How to Check Whether an IP Is a Tor Exit Relay—and What It Means

Exit relays are the only Tor addresses websites see

A Tor connection passes through three relays: a guard, a middle relay and an exit. The guard knows who you are but not where you are going; the exit knows the destination but not who you are. Only the exit opens a connection to the website, so the only Tor-related address a website ever sees is an exit relay’s address.

This matters because many tools flag every Tor relay, including guards and middle relays that never connect to ordinary websites. If someone runs a non-exit relay on their home connection, a sloppy “Tor detected” label can follow their address around even though no Tor user’s traffic ever left from it.

The authoritative check: the Tor Project bulk exit list

The Tor Project publishes a plain-text list of exit addresses at https://check.torproject.org/torbulkexitlist. It is built from active measurement: the Tor network’s exit scanner connects through exits and records the address each one actually uses to reach the internet. That last detail matters, because an exit’s outgoing address can differ from the address it advertises as a relay.

TrustIP downloads this list, caches it for 30 minutes and checks each lookup against it. When we checked in October 2026 the list held roughly 1,200 addresses—a small number compared with the size of the internet, which is one reason a Tor match is a strong, specific signal while a vague “anonymizer” label is not.

Checking history with ExoneraTor

The bulk list only describes the present. If you are investigating an incident from last month—an abuse report, a fraud alert, a log entry—you need to know whether the address was a Tor relay on that date. The Tor Project’s ExoneraTor service answers exactly that question: enter an IP address and a date, and it reports whether a Tor relay used that address on or around that date.

ExoneraTor exists so that operators and investigators can establish that traffic came from the Tor network rather than from the person who holds the address today. If an address was a Tor exit when the incident happened, the relay operator is very unlikely to be the original source of the traffic.

If your own address is on the list

• You run an exit relay: this is expected. Publish a clear reverse DNS name and a notice page so abuse reports reach you with context, as the Tor Project recommends for exit operators.
• You do not run Tor, but someone on your network does: shared offices, universities and households can host an exit without everyone knowing. Check with your network administrator.
• You recently received the address: cloud and hosting IPs are recycled. The list is refreshed from live measurements, so a stale entry should disappear once the previous exit stops running. ExoneraTor can show when it was last used.
• Only a third-party tool says “Tor”, but the bulk list does not: the tool is probably counting non-exit relays or using an old snapshot. Point the provider to the bulk list and ExoneraTor as evidence.

What a website should do with a Tor match

A Tor exit match tells you the visitor’s traffic is anonymized; it says nothing about intent. People use Tor to avoid surveillance, to reach services blocked in their country, and to research sensitive topics, and abusers use it too. Proportionate responses—rate limits, step-up verification for sensitive actions, or read-only access—usually work better than blanket blocks, which also lock out legitimate users who have no alternative.

Whatever you decide, base it on the authoritative list, record the time of the check, and remember that the same address may stop being an exit tomorrow.

References and source material

These sources are provided so readers can verify the technical background. Inclusion does not imply endorsement of TrustIP.

• Tor Project bulk exit list
• ExoneraTor — was this IP a Tor relay?
• Tor Project: tips for running an exit node
• Tor Metrics — relay search