Tor Exit Node Check — is this IP a Tor exit or open proxy?

Why check for Tor exits and proxies

Traffic leaving the Tor network or an open proxy hides who is really behind a request. That is legitimate for privacy and research, and it is also what credential stuffing, scraping and card testing hide behind. Knowing that a login or a signup arrives through an anonymizer lets you respond in proportion: a captcha, a second factor, a manual review, not necessarily a block.

Where the data comes from

The anonymizers category in IPGuardian is built from 17 public feeds: the Tor Project's own exit list, Emerging Threats and dan.me.uk Tor lists, and open-proxy collections such as FireHOL proxies, SOCKS and SSL proxy trackers. Together they cover more than five million addresses. A match tells you the exact list, so you can tell a Tor exit from a scraped HTTP proxy.

How to use the result

Tor exit lists are precise and current: the Tor Project publishes them itself. Treat a match as a fact.
Open proxy lists are noisier. Proxies appear and disappear within hours, and many sit on residential addresses that are reassigned. Prefer lists with a short window (1 day, 7 days) over 30-day ones for blocking decisions.
An anonymizer match alone is not abuse. In our SSH brute-force measurement only 7% of attackers came through anonymizers; most attacks come from ordinary compromised servers.

Automating the check

Send the address to the API and look for "category": "anonymizers" in the sources:

curl -X POST https://ipguardian.net/api/check \
  -H "Content-Type: application/json" \
  -d '"185.220.101.1"'

Frequently asked questions

Does this detect commercial VPNs?

Only partly. Public lists cover Tor and open proxies well; commercial VPN ranges appear only when a list maintainer has collected them.

Are IPv6 Tor exits covered?

Not yet. The aggregated source lists are IPv4-only, so IPv6 addresses return a clean result.

How often is the Tor list updated?

Once a day, together with all other sources.

Should I block all Tor traffic?

That depends on your service. Many sites allow reading through Tor and add friction only to logins, signups and payments.