A Tor exit node check answers one question: does this address belong to the Tor network’s exit list? Tor exit nodes carry traffic from many users. An address from an exit node can be a journalist, a privacy-conscious customer or a script that hides its origin. The flag describes the network, and the person behind it remains unknown.
The TOR detector checks an address against the current exit-node list.
curl "https://api2.globus.studio/v2/tor?ip=8.8.8.8&format=json"What a Tor exit node check response means
A Tor exit node check returns is_tor true when the address is in the list. The response also has a short message. The full exit-node list is not returned; that would be a large response and a privacy leak of its own.
How the list updates
The Tor exit node check list is fetched on a schedule and stored on the server. A node that joined a minute ago may not appear yet. A node that left may still appear until the next refresh. Treat the result as a recent snapshot.
What to do with it
A Tor exit node check can shape a login policy: a Tor address can trigger a second factor or a manual review. For a public blog, it can be ignored. For an API with a free tier, it can share the rate limit with other anonymous traffic.
Blocking every Tor address punishes the users who need privacy and does little against a determined attacker. A challenge is usually a better response than a hard block.
Combine with other signals
A Tor address with a fresh account and a burst of requests is different from a Tor address that reads one page. The IP bot check and the geolocation endpoint add context. The decision should depend on what the request does.
Privacy
Do not publish a list of your users’ Tor addresses. Log the flag, not the whole address, when you can. Keep retention short. A Tor exit node check tells you about the network path; it does not tell you why someone uses it, and the log should not guess. Store the decision and the rule version, not a permanent label on the account.
Limits
The Tor exit node check is fast and rate limited. The response is a recent snapshot, so a single call cannot prove that an address is clean forever. Read the endpoint documentation for parameters and examples.
Exit nodes and relays
A Tor relay carries traffic inside the network. An exit node is the point where traffic leaves for the public internet. The endpoint checks exit nodes because those are the addresses a website sees. A relay address that is not an exit node should not be flagged.
Policy examples
A public documentation site can ignore the flag. A login form can require a second factor. A free API tier can apply the same rate limit as other anonymous traffic. A payment page can ask for a manual review when the amount is high.
Write the policy down. A flag without a rule becomes an inconsistent block list. Review the rule after a month with real data. A Tor exit node check can inform the rule, but the rule decides what happens to the request, and the rule should be the same for every client in the same situation.
Testing the policy
To test a Tor exit node check rule, pick a known exit node and a normal address. Run both through the login flow. Confirm that the exit node gets the challenge and the normal address does not. Then test a Tor user with a valid second factor. The flow should allow the login and record the flag.
Review the rule after a month. If the challenge rate is high and the fraud rate is low, the policy is too strict. If the fraud rate is unchanged, the flag is not adding value.
Related reading
Combine the flag with IP bot detection and User-Agent parsing. For the policy behind the checks, read why a string is not proof.
Further reading: RFC 1928, SOCKS5.