What is a Tor exit node, and should I block it?
You looked up an address from your logs and the answer came back: Tor exit node. That sounds alarming. It mostly means you've learned where the trail ends.
How Tor hides an address
Tor Browser sends each connection through three relays run by volunteers around the world. The first knows who the user is but not where they're going. The last, the exit, knows the destination but not who asked. Your website talks to the exit, so the exit's address is the one in your log.
Two consequences follow, and they matter more than anything else in this guide:
- An exit address isn't a person. Hundreds of unrelated people can use the same exit in an hour. Blocking it blocks all of them; identifying “the person behind it” from your side is impossible by design.
- The same person can arrive from many exits. Tor picks new circuits regularly, so blocking one exit address stops one connection, and the next arrives from somewhere else.
Not every relay is an exit, and exits don't all allow the same traffic: each relay operator sets an exit policy, and many relays don't allow exiting at all. That's why only the exit list matters for your logs.
How to tell an address is a Tor exit
The Tor Project publishes the current exit addresses as a plain list, one per line, at check.torproject.org/torbulkexitlist. iplover downloads it every three hours and compares addresses with it on our server. For a past date, the Tor Project's ExoneraTor service says whether an address was a Tor relay on a given day, which is the question to ask about an old log line.
A worked example: a password guesser on Tor
Four lines from a WordPress access log, eight seconds apart:
185.220.101.1 - - [05/Nov/2026:09:31:07 +0000] "POST /wp-login.php HTTP/1.1" 200 6832 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0"
185.220.101.1 - - [05/Nov/2026:09:31:09 +0000] "POST /wp-login.php HTTP/1.1" 200 6832 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0"
185.220.101.1 - - [05/Nov/2026:09:31:12 +0000] "POST /xmlrpc.php HTTP/1.1" 200 4272 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0"
185.220.101.1 - - [05/Nov/2026:09:31:15 +0000] "POST /wp-login.php HTTP/1.1" 200 6832 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0"iplover's IP lookup for 185.220.101.1 returned this on 9 November 2026:
| Verdict | Tor exit node This is a Tor exit node. |
|---|---|
| Why | Found in the Tor Project bulk exit list. “Traffic from this address comes from people using the Tor network to hide where they connect from. It is not the address of the person behind it.” |
| Reverse DNS | berlin01.tor-exit.artikel10.org, confirmed forward |
| Network | Artikel10 e.V., RIPE NCC (AS60729), Germany |
| Abuse contact | abuse@artikel10.org |
Read the reverse name: the operator calls the machine a Tor exit openly. Large exits are often run by non-profits like this one, which publish who they are and answer abuse mail, even though they can't tell you which user sent a request.
As for the four requests: they're password guesses, and all failed (a failed WordPress login returns the login page again with status 200; a successful one redirects with 302). Blocking this exit would stop these four. The next batch would come from another exit, or from a cloud server. The useful fix is the same as for any password guessing: strong passwords, two-factor authentication, and rate limits on the login page.
Should you block Tor?
The Tor Project's own advice to site operators is worth repeating: some of the Tor users reaching your service right now may be entirely legitimate. Journalists, people in countries that censor the web, people avoiding tracking, and security researchers all use it. Whether blocking is worth losing them depends on your site:
| Your situation | Sensible choice | Why |
|---|---|---|
| Blog, news, documentation, public information | Don't block | Reading is harmless, and these readers often have good reasons for Tor. |
| Password guessing on your login page | Rate-limit and add 2FA for everyone | Guessers switch exits and networks; the fix has to be on the login itself. |
| Fraud on sign-ups or payments | Add friction for Tor: extra verification, manual review, a challenge | Keeps genuine users possible while raising the cost of abuse. |
| Comment or form spam | Challenge or moderate, rather than block | Spam arrives from everywhere; Tor is rarely most of it. |
| Admin panels, internal tools | Allow only known addresses or a VPN | These should be closed to the whole internet, not just to Tor. |
| A legal or contractual reason to know a user's country | Block or restrict Tor, and say so on the page | Tor makes location unknowable by design. |
If you do restrict Tor, the exit list is the only reliable source, and it changes constantly, so use it automatically rather than pasting addresses into a config file. Some CDNs do this for you: Cloudflare, for example, labels Tor visitors with the special country code T1, so you can treat them differently instead of blocking them outright.
What a Tor exit can't tell you
Seeing a Tor exit tells you the visitor chose privacy. It doesn't tell you who they are, where they are, or whether they mean harm, and nothing on your side can find out. Judge the request, not the network: four password guesses are a problem from any address, and an ordinary page view isn't one, even from Tor.
Sources
Official documents we used to check the facts in this guide.