Every Tor node, rebuilt every day.
The public Tor node set, refreshed daily so a node that left the network does not keep blocking customers.
Schema
See documentation →Published as CSVGZ and MMDB. Every column is described in the docs.
| start_ip | end_ip | confidence | last_seen |
|---|---|---|---|
| 46.4.103.35 | 46.4.103.35 | high | 2026-09-08 |
| 188.97.91.218 | 188.97.91.218 | high | 2026-09-08 |
| 46.232.251.191 | 46.232.251.191 | high | 2026-09-08 |
| 91.199.197.75 | 91.199.197.75 | high | 2026-09-08 |
| 2620:18c:0:192::e0:170 | 2620:18c:0:192::e0:170 | high | 2026-09-08 |
Downloading it from code.
Database API reference →One call gets you the current Tor IP build. Every official client wraps it three ways: straight to disk, a time-limited link you hand to your own runner, or bytes in memory. A file written to disk lands only once the whole transfer has arrived, and checksums() returns the published digests to verify it against.
download()downloadUrl()downloadBytes()metadata()checksums()What it's used for
Three decisions Tor IP is bought for, and what each needs from the data rather than from a score.
Apply the policy you actually want
Some products welcome Tor and some can't accept it. This set lets you make that call on purpose.
Avoid stale blocks
Tor nodes churn constantly. A daily rebuild means a node that left stops being punished.
Small enough to embed
The whole set fits anywhere, including edge workers.
Official SDKs
All SDKs on GitHub →Twelve official clients, each wrapping the database endpoints as well as the lookup: list what you're licensed for, poll a build, follow the download redirect. Install commands are in the docs.
Common questions
Is it every Tor relay?
Yes, any Tor node: guard and middle relays as well as the exits Tor traffic leaves the network from.
What happens when a node leaves the network?
It drops out of a later daily build, so a departed node stops matching.
Why is it published as ranges?
So it fits the same parsers and MMDB lookups as every other database. Most rows are a single address, with the start and end the same.
Does a match mean we should block?
No. It means the address is a Tor node. Blocking is a policy decision, and challenging or reviewing the traffic is the other one.
How often is it rebuilt?
Daily. The metadata call says when the current build landed and how many rows it holds, so you fetch only a new one.
Which formats does it ship in?
Gzipped CSV and MMDB, both cut from the same build. The MMDB opens in any MaxMind DB reader, so lookups run in memory on your own servers.
Is it really free?
Yes. Create an account and download it from the console, or with your API key from the database API or any official client. Each new build can also be announced to your webhook, or written to your AWS S3 or S3-compatible storage, Google Cloud Storage, Azure Blob Storage, or an SFTP or FTPS server. It's licensed under CC BY-SA 4.0: credit VPNDetection and share what you build from it under the same license.
Is it the same data the API answers from?
Yes. A lookup's is_tor comes from these builds, so the file and the API agree on an address.
What if a row looks wrong?
Send it to us and we'll tell you what we hold on it, when we last saw it and how. Corrections land in the next build.
Start without signing up.
Paste it into a terminal. No account needed. 1,000 lookups a day per address, answering ip and is_vpn.
{"ip": "146.70.116.130","is_vpn": true}