A look at the traffic originating from my Tor Exit relays

Have you ever wondered which clearnet web domains (as in not onions) are the most popular among users of The Onion Router project (Tor)? Is there any evidence to support the popular mainstream opinion that Tor is predominantly used by people with malicious and criminal intent? To add some spice to this question in 2026, I’ve aggregated non-identifiable data based on DNS queries made by my five Tor exit relays.

Disclaimer

This article does not pretend to be based on any scientific research, and the sample data is too small to provide any real value. I am also guilty of overstating the value of DNS logs when it comes to understanding traffic from Tor users. Only non-identifiable data has been used, and there are no attempts to perform any correlation with specific users or exit nodes.

Available data

• Exit relays: 5
• Log period: 1 week
• Aggregated log files: 5
• Total lines parsed: 60159688

Classifying, extracting, and accumulating

All my Tor Exit relays use the Unbound DNS server. I have a mix of FreeBSD and Linux-based relays. I’ve made a Python script to parse the aggregated Ubound logs to identify and classify the data down to registrable domains and suffixes in a few steps.

Here is the gist of it.

Step one: Classify

• WEB: Normal lookups
• RDNS/PTR: Reverse DNS / PTR
• IP-ISH: forward lookups where the hostname encodes an IP address

Step two: Normalize, extract, and discard

Extracting the registrable domains (eTLD+1) sounded like an easy task, but later, I realized that my increasingly growing list of regular expressions was not up to the task. My thanks to John Kurkowski for providing tldextract: A Python library to parse URLs.

The result

After discarding enumerated queries and malformed/unwanted patterns from the logs, we’re left with the following:

Class	Count	Share
WEB	22192644	98.818%
IP-ISH	249316	1.110%
RDNS/PTR	16224	0.072%
Total	22458184	100.000%

The top lists.

Finally, it’s time to break it all down. Let’s find out what the majority of Tor users are doing on the Internet.

Top 25 - Most popular domains

The moment of truth, unfiltered.

To the surprise of no one, the Internet is currently being overrun by big tech and the advertising industry. The most surprising result in this list, as far as I’m concerned, is that Blogspot is still alive. And DigitalOcean is (apparently) a big player in the realm of object storage.

If we just focus on regular domains that users visit directly, we get a slightly different list.

Top 25 - Most popular regular domains

Speaking of Blogspot, I’ve looked at the list of subdomains, and as far as I can see, it’s all just regular blogs by everyday people. The most popular one belongs to a techno artist promoting his music.

Other interesting findings

DNS queries seem like a more reliable indication of the popularity of your favorite Linux distro than Distrowatch’s infamous ranking.

Top 10 - Most popular GNU/Linux distributions

Quite the difference from Distrowatch’s top 10. In fact, a few of the top 10 distributions from Distrowatch’s list had zero DNS requests.

FQDN / subdomains

I won’t be publishing this information in detail, as some companies seem to believe that DNS zone files are hidden or somehow secret information. Alas, there is no need to guard the server on the other end of the pointer. Deploy and forget, I guess, the benefits of automation.

However, I’ll make one exception to this rule. Apple has a few peculiar ones, including pancake.apple[.]com and swallow.apple[.]com.

Additionally, the poor and starving children forced to assemble your next iPhone in a faraway country are sending Morse signals from captive.apple[.]com. Mean-spirited geo-political jokes aside, this record was probably coming from Tim Cook himself, being held captive and forced to watch the Melanie premiere from inside the White House.

Logs on Tor Exit relays?

You should always have a “no logging” policy on Tor relays!

This seems entirely reasonable if you’ve never hosted servers. Tor relays (like anything else available on the Internet) are constantly under attack, and without any logs, you’re just fumbling through the dark.