How to detect Tor exit nodes at login

Tor is a legitimate privacy tool, and also a favourite for account takeover and abuse because it hides the origin of a request. Detecting it at login lets you apply the right level of friction.

Detection is a list problem

Every Tor exit node is public: the Tor project publishes the live exit list. Detecting Tor is therefore reliable, match the source IP against the current exit set. The trick is keeping the list fresh (it changes constantly) and doing the lookup fast enough to sit inline with login.

What to do with a Tor login

• Low-risk flows: allow, maybe log it.
• Login / password reset: step up with a second factor.
• High-value actions: block, or require manual review.

Blanket-blocking Tor annoys privacy-conscious users, so tie the response to the sensitivity of the action, not a global rule.

Try it

Paste a Tor exit into the live classifier and you will see it flagged as Anonymised / TOR with a high risk score. Get an API key to run the same check at your login.