Tor exit nodes: what they are, where the live list is, and how to check an address

A Tor exit node is the last relay in a Tor connection. It sends the user's traffic on to the website, so the website sees the exit's IP address and never the user's. The Tor Project publishes every exit address it observes, as a text file at check.torproject.org/torbulkexitlist and as a DNS lookup. On October 23, 2026, the file held 1,227 addresses in the morning and 1,217 just 93 minutes later, so refresh any copy often.

#What is a Tor exit node?

Tor passes each connection through a chain of relays run by volunteers. The exit is the relay at the end of the chain: it opens the connection to the website and carries the answer back. Each exit sets an exit policy that names the ports it serves.

Lists of all Tor relays also hold relays that never connect to websites. For spotting Tor traffic, use the exit list. Blocking every relay in the full list blocks addresses that never send you anything.

#Where is the live list of exit nodes?

The Tor Project runs the source that other lists copy. Its exit list service tests the network and records every address it sees an exit use, whatever that exit's policy says. It offers the result three ways: a text file, a DNS lookup and the raw measurements in its CollecTor archive.

curl -s https://check.torproject.org/torbulkexitlist -o tor-exits.txt
wc -l < tor-exits.txt

The Tor Project does not say how often the file is rebuilt. We read it twice on October 23, 2026: 1,227 addresses at 10:05 UTC and 1,217 at 11:38 UTC. Refresh a local copy at least every hour.

Tor Metrics counted 2,652 relays with the Exit flag on October 20, 2026, about twice the number of exit addresses. The reason is sharing: since June 2023, Tor lets one IP address carry up to 8 relays. Over the past year, the monthly average stayed between 2,604 and 3,222 exit relays.

#How do you check if an IP address is a Tor exit?

For one address, ask the Tor Project's DNS exit list. Write the address's four numbers in reverse order and add dnsel.torproject.org. An exit answers 127.0.0.2, and any other address gets no answer:

$ dig +short 34.101.220.185.dnsel.torproject.org
127.0.0.2
$ dig +short 1.1.1.1.dnsel.torproject.org
$

A TXT lookup on the same name returns the fingerprint of each relay on that address. The free proxy and VPN check shows Tor too, next to the VPN, proxy and datacenter flags. FFraud's Tor exit page lists the exits it tracks.

#What does an exit's abuse record mean?

Almost every exit has one. All 1,217 exits on the list at 11:38 UTC had a record in FFraud's data, and 1,210 of them, 99.4 percent, carried confirmed abuse. These are the most common abuse tags:

The record describes traffic that came out of the exit, sent by some of the people who use Tor. The Tor Project tells exit operators to expect abuse complaints for this reason: the destination sees only the exit. An abuse record on an exit shows that Tor carried attacks, and it says nothing about the person behind the next connection.

FFraud's methodology gives every exit a high score floor for the same reason: anyone can be behind it. Use the score to decide how much proof to ask for, as an IP fraud score explains.

#Are Tor exit nodes dangerous for Tor users?

They can be. In October 2026, attackers broke into servers that ran Tor relays and changed their settings so they intercepted SSH, even turning some relays into exits for it. The Tor Project confirmed the reports on October 5 and had the directory authorities reject the affected relays. A researcher who scanned about 3,000 exits found 333 sending SSH to the same 12 interception servers.

An exit connects to the open internet, so encryption and server checks still matter on the last stretch. Use HTTPS, and check the SSH host key warning before you type a password over Tor.

#Should you block Tor exit nodes?

Decide by what Tor users do on your site. Some firewalls block exits by default, such as WatchGuard's Tor Exit Node Blocking. A block stops the attacks that come through Tor, and it also stops every Tor user, including people who use Tor for privacy. For logins, signups and payments, a challenge often fits better than a block.

To block, load the exit list into the kernel firewall with ipset or into a geo map in nginx, and refresh it every hour.

#Questions people ask