Incoming TOR connections

Kodi

I don't have TOR or VPNs installed on my phone, however my router is picking up incoming TOR connections to the phone. It probably happens once a day and the logs show about 20 random connections to my GrapheneOS phone, port 53208, 54596, 34658, 35366 etc..etc.. they always seem to be random.

Is this a rogue app or does GrapheneOS use some sort of a TOR network for update checks or something?

[deleted]

Kodi

Have you tried looking at live DNS logs? Use NextDNS, enable logging, and watch them and see if you can catch a domain. Watch for a while to see if it shows up, but also open each app one by one and look and see what domains they're reaching out to.

boldsuck

You may have a Dyn IP that was previously used for Tor. Many users have the Snowflake plugin running in their browser to help people in oppressed systems. Or DYN-IP bridges for Turkmenistan. The country is completely cut off from the Internet. (The residential IP addresses only works for a few days.)
Or you have a crypto wallet or other app with building hidden service. (They mostly use Orbot.)

Kodi

Thanks everyone, I'll investigate further

PiNizz-Va-J-J

Kodi Do you have an update on your case?