Abstract—Tor is a well-known low-latency anonymous communication system that is able to bypass Internet censorship. However, publicly announced Tor routers are being blocked by various parties. To counter this blocking, Tor introduced nonpublic bridges as the first-hop relay into its core network. In this paper, we analyzed the effectiveness of two categories of bridgediscovery approaches: (i) enumerating bridges from bridge https and email servers, and (ii) inferring bridges by malicious Tor middle routers. Large-scale experiments were conducted and validated our theoretic analysis. We discovered 2365 Tor bridges through the two enumeration approaches and 2369 bridges by only one Tor middle router in 14 days. The malicious middle router based bridge discovery approach is simple, incurs little overhead, can discover bridges distributed by any approach, and is efficient and effective. We also discussed countermeasures to the malicious bridge discovery. Keywords-Anonymous Communicati...