Who Sees What
Awazon market onion addresses
awazonloedcyl2otgftfg7qm6e2klbgg2dhouyli3hdno6gdkueh6byd.onion
awazonozc4jwyrveu4473igv5ldt2hnccl2s7lerm2z27cvrc22e4uyd.onion
awazonth6ocz5cyos63czmhtsglqr7ydkdcc4lopux7nxbauoo2qmvyd.onion

Printed exactly as supplied, in the order supplied, with no labels and no ranking between them. This site runs no checks against any of them. It publishes no uptime figure, no status light and no date of last checking, because it never looks. An address that opens is not by itself evidence of anything.

Your network: the line, the router and the wifi

Before any traffic reaches Tor, and long before it reaches a market, it crosses equipment that somebody else owns and logs. This section is about that somebody, and about the narrow, specific thing they end up holding.

Your network is the first observer in the chain, and it is the only one you cannot skip. Every other observer in this catalogue is optional in some sense. You can decline to tell a person. You can avoid a vendor. You cannot send a packet without handing it to whoever carries your traffic.

In a flat or a house, that observer is usually three parties stacked on top of each other. There is the access provider who sold the line and who has a subscriber account with a name and a billing address attached to it. There is the router, which is a small computer that keeps a connection table and often a log, and which is physically in the building. And there is whoever else has a legitimate route to the provider's records, which in most countries means a court, a regulator or a law enforcement request made under a defined procedure.

Elsewhere the shape changes. On a workplace network there is an administrator with far more visibility than a domestic provider bothers with. On a cafe network there is a small business with a router it did not configure. On a mobile connection there is a carrier plus a cell record that also places the handset geographically. The class is the same. The details of what gets kept differ enormously.

What this class of observer structurally sees

A network observer sits on the wire. That position gives it three things and, when Tor is in use, essentially only three things: who the packets are going to on the first hop, when they were sent, and how much of them there was.

That is not a small amount of information, and this site does not pretend otherwise. A record that says a household connected to a Tor entry point at a certain hour, for a certain length of time, moving a certain volume, is a real record. It exists whether or not anyone ever looks at it. Retention periods vary by country and by provider, and this site publishes no figure for them.

The first hop
The address your machine actually opened a connection to. With Tor that is an entry relay or a bridge, not the market.
Timing
When the connection opened, when it closed, and the gaps in between.
Volume
Roughly how many bytes moved in each direction.
The account
Which subscriber line this happened on, and therefore which household or which business.

What Tor removes from their view

Tor exists to break the link between the first hop and the destination. From the network observer's seat, the encrypted tunnel starts at your machine and ends at a relay that is not the site you asked for. The observer sees the outside of that tunnel. It does not see inside it.

Concretely, that means the network does not learn which onion address you opened, which page you loaded, which listing you looked at, what you typed into any field, whether you have an account anywhere, or whether you bought anything at all. Those facts are visible to different observers entirely. The site you connect to knows some of them, and that is covered in the market's own server. The relays each know a fragment, which is covered in the Tor network itself.

This split is the whole reason the catalogue is filed by observer rather than by topic. The same single action produces a completely different record depending on where you stand. A reader who assumes their provider can see browsing over Tor is overestimating it. A reader who assumes the provider sees nothing at all is underestimating it. Both corrections belong on the same page.

SCOPEThis section stops at the edge of your building. What happens after the first hop belongs to the Tor observer. What happens on your own machine, which the network never sees, belongs to your own device.

The six actions in this section

Each card below takes one action, names the observers it creates, and states what those observers get from it. Two cards cover the plain case, at home and on a network belonging to somebody else. One deals with time, which is the signal readers most often forget they are producing. One goes back before any market is involved, to the download itself. One deals with the shape of traffic, which is the most misread subject in this section. The last deals with bridges, which change one thing and leave the rest untouched.

None of them is a how-to. Each describes a record, and the gap between what it contains and what people assume it contains. If you want the whole catalogue side by side rather than one observer at a time, the catalogue lists every card, and the seven observers puts this one next to the other six.

Your networkOpening Tor at homeYour ISP · Your router · Whoever holds the accountThe plain case: your own connection, your own router, Tor Browser opened. What that leaves behind on the wire.5 things reduce thisYour networkBorrowed or public wifiThe wifi operator · Their provider · The captive portal · Your own deviceCafe, library, workplace, a neighbour. A different network is a different observer, not an absent one.5 things reduce thisYour networkHow long the session runsYour ISP · The wifi operator · Your routerStart time, end time, idle gaps and repetition. Timing is the signal readers most often forget they produce.5 things reduce thisYour networkDownloading Tor BrowserYour ISP · The wifi operator · The distribution pointBefore any market is involved there is a download, and it repeats every time the software updates.4 things reduce thisYour networkThe shape of the trafficYour ISP · The wifi operator · Anyone on the same wireVolume, burstiness and direction are visible through encryption. This is the most misread subject in the section.4 things reduce thisYour networkTurning on a bridgeYour ISP · The bridge operator · The wifi operatorThe first hop stops resembling a published relay. Everything downstream of it stays exactly as it was.4 things reduce this

All seven observersFull catalogue

Questions that come up

Does the network observer know which market I opened?

No. With Tor in use the first hop is a relay or a bridge, and the destination sits inside encrypted layers the network observer cannot open. It sees a connection to a Tor entry point. The onion address, the pages and the form fields are not in that record.

Is it visible that I am using Tor at all?

On an ordinary connection to a public relay, generally yes. That is a normal and lawful thing to be visible. Turning on a bridge changes how obvious it is, and changes nothing else.

Which of the six cards should I read first?

If you have never thought about the line at all, start with opening Tor at home. If you have already assumed the network sees everything, read the shape of the traffic, because that is where the assumption usually comes from.