tor project. However even a handful of bad nodes could be a threat as exit nodes are periodically changed as you use the Tor network.

Understand the Technology, Understand the Risks

Use of the Tor Project by activists and Human Rights Defenders can be a valuable tool in avoiding surveillance; however you should always have a good understanding of the risks and keep your traffic encrypted end to end, as any of these exit nodes could be watching your traffic flows.

At the most basic level unless you are using encrypted protocols (HTTPS / SSH / TLS), the Tor traffic could be monitored. Here are two simple examples:

To gain an understanding of the technology the Tor Project website is the best place to start.

Tor Exit Nodes Geo-Located on a Google Map

These nodes are from February 27, I am working on scripting this up so that it is updated daily with the latest list of exit nodes. The list was downloaded from Blutmagie in csv format. Geolocation was performed against the IP addresses using the Free GeoIP API which seemed to have better coverage than MaxMind Geocities Lite.

From the map it is clear to see the high concentration of Tor exit nodes within Europe, once you start to zoom in and see the European nodes it is clear there is quite a spread of locations where the Tor nodes are operating.

Taking a closer look at the Internet Providers

Using the Shadowserver Whois service I also mapped the Tor exit node IP addresses against the ASN and Netblock.

The Internet service providers from the chart are the top 25 with the highest concentrations of Tor exit nodes.

In this post I have touched on some of the security threats and benefits of the Tor network. I encourage anyone intending to use the Tor network, to do some solid research around Operational security. If you are using Tor to bypass a proxy you should understand the risks to your traffic. If you are an activist using Tor to avoid monitoring by oppressive regimes, you really need to have a solid understanding of the technology, without knowing the threats you are putting yourself and perhaps others at risk.