How fresh is the Tor data?

The exit list changes frequently, so we refresh it continuously to catch new and retired relays quickly.

Should I block all Tor traffic?

That depends on your risk profile. Many teams challenge rather than block, since Tor also has legitimate privacy uses. The score helps you decide.

Yes, Tor is reported as part of the proxy verdict from GET /v1/proxy/{ip}.

IPScanner

Free IP tool

Tor Exit Node Detection

Check whether an IP is a Tor exit node using a continuously updated live list, and automate the same check through the API.

Overview

What is a Tor exit node?

A Tor exit node is the last relay in the Tor network, the IP that the destination website actually sees. Traffic from a Tor exit could be anyone, anywhere, with their real location fully hidden. Tor exit node detection checks an IP against the live, frequently changing list of exit relays so you can apply the right policy to anonymous Tor traffic, whether that is blocking, challenging or simply logging it.

Signals

How Tor detection works

The exit list changes constantly, so freshness matters most.

Live exit list

Correlation against the public Tor exit-node list, refreshed continuously.

Relay history

Tracks IPs that have recently served as exit relays.

ASN context

Many exits sit in known hosting ranges, reinforcing the verdict.

Reputation

Past abuse from the exit raises its risk.

Anonymity flag

Clear signal that origin is fully obscured by Tor.

Confidence score

A 0–100 score accompanies every verdict.

API

The same check, from code

GET/v1/proxy/{ip}

curl -H 'Authorization: Bearer YOUR_API_KEY' \
  'https://ipscanner.io/v1/proxy/185.220.101.1'

response

{
  "ip": "185.220.101.1",
  "isProxy": true,
  "isTor": true,
  "networkClass": "tor",
  "anonymized": true,
  "provider": "Tor exit node",
  "riskScore": 95
}

One request, one verdict. The free plan includes 30,000 lookups a month with no card, and every response carries the network class and a confidence score.

View API docs OpenAPI spec

Use cases

Where teams use it

High-risk actions

Block or challenge Tor traffic on payments and withdrawals.

Abuse mitigation

Reduce spam and harassment routed through Tor.

Compliance

Flag fully anonymised traffic for review.

Threat intel

Enrich logs with a Tor indicator during investigations.

More tools

Explore related detection tools

VPN Detection APIReal-time VPN detection API. Send any IP and get back whether it belongs to a commercial VPN, with a confidence score. Free tier, simple REST, fast global lookups.Proxy Detection APIDetect HTTP, SOCKS, residential and datacenter proxies plus Tor exit nodes from any IP with one REST call. Real-time proxy detection API with a free tier.Residential Proxy DetectionDetect residential proxies that disguise traffic as ordinary home connections. Real-time residential proxy detection by IP with confidence scoring and a free tier.Datacenter Proxy DetectionDetect datacenter and cloud-hosted proxies by IP in real time. Identify hosting ASNs used for proxying and scraping with confidence scoring and a free API tier.

Explore the suite

Try Our Other Tools

VPN DetectionIdentify IPs that route through encrypted VPN tunnels to mask their real location.Proxy DetectionFlag HTTP, SOCKS, residential and data-center proxies plus Tor exit nodes.IP GeolocationMap any IP to country, region and city with ISP and timezone data.ASN DataLook up the Autonomous System Number and organization that owns an IP range.WHOIS InfoRetrieve registration and ownership records for domains and IP ranges.

FAQ

Frequently asked questions

Enter the IP above. We correlate it against the live Tor exit list and return a verdict with a confidence score; the same check is available via the API.

Why Choose IPScanner

Teams use IPScanner to tell real users apart from masked and automated traffic.

Accuracy you can measure

Verdicts come with a 0 to 100 confidence score, so you tune the threshold to your own risk instead of trusting one number.

Built to scale

The API runs on infrastructure sized for production traffic, with a 99.9% uptime target for business-critical use.

Data that stays fresh

We refresh VPN, proxy, and Tor lists continuously, so newly spun-up servers get caught quickly.

Easy to wire in

A plain REST API works with any language or framework. Most teams are live the same afternoon.

Documentation that's honest

Worked examples in curl, JavaScript, and Python, plus straight notes on what each signal does and doesn't mean.

People who know the domain

Support comes from engineers who work on IP detection every day, not a generic help desk.