Free tool

Tor Exit Node Check

Name: GeoIPHub API
Availability: InStock
Author: GeoIPHub

Verify any IP against the official Tor Project exit list, the authoritative record of which addresses route Tor traffic onto the open internet.

The data source

Straight from the Tor Project.

There is exactly one authoritative source for Tor exit nodes: the exit list published by the Tor Project itself. GeoIPHub ingests it daily, so the detection.is_tor flag reflects the network as it stands, not a months-old snapshot. No heuristics, no guessing. An IP is flagged as a Tor exit because the Tor Project says it is one.

Exit nodes are the only part of the Tor network your servers ever see. Traffic enters through a guard relay and hops through middle relays, but it reaches your application from the exit's IP address. That is why only exits are flagged: guard and middle relays never originate connections to your service.

One distinction worth keeping: privacy relays like Apple iCloud Private Relay and Cloudflare WARP are not Tor. GeoIPHub flags them separately in detection.is_relay, so a policy written for Tor exits does not accidentally sweep up iPhone users with default settings.

Explore the full threat intelligence layer

FAQ

Frequently asked questions

Where does the Tor data come from?

From the official exit list published by the Tor Project, ingested daily. It is the same list the Tor network itself maintains, which makes it the ground truth for exit-node status.

What is the difference between an exit node and a relay?

Tor routes traffic through a guard relay, middle relays, and finally an exit node. Only the exit's IP ever connects to your servers. Separately, commercial privacy relays (iCloud Private Relay, Cloudflare WARP) are not part of Tor at all and are flagged in detection.is_relay instead of detection.is_tor.

Is Tor traffic always malicious?

No. Tor serves journalists, researchers, and privacy-conscious users alongside abusers. Treat the flag as one input: GeoIPHub folds it into the 0–100 fraud score with a recommended action, so you can step up verification for Tor traffic instead of blocking it outright.

How fresh is the verdict?

The exit list is refreshed daily. Known IPs answer from the database in under a millisecond; an IP not seen before is classified live in under 2.5 seconds and then persisted.

More free tools