Every Tor node, rebuilt every day.
The public Tor node set, published as ranges with the confidence and the build in which each was last observed, and refreshed daily so a node that left the network does not keep blocking customers.
Schema at a glance.
See documentation →The schema and metadata are in the docs. It is published as CSVGZ and MMDB.
| start_ip | end_ip | confidence | last_seen |
|---|---|---|---|
| 46.4.103.35 | 46.4.103.35 | high | 2026-09-08 |
| 188.97.91.218 | 188.97.91.218 | high | 2026-09-08 |
| 46.232.251.191 | 46.232.251.191 | high | 2026-09-08 |
| 91.199.197.75 | 91.199.197.75 | high | 2026-09-08 |
| 2620:18c:0:192::e0:170 | 2620:18c:0:192::e0:170 | high | 2026-09-08 |
Downloading it from code.
Database API reference →One call gets you the current Tor IP build. Every official client wraps it three ways: straight to disk, a time-limited link you hand to your own runner, or bytes in memory, and checksums() returns the published digests to verify it against.
download()downloadUrl()downloadBytes()metadata()checksums()import osfrom internetdata import InternetDataclient = InternetData(os.environ["INTERNETDATA_API_KEY"])# what is in today's build, without moving the filemeta = client.database.metadata("tor_ip_v1")client.database.download("tor_ip_v1", "mmdb", "./tor_ip_v1.mmdb")sums = client.database.checksums("tor_ip_v1", "mmdb")print(meta.updated, meta.entries, sums["sha256"])
Where it occurs.
Tor IP holds 13,329 IPv4 addresses in the latest build. These are the countries and networks with the most of them; each opens its own page, as does every IP range.
By country
Of the 13,329 IP Geolocation places.
- United States4,067 · 30.51%
- Germany3,095 · 23.22%
- The Netherlands926 · 6.95%
- France729 · 5.47%
- United Kingdom426 · 3.20%
- Sweden318 · 2.39%
- Switzerland277 · 2.08%
- Canada261 · 1.96%
- Finland213 · 1.60%
- Russia196 · 1.47%
By network
Each /24 counted for the AS announcing most of it.
- AS368491st Amendment Encrypted Openness LLC1,174 · 8.81%
- AS24940Hetzner Online GmbH582 · 4.37%
- AS16276OVH SAS563 · 4.22%
- AS3320Deutsche Telekom AG418 · 3.14%
- AS197540netcup GmbH274 · 2.06%
- AS8560IONOS SE268 · 2.01%
- AS3209Vodafone GmbH260 · 1.95%
- AS36352HostPapa224 · 1.68%
- AS7922Comcast Cable Communications, LLC222 · 1.67%
- AS63949Akamai Connected Cloud208 · 1.56%
Getting your hands on it.
Free with an account, and the file is yours: teams join Tor IP against the traffic, logs and routing data they already hold, inside their own infrastructure.
Rules and scoring
Join the rows against traffic you already log and score a session on the operator and the confidence, rather than on one boolean.
Account and payment risk
Signals at signup and checkout, where the answer has to be local and consistent.
Network and abuse operations
Attribute what is hitting you to the infrastructure behind it, with provider IDs that stay stable as ranges rotate.
An official client for every major language.
All SDKs on GitHub →Twelve official clients for the languages you ship in, each wrapping the database endpoints: list what you're licensed for, poll a build, follow the download redirect and verify what landed. Install commands are in the docs.
Is it every Tor relay?
Yes, any Tor node: guard and middle relays as well as the exits Tor traffic leaves the network from.
What happens when a node leaves the network?
It drops out of a later daily build, so a departed node stops matching.
Why is it published as ranges?
So it fits the same parsers and MMDB lookups as every other database. Most rows are a single address, with the start and end the same.
Does a match mean we should block?
No. It means the address is a Tor node. Blocking is a policy decision, and challenging or reviewing the traffic is the other one.
How often is it rebuilt?
Daily. The metadata call answers when the current build landed and how many rows it holds, before you fetch it.
Which formats does a build ship in?
Gzipped CSV and MMDB, both cut from the same build. The MMDB opens in any MaxMind DB reader.
Is it really free?
Yes. Create an account and download it from the console, or with your API key from the API or any official client. It's licensed under CC BY-SA 4.0: credit InternetData and share what you build from it under the same license.
Is there a lookup API?
No. You download Tor IP and query it in your own systems, so nothing is metered and no address leaves them. Each build comes from the database API, or to your webhook or your own storage. One address at a time, its page on this site shows what Tor IP holds for it.
What if a row looks wrong?
Send it to us and we'll tell you what we hold on it, when we last saw it and how. Corrections land in the next build.