Who Sees What
Awazon market onion addresses
awazonloedcyl2otgftfg7qm6e2klbgg2dhouyli3hdno6gdkueh6byd.onion
awazonozc4jwyrveu4473igv5ldt2hnccl2s7lerm2z27cvrc22e4uyd.onion
awazonth6ocz5cyos63czmhtsglqr7ydkdcc4lopux7nxbauoo2qmvyd.onion

Printed exactly as supplied, in the order supplied, with no labels and no ranking between them. This site runs no checks against any of them. It publishes no uptime figure, no status light and no date of last checking, because it never looks. An address that opens is not by itself evidence of anything.

The entry guard, and what your first relay can see

Every circuit begins at one relay you connect to directly. It is the only relay in the whole path that ever sees your real network address.

Who sees it

The guard relay operator · Whoever hosts that relay · Your ISP

What the first relay is handed

The guard receives a connection from your address, on a port, at a time. It completes a handshake that is recognisable as Tor rather than ordinary web traffic. From then on it exchanges fixed size cells with you and forwards them to the next relay you asked it to reach.

So the operator holds a small, precise record: an address, a start time, an end time, a volume. If the machine keeps ordinary connection logs, that is what is in them. There is no field in that record for what you were doing, because nothing in the protocol ever tells the guard.

Sees
Your network address, that the traffic is Tor, when the connection started and stopped, roughly how much passed.
Sees next
The address of the next relay, which is not the destination.
Does not see
Any hostname, any onion address, any page, any account name, any form field, or whether anything loaded at all.

What it does not learn, in detail

The guard cannot read past the next hop. Everything beyond that relay is wrapped in layers it holds no keys for, so it cannot tell an onion connection from an ordinary fetch by inspecting content. There is no content available to inspect. It sees encrypted cells that all look alike by design.

It also does not know how long the path is. Positions are not labelled in the traffic. The guard knows it was contacted directly, which is what makes it a guard, but the relay it forwards to is simply the next address. The middle relay covers the same blindness from the other side.

One more thing it does not learn, which readers often get backwards: the guard has no idea whether you are signed in anywhere, or who you are on any site. Account identity lives at the far end, not on the path.

Why the same relay keeps coming back

A client does not pick a fresh first hop for every circuit. It picks a small set and keeps using it for a stretch of time measured in weeks or months rather than minutes. That is deliberate, and the reasoning explains who your persistent first observer is.

If the first hop were reselected constantly, a client in ordinary use would eventually pass through a hostile one, and the chance of that happening at least once climbs steadily with time. A stable first hop turns that into a single draw. Either the relay you settled on is a problem, in which case it has been one from the start, or it is not, in which case a long run of activity never touches a hostile first position at all.

The cost of that trade is stated just as plainly. Your first observer is one specific party for a long time. It does not see a session, it sees a habit.

What the persistence looks like as a record

Over weeks, a guard operator who keeps records has a series of connections from one address. Times of day cluster. Sessions have typical lengths. Byte counts have a typical range, and unusual days stand out against the ordinary ones. That is a real pattern and it is fair to name it.

What the pattern still does not contain is a destination. It says somebody at this address uses Tor, often in the evening, for about this long. It does not say which service, which account, which order, or whether a market was involved at all. The distance between those two statements is why this catalogue is filed by observer. The traffic shape behind the byte counts is covered in the shape and size of the traffic, because your own line sees the same volumes.

Who else sees this exact connection

Relay addresses are published so that clients can find them. The first hop is therefore not only visible to its own operator: anyone watching your line sees a connection to a machine known to be a relay, and can conclude you are speaking Tor without learning anything else. Your ISP is in that position by default, and so is whoever runs the network you are on.

That is where the network section and this one overlap, and the split is simple. What your line sees is opening Tor at home. What the relay sees is this card. Two observers, same connection, opposite ends.

What changes the answer

5 things change how much this action gives away. None of them takes it to zero, and none of them is a promise.

  1. A bridge changes who can tell it is Tor, not what the first hop seesA bridge is an unlisted first hop, which alters what a network watcher can conclude from the destination address. It does not change the fact that some first machine receives a direct connection from you and knows your address. See turning on a bridge for what that actually buys and what it does not.
  2. A different line means a different address, not fewer observersConnecting from another network hands the guard a different address to write down, and introduces whoever runs that network as a fresh observer. Using borrowed or public wifi covers the trade.
  3. Session length is the part of the record you controlThe guard record is bounded by when the connection opens and closes. A short session produces a short entry, a client left running all day produces a long one. See how long the session stays open.
  4. Asking for a new circuit does not swap this relayThe menu item that builds a fresh path for a site changes the later positions and normally leaves the first hop alone, which is the whole point of the design. A new circuit for this site says exactly what moves.
  5. Putting a VPN in front moves the observer rather than removing itWith a VPN before Tor, the guard is handed the address of a company instead of yours, and that company now holds what your ISP would have held, plus an account and a payment record. Adding a VPN to Tor states the trade in both directions. None of it reaches the far end, which records what you send it regardless.

What this card is not

This is not a tuning guide, and it cannot tell you which relay you are using or whether its operator is honest. It describes a position, not a machine.

Questions that come up

Can my first relay tell that I am reaching an onion address?

It cannot read the traffic, which is uniform by design, so it learns no destination and no address. What it knows is that a Tor connection exists from your address.

Is it safer to change my first relay often?

The design does the opposite, because frequent reselection raises the chance of eventually using a hostile first hop. This site describes that reasoning rather than advising you to override anything.