Free tool

Tor Exit Node Check

Name: GeoIPHub API
Availability: InStock
Author: GeoIPHub

Verify any IP against the official Tor Project exit list, the authoritative record of which addresses route Tor traffic onto the open internet.

The basics

What is a Tor exit node?

A Tor exit node is the last relay in a Tor circuit — the point where traffic leaves the Tor network and reaches the open internet. When someone browses your site over Tor, the request arrives from an exit node's IP address, never from their real one.

Exit nodes are the only part of Tor your servers ever see. A circuit first passes through a guard (entry) relay and one or more middle relays, but those never connect to your application — so exits are the addresses worth checking, and the ones this tool flags. Paste any IP into the checker above to see whether the Tor Project currently lists it as an exit.

The data source

Straight from the Tor Project.

There is exactly one authoritative source for Tor exit nodes: the exit list published by the Tor Project itself. GeoIPHub ingests it daily, so the detection.is_tor flag reflects the network as it stands, not a months-old snapshot. No heuristics, no guessing. An IP is flagged as a Tor exit because the Tor Project says it is one.

One distinction worth keeping: privacy relays like Apple iCloud Private Relay and Cloudflare WARP are not Tor. GeoIPHub flags them separately in detection.is_relay, so a policy written for Tor exits does not accidentally sweep up iPhone users with default settings.

Explore the full threat intelligence layer

The exit list

The full Tor exit node list.

The complete, authoritative roster of Tor exit nodes is the Tor Project's bulk exit list — a plain-text file of every IP currently running as an exit, published at check.torproject.org/torbulkexitlist and regenerated continuously as relays join and leave the network. You can pull it directly:

official tor bulk exit list

curl https://check.torproject.org/torbulkexitlist

It holds exit nodes and nothing else, which is all you need: guard and middle relays never connect to your servers, so they never belong on a blocklist. The file also carries no context — no organization, no first-seen date, no risk signal beyond the raw IP.

A static list goes stale the moment you save it. The network churns by the hour, so a copy you fetched this morning is already missing exits that came online since, and matching thousands of addresses on every request is upkeep you own forever. A live detection.is_tor lookup reflects the current list with nothing to maintain, and returns it alongside the rest of the IP's context. For how exit status feeds a risk decision, see how to detect Tor traffic by IP.

FAQ

Frequently asked questions

Where does the Tor data come from?

From the official exit list published by the Tor Project, ingested daily. It is the same list the Tor network itself maintains, which makes it the ground truth for exit-node status.

What is the difference between an exit node and a relay?

Tor routes traffic through a guard relay, middle relays, and finally an exit node. Only the exit's IP ever connects to your servers. Separately, commercial privacy relays (iCloud Private Relay, Cloudflare WARP) are not part of Tor at all and are flagged in detection.is_relay instead of detection.is_tor.

Is Tor traffic always malicious?

No. Tor serves journalists, researchers, and privacy-conscious users alongside abusers. Treat the flag as one input: GeoIPHub folds it into the 0–100 fraud score with a recommended action, so you can step up verification for Tor traffic instead of blocking it outright.

How fresh is the verdict?

The exit list is refreshed daily. Known IPs answer from the database in under a millisecond; an IP not seen before is classified live in under 2.5 seconds and then persisted.

More free tools