How we see the Tor network

What it is

A Tor circuit passes through three relays. Only the last one, the exit, ever contacts your service, so the address you see in your logs is an exit address. The guard and the middle relay in that circuit are real machines with real addresses too, and they never touch you.

That distinction is the whole subject of this page, because it decides what a flag on an address is worth to you.

How we actually know

Two sources, both published by the Tor Project itself. The first is the bulk exit list at check.torproject.org, which is the canonical answer to "can this address deliver traffic to me". The second is Onionoo, the project's own metrics service, which describes every relay in the consensus.

From Onionoo we keep only relays still marked running, because it holds entries long after a relay has left the network. For each one we take both its advertised address and its exit addresses, which a relay publishes separately when its traffic leaves from somewhere other than the address it advertises. Both lists are refetched on every nightly rebuild.

What to read in the response

What this flag does not mean

The tor flag means the address is part of the Tor network. It does not mean the address is an exit. We deliberately include guards and middle relays, and you should know that before you act on the flag.

The reasoning is that roughly 55% of relays run from home connections and a relay's role changes over time: an address relaying today can exit tomorrow. Flagging the whole network buys coverage. What it costs is a false positive on a specific and sympathetic person, the volunteer running a middle relay from their flat, who cannot reach you through Tor at all and is scored as though they could.

Tor weighs 100 out of 100, so this flag alone takes the score to 1.0. If your product has users who would plausibly run a relay, and a developer tool does, treat tor as a reason to challenge rather than to refuse. Filtering Onionoo down to the exit flag is a one line change on our side and we will make it if you need it.

Wiring it up

curl -H "Authorization: Bearer nv_live_..." \
     https://novpn.fr/v1/check/185.220.101.1

# => "tor": true, "score": 1, "risk": "high"

What happens on an address nobody has seen

An address the database holds nothing on answers 404, not a low score. That is deliberate: there is no country, no operator and no ASN to return either, so a result would be a row of nulls dressed up as an answer. Treat it as no opinion rather than as clean, and decide for your own case whether to let the request through. The address goes into the scan queue and usually resolves within minutes, and the call is free on a paid plan.

Every field, every error code and the exact billing rules are in the documentation. Endpoints

The other detections, explained the same way

• Residential proxies
• Datacentre ranges