I have someone attacking my site and it would seem some of the IPs are Tor exit nodes.

Is there somewhere I can input an IP and definitively see if it's registered as a Tor exit node?


The Tor Project has a tool to do this at:


For automated lookups, they also provide a DNSBL-based lookup; information on that is available at:


  • How can I setup an API like what exonerator has? the TorDNSEL docs aren't super clear to me – Anthony Sep 19 '17 at 4:19
  • @Antoine You don't have to set up an API, it's already provided. – gf_ Sep 19 '17 at 9:14
  • How can I use it like the exonerator though, where I plug in an IP and receive word back on whether it's an exit node? This API: [service port].[reversed service address].ip-port.exitlist.torproject.org isn't super clear to me, what's a reversed service address in this instance? – Anthony Sep 19 '17 at 18:15
  • @Antoine Read the web page for DNSEL, under "What do the received answers mean?". – user15323 Sep 19 '17 at 18:23
  • @Antoine you can use github.com/assafmo/IsTorExit – assafmo Mar 28 '18 at 5:30

I actually implemented the solution @duskwuff suggested.
Check it out at - https://github.com/assafmo/IsTorExit


npm install -g istorexit
istorexit [ip...]


const IsTorExit = require("istorexit");
IsTorExit("").then(console.log); // true
IsTorExit("").then(console.log); // false


On this link you can check if IP is an tor exit node.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.