Tor Exit Node Checker
Check if any IP address is an active Tor exit node. Refreshed regularly from authoritative sources.
Tor Exit Detection
Identifies active Tor exit nodes from authoritative sources
Threat Context
See if the IP has additional threat flags beyond Tor (proxy, botnet, scanner)
Network Info
Full ASN, prefix, geolocation, and RPKI status for any IP
Always Current
Tor exit list refreshed regularly from authoritative sources
How It Works
Enter IP
Type any IPv4 or IPv6 address into the search bar above.
Instant Check
We check the IP against our Tor exit list and threat intelligence data.
Full Context
See Tor status alongside geolocation, ASN, RPKI, and threat score on the IP detail page.
Frequently Asked Questions
How does Tor exit node detection work?
We maintain an up-to-date list of active Tor exit nodes sourced from authoritative data. When you look up an IP, we check it against this list. Tor exit nodes are the final hop in the Tor circuit - they are the IPs that external servers see when a Tor user connects.
Is a Tor exit node always malicious?
No. Tor is a legitimate privacy tool used by journalists, activists, and security researchers. However, Tor exit nodes are also frequently used to obscure the source of malicious activity. ipctl shows the Tor tag as a neutral fact alongside other threat indicators so you can make your own assessment.
How accurate is Tor detection?
Very accurate for active exit nodes. We use authoritative sources that are refreshed regularly. IPs are tagged when they appear on the list and untagged shortly after leaving. The main edge case is bridge relays, which are not publicly listed by design.
Can I check Tor status via API?
Yes. The GET /v1/ip/{ip} endpoint returns a tags array that includes 'tor-node' when the IP is an active Tor exit. The threat score also factors in Tor status. Free tier includes 1,000 requests/day.
Programmatic Access
Query Tor status via the REST API. The response includes a tags array with "tor-node" when the IP is an active exit.