Skip to content
Spaw
Get your API key

Tor exit node

published · September 10, 2026

A Tor exit node is the last relay in a Tor circuit, the machine that makes the request to the destination on the user's behalf.

A Tor exit node is the last relay in a Tor circuit — the machine that makes the request to the destination on the user's behalf, and therefore the address a server sees. The Tor Project publishes the list of them, so this is one of the few network facts that is exact rather than inferred.

What Spaw answers

is_tor is the flag, and it feeds is_anonymous along with is_vpn and is_relay. The risk score carries +70, the heaviest of the anonymity signals: a VPN is +30 and Apple's iCloud Private Relay is +10.

The gap between those three numbers is the whole judgement. Tor conceals origin deliberately and is rare in ordinary consumer traffic; a commercial VPN is a privacy product millions of people leave switched on; Private Relay is on by default for iCloud+ subscribers and says almost nothing about intent.

What it does not mean

Tor is used by people who need it. Treating +70 as a block is a policy decision, not a reading of the data, and the guide beside this entry argues for a step-up rather than a refusal. Nothing in the answer identifies the person behind the circuit — that is the point of the circuit.

Related

markdown version: /glossary/tor-exit-node.md

Verify addresses the same way

The Spaw API runs every check described here on each lookup, with an SMTP handshake that never sends mail. 10 free lookups a month, no card required.

Get your API key

More glossary

  • ASN

    An Autonomous System Number identifies one network that announces its own routes to the internet under a single routing policy.

  • Address register

    An address register is a country's official file of every address its authorities recognise, usually keyed on buildings rather than letterboxes.

  • CIDR

    CIDR notation writes a range of IP addresses as one address and a prefix length, so 203.0.113.0/24 means the 256 addresses sharing those first 24 bits.

  • Catch-all domain

    A catch-all domain is one whose mail server accepts mail addressed to every recipient, whether or not that mailbox exists.

  • Check digit

    A check digit is a digit computed from the rest of an identifier so that a mistyped one usually fails arithmetic before anybody looks it up.

  • Company number

    A company number is the identifier a national registrar assigns to an incorporated company, unique within that register and never within the world.

  • Credit

    A credit is the billing unit of the whole API: one credit buys one fresh lookup that produced a usable answer, on any of the six signals.

  • Datacenter IP

    A datacenter IP is an address inside a range operated by a hosting, cloud or server provider rather than by a consumer access network.