Account takeover
Credential stuffing and password guessing often run over Tor to hide their source.
What counts as Tor
Tor sends a visitor’s traffic through several volunteer-run relays, so your site only sees the last one, the exit node. It gives strong anonymity, which is why it’s popular for abuse that needs to stay hidden.
VPN Blocker refreshes the list of Tor exits every hour. Look up an IP and categories contains tor when it’s a current exit, or one seen in the last 7 days, with a confidence score that tells you which.
GET https://api.vpnblocker.net/v2/json/185.220.101.33
{
"status": "success",
"package": "Professional",
"remaining_requests": 987652,
"ipaddress": "185.220.101.33",
"host-ip": false,
"categories": ["tor"],
"confidence": 98,
"hostname": "tor-exit-33.for-privacy.net",
"org": "Stiftung Erneuerbare Freiheit",
"country": {
"name": "Germany",
"code": "DE"
},
"subdivision": {
"name": "Brandenburg",
"code": "BB"
},
"city": "Brandenburg an der Havel",
"postal": "14621",
"location": {
"lat": 52.6171,
"long": 13.1207
}
}How to check for Tor
Check categories for tor. Add confidence ≥ 90 to match only current exits, or ≥ 70 to include exits seen in the last 7 days.
JavaScript
const r = await lookup(ip); // see the guides for lookup()
const isTor = r !== null && r.categories.includes('tor') && r.confidence >= 90;PHP
$r = vpnblocker_lookup($ip); // see the guides for vpnblocker_lookup()
$isTor = $r !== null && in_array('tor', $r['categories'], true) && $r['confidence'] >= 90;Python
r = lookup(ip) # see the guides for lookup()
is_tor = r is not None and "tor" in r["categories"] and r["confidence"] >= 90Full walkthroughs: PHP · Node.js · Python · game servers and Discord
Why sites block Tor
Payment fraud
Very few genuine purchases come from Tor. Many card fraud attempts do.
Spam and harassment
Stop anonymous accounts from coming back after a ban.
Game servers and chat
Keep banned players and trolls from rejoining.
Sensitive actions only
Allow Tor for reading, and ask for extra checks before sign-up, posting or payment.
Compliance
Meet rules that require you to know roughly where your users are.
Questions
How up to date is Tor detection?
We refresh Tor exits every hour. An address that has stopped being an exit is still reported as tor for 7 days, with a lower confidence, because exits often come back.
Why is host-ip false for a Tor exit?
host-ip describes the network an IP belongs to, while tor describes the IP itself. A Tor exit on a home or university connection is host-ip: false with categories: ["tor"]. If you block Tor, check categories.
Do you detect Tor relays that aren’t exits?
No, only exits. Traffic from the Tor network reaches your site from an exit, so exits are the addresses you see.
How long should I cache Tor results?
About an hour, and never longer than a day, because the list of exits changes often.
Is Tor detection on every plan?
Yes, including the Free plan.
More detection
Start detecting Tor today
Create a free account and make your first lookup in minutes. 10,000 lookups a month at no charge.