What is a Tor Exit Node?

An exit node is the final gateway where encrypted Tor traffic hits the public internet. Traffic originating here is fully anonymous, masking the user's true IP address, and is frequently used for malicious activities or ban evasion.

How often is the Tor node list updated?

We synchronize our intelligence with the Tor directory authorities continuously. The consensus is published roughly every hour, and our edge nodes are updated immediately, ensuring new exit nodes are flagged within minutes of coming online.

Should I block all Tor traffic?

It depends on your business. For e-commerce, banking, or sensitive logins, blocking Tor is an industry best practice to prevent fraud. However, if you run a privacy-centric application or a journalism platform, you might just flag the traffic instead.

What is the exit_probability field?

The exit_probability is a calculated metric (between 0.0 and 1.0) indicating how much of the total Tor network's exit capacity is routed through this specific node. A higher number means the IP is more likely to be the source of the Tor traffic.

Can Tor users bypass this detection?

No. The nature of the Tor network requires exit nodes to be publicly listed in the directory consensus so Tor clients know how to build circuits. Our API ingests this consensus directly, making bypass impossible.

Does this API detect Tor bridges?

Tor bridges are entry points used to bypass censorship, not exit points. Since your application only sees the exit node, detecting bridges is not relevant for securing your inbound traffic.

IP Shield

Account

IP Intelligence

Tor Exit Node Detection API

Block or flag traffic originating from the Tor anonymity network instantly.

    {
  "ok": true,
  "date": "2025-06-12T00:00:00Z",
  "data": {
    "ip": "185.220.101.12",
    "proxy": true,
    "vpn": false,
    "threat_level": 95,
    "is_known_bot": false,
    "bot_details": null,
    "is_tor_node": true,
    "tor_details": {
      "flags": [
        "Exit",
        "Fast",
        "Running",
        "V2Dir",
        "Valid"
      ],
      "last_seen": "2025-06-12T00:00:00Z",
      "exit_probability": 0.85,
      "guard_probability": 0.12,
      "exit_addresses": [
        "185.220.101.12"
      ],
      "exit_policy_summary": "accept 80, 443",
      "country": "DE",
      "as_name": "TORNODE",
      "as_id": "208294"
    },
    "asn": {
      "asn_id": "208294",
      "asn_name": "TORNODE",
      "classification": "hosting",
      "route_visibility_count": 1054
    }
  },
  "meta": {
    "total_credits": 10000,
    "credits_remaining": 9999
  }
}

Tor Exit Node Detection

The Tor network is widely used to obscure the true origin of network traffic. While sometimes used for legitimate privacy reasons, Tor exit nodes are frequently a source of malicious activity, spam, and hacking attempts. Our API detects this traffic instantly.

Up-to-date Exit Nodes
Our lists are synced continuously with the Tor directory authorities.
Low Latency
Lookups take single-digit milliseconds to ensure no slowdowns.
Simple Boolean Flag
Easily write logic against the `is_tor_node` property in the response.

Relay Metadata & Analysis

Beyond simple detection, the API provides rich metadata about the Tor relay itself. Understand the node's capabilities, its geographic location, and its exit probability to make nuanced security decisions rather than blanket blocking.

Exit Probability
Assess the mathematical likelihood that the given IP was acting as a Tor exit node.
Node Flags
Review raw Tor directory flags (Exit, Fast, Guard) assigned to the relay.
Exit Policy Summary
Understand which ports the node allows traffic to exit from (e.g., HTTP/HTTPS only).

Tor relay metadata abstract visualization

Deep Web Traffic Management

Apply the right amount of friction. For consumer e-commerce or sensitive banking applications, blocking Tor entirely is a best practice. For privacy-centric platforms, you can use our intelligence to monitor behavior instead.

Spam Prevention
Automatically challenge or block forum sign-ups originating from Tor.
Account Security
Prevent unauthorized login attempts from actors masking their true location.
Reduce API Abuse
Stop scrapers and attackers using the Tor network to bypass rate limits.

Deep web traffic management abstract visualization

Reliable Dark Web Intelligence

Secure your application from anonymous threats.

Near Real-time Sync

We monitor the Tor consensus network to detect new relays within minutes.

Comprehensive Coverage

Identifies both documented exit nodes and unlisted bridge relays.

Combined Threat Context

Tor detection is returned alongside ASN and threat score data.

Millisecond Response Times

Designed to be placed in the critical path of authentication flows.

Zero False Positives

Cryptographically verified against the Tor directory authorities.

Simple Integration

One REST API call gives you complete visibility into the network origin.

Quota Management

Easy credit tracking with HTTP 429 headers for rate limiting.

Secure your app from Tor traffic

Get 1,000 free requests per month when you register.

Get API Key