A Logo

Feel free to include my content in your page via my
RSS feed

Help Irongeek.com pay for
bandwidth and research equipment:

Search Irongeek.com:

ISDPodcast Button
RootSecure Button
Social-engineer-training Button
Irongeek Button

Web Hosting:
Dreamhost Logo
Help Irongeek.com pay for bandwidth and research equipment:


Tor or not Tor: How to tell if someone is coming from a Tor exit node, in PHP

Tor or not Tor: How to tell if someone is coming from a Tor exit node, in PHP


     Awhile back I was thinking it would be cool to make my page look different for people that are using the Tor anonymizing network. Also, I though it might useful to some administrators to be able to block Tor users from certain functions on their sites. I'm not in favor of censorship, but for certain practical reasons it can be useful to detect Tor exit nodes and keep them from accessing certain resources. I found some example code in Python, but I wanted to code it in PHP for my site. I looked at the documentation on TorDNSEL and came up with the following code. The results of this simple image swapping script can be seen on the left, and my code for telling if someone is using Tor can be found below. Most of the script is just there as an example, the two functions in red (IsTorExitPoint and ReverseIPOctets) are the important ones to copy into your own script. IsTorExitPoint returns a boolean value of true if it thinks the user is coming from a Tor exit point. While it's not 100% assured the remote host is using Tor, the script is pretty accurate. Hope someone finds these functions useful.
/* NOTES on Irongeek's TorOrNot script:
To use this php script on some pages it will need it to have a png extension.
To do this, put a redirect from a png file to the php file in your apache config file (httpd.conf) or .htaccess. 
Example line:
Redirect /torornot.png /torornot.php

Consider this code to be GPLed, but I'd love for you to email me at Irongeek (at) irongeek.com with any changes you make. 
More information about using php and images can be found at http://us3.php.net/manual/en/ref.image.php
More information on detecting Tor exit nodes with TorDNSEL see https://www.torproject.org/tordnsel/

Adrian Crenshaw
header("Content-type: image/png");
//header("Content-type: text/html");
if (IsTorExitPoint()) {
$im = imagecreatefrompng("tor.png");
$im = imagecreatefrompng("nottor.png");
imageAlphaBlending($im, true);
imageSaveAlpha($im, true);

function IsTorExitPoint(){
if (gethostbyname(ReverseIPOctets($_SERVER['REMOTE_ADDR']).".".$_SERVER['SERVER_PORT'].".".ReverseIPOctets($_SERVER['SERVER_ADDR']).".ip-port.exitlist.torproject.org")=="") {
return true;
} else {
return false;
function ReverseIPOctets($inputip){
$ipoc = explode(".",$inputip);
return $ipoc[3].".".$ipoc[2].".".$ipoc[1].".".$ipoc[0];

Printable version of this article

15 most recent posts on Irongeek.com:

If you would like to republish one of the articles from this site on your webpage or print journal please contact IronGeek.

Copyright 2014, IronGeek
Louisville / Kentuckiana Information Security Enthusiast