{"uid":"cap_XiNBeVqlewL44rHh_BuZy","slug":"sitecheck-web-intel-tor-exit-node-lookup-234f1f13","name":"SiteCheck Web Intel – Tor Exit Node Lookup","description":"Checks an IPv4 address against the Tor Project's bulk exit list (about 1,200 active exit IPs). If it is an exit, adds the relays for that address from Onionoo: nickname, flags, country, first and last seen. Only exit IPs are on the list; a relay's other IPs are not checked.","url":"https://api.webintel-api.workers.dev/api/security/tor-exit-nodes?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":["ip"],"properties":{"ip":{"type":"string","description":"IPv4 address such as 171.25.193.25 (required)"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.002","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.002/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_q75sxOniNAmzpYG_ofCYx","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.002","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Checks whether a given IPv4 address is a Tor exit node and returns relay metadata (nickname, flags, country, first/last seen) from Onionoo if it is.","exampleAgentPrompt":"Can you check whether 171.25.193.25 is a Tor exit node, and if so, give me the relay nickname, country, and when it was first and last seen?","exampleUseCases":[{"title":"Fraud detection for suspicious login","prompt":"We just got a login attempt from 185.220.101.47 — can you tell me if that IP is a known Tor exit node so I can flag it as potentially anonymous traffic?"},{"title":"Security audit of web traffic","prompt":"I'm reviewing our server logs and want to know if 94.230.208.147 is a Tor exit node. If it is, what country and relay flags does it have?"},{"title":"Threat intel enrichment for SOC alert","prompt":"We have an alert on IP 199.87.154.255 — please check if it's on the Tor exit list and pull any Onionoo relay metadata like nickname and when it was active."}],"resultDescription":"Returns whether the IPv4 address is present on the Tor Project's bulk exit list (~1,200 active IPs). If it is a Tor exit node, also returns enriched relay details from Onionoo: relay nickname, flags (e.g. Exit, Guard, Stable), country code, and first/last seen timestamps. Non-exit IPs return a negative result with no relay metadata.","failureModes":["IP not on exit list returns a negative/not-found result (not an error)","Invalid or non-IPv4 input returns a 400 or validation error","Relay's non-exit IPs are not checked and will always return negative","Onionoo data may lag actual network state by hours","API returns 402 if payment header is missing or invalid","Cloudflare Worker timeout if upstream sources are slow"],"whenToPreferThis":"Choose this endpoint when you need a fast, low-cost check of whether a specific IPv4 address is an active Tor exit node, with bonus relay metadata. Prefer it over generic IP reputation APIs when Tor-specific detection is the goal. Note it only covers exit nodes (~1,200 IPs), not all Tor relays or bridges, so pair with broader threat intel if full Tor relay coverage is needed.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-24T12:44:48.893Z","isFirstParty":false,"canonicalSlug":"sitecheck-web-intel-tor-exit-node-lookup-234f1f13"}