Identify Tor web browsing based on ".noconnect" timing differences. Internally, Tor treats hostnames ending with ".noconnect" specially by immediately closing the connection.

This behavior can be used to determine if the user traffic is being handled by Tor by comparing to other non-existent top level domains. This approach can be performed entirely on the client-side and requires no server resources.