Strange IPs ! Help!

[helpplease]

If I go to onion duckduckgo and type “whats my ip” I get one ip. ok that’s normal. But after doing it for around 2 days in a row and rebooting all the system more times, every time I go back to duckduckgo onion and check for my ip address is still the same!!! it doesn’t change at all for onions apparently, IS IT NORMAL?

PLUS I went to check.torproject.org to check my tor configurations and it said “Congratulations. This browser is configured to user Tor.” and it also showed my ip address. that ip address is different from the one I got on the onion duckduckgo (which is normal because to access clearnet you go through an exit node right), but then I immediately went to duckduckgo normal clearnet search engine and searched for “whats my ip” exactly like on the onion duckduckgo, and it’s even weirer than before! I GOT an ip address different from both of them!!

so basically I got different 3 different ips at the same time:
1 ip from onion duck duck with persists after reboot and after days;
1 ip from https://check.torproject.org to check my clear ip
1 ip from duck duck normal clearnet search engine.

ALL THOSE 3 ips are different at the same time!!!

So question is: shouldn’t my clearnet ips be only 1 at the same time? or perhaps the ip I get from check.tor.project is somehow different from the real one got at clearnet duckduckgo? AND WHY does my onion ip stay the same after reboots and days? isn’t it supposed to change? isn’t only the guards supposed to perform “persistence”?

[0brand]

Hi helpless, I will try to explain.

If you look at the results of “whats my ip” when you use duckduckgo.onion you will see something like " Your IP address is 121.160.*** in Anonymous Proxy". The duckduckgo.onion is a hidden service and your using a proxy so it will give you a different ip . The ip will stay the same every day because your using the same proxy.

The “whats my ip” from a clearnet duckduckgo.com search will give you something like “Your IP address is 24.201..* in Madrid, Spain”. This is because you are not using a duckduckgo.onion proxy. This ip should change when ever a different exit node is used.

You are getting a different “Tor ip check” because all it is really doing is making sure your browser is configured to use Tor and you are in fact on the Tor network ( i think ) . Its ok if it shows a different ip than the other ip check

Either way it is nothing to be concerned about. It is actually a good thing that they give you different ips.

Regards 0brand

[Patrick]

Stream Isolation

[helpplease]

Thank you for the answer 0brand.
BUT it’s the exact opposite of what you said: searching on the onion duckduckgo for “whats my ip” gives you the ip + the location, meanwhile searching on the normal clearnet duckduckgo for “whats my ip” gives you the ip + " in Anonymous Proxy".

And the main problem is that for the onion services the ip i’m using is always the same.
And i’m not using a proxy, torrifing does not include proxies as far as I know.
ANOTHER BIG WEIRD THING is that using two different computers, and installing on them tor, is giving me the same ip address when looking for “whats my ip” in the onion duckduckgo.

I just tested out something else: I went to different sites in the clearnet that check your ip, and they all tell me I have different IPs… I don’t care if “well the more different, the better” because this doesn’t make any sense, it should not be happening.

[Patrick]

The problem is, you give too much value on what some random website (duckduckgo onion) showing something. And not knowing what stream isolation is. duckduckgo onion is not even a leak testing website.

(And even these browser tests cause more confusion https://www.whonix.org/wiki/Browser_Tests.)

A reverse DNS result for the IP shown on duckduckgo onion is amazonaws.com. I am not surprised by that, since the whole internet is hosted nowadays on amazon aws.

That way the duckduckgo onion might be implemented is running an onion on a amazon aws server which then connects to duckduckgo clearnet. And the one connecting there, is always the the amazon aws’s clearnet IP. Or the duckduckgo onion falls back to show the IP of the load balance or server or whatever if it’s getting a connection from their onion.

---

I don’t care if “well the more different, the better” because this doesn’t make any sense, it should not be happening.

It’s called stream isolation. (No, I don’t paste any links to any wiki pages in here if they have nothing to do with the topic.)

I am not aware of any onion IP check. In theory hidden services could log somehow from which connection they have been receiving the connection. It would be coming from their Tor entry guard relay. If they posted that, they would harm their anonymity.

Or they could somehow ask Tor for thei Tor hidden service rendezvous point and show that. An onion IP check (perhaps run by a non-anonymous operator) could be useful for educative purposes indeed.

[Hexagon]

If you visit https://duckduckgo.com/ your traffic goes the normal way through the exit node. https://duckduckgo.com/ is able to see your exit node’s IP and can tell you are using Tor (or more general an anonymous proxy as DuckDuckGo calls it).

If you visit https://3g2upl4pq6kufc4m.onion/ your traffic goes not through an exit node, but through a rendezvous point and another Tor circuit, so the IP you’re seeing when visiting the .onion is the Tor gateway used by DuckDuckGo (apparently they don’t recognize it though), this is also the reason why this IP doesn’t change.

I just tested out something else: I went to different sites in the clearnet that check your ip, and they all tell me I have different IPs

That’s because of the stream isolation feature @Patrick linked to.

I don’t care if “well the more different, the better” because this doesn’t make any sense, it should not be happening.

This is a feature that’s supposed to prevent identity correlation, if you don’t care and think this shouldn’t be happening feel free to disable it at your own risk: https://www.whonix.org/wiki/Stream_Isolation#Tor_Browser_Remove_Proxy_Settings

[0brand]

BUT it’s the exact opposite of what you said: searching on the onion duckduckgo for “whats my ip” gives you the ip + the location, meanwhile searching on the normal clearnet duckduckgo for “whats my ip” gives you the ip + " in Anonymous Proxy".

Sorry, my mistake I got the two mixed up

And i’m not using a proxy, torrifing does not include proxies as far as I know.

I meant there was a proxy from the duckduckgo hidden service to a exit node. Anyhow, Patrick and Hexagon explained things way better than I ever could. Im sorry if I confused you or mixed up the information. Just trying to help

[mT8RQf]

Stylometry

[helpplease]

No problem @0brand you have indeed helped! If I could +rep you I would! (as you know you gotta have something like 20 posts before u can +rep here)!

@ Patrick @ Hexagon (I can’t mention more than 2 users in a post as a rule anti-spam of the forum I guess, that’s why I set a space between ‘@’ and the username) Thank both of you too very very much! It’s all crystal clear now!
This has been extremely helpful.

ps: thank you too @ mT8RQf even though I almost didn’t see your post at all, I thought it was an advertising Ad hehe
ps2: Yea @ Patrick I didn’t see your first post quoting the stream isolation page either, though was and Ad too, I’ll take a look at some glasses shop.