Would it be possible to block Tor users? (https://www.torproject.org/)

Due to the nature of the site I run I should do all I can to stop multiple accounts and block certain locations. Tor is worse than proxies - a total nightmare...

12 Answers 12


Tor is much easier to block than other open proxies since the list of exit IP addresses is known and published. Read the answer at https://www.torproject.org/docs/faq-abuse.html.en#Bans and if you still want to block users from accessing your site you could use https://www.torproject.org/projects/tordnsel.html.en or the Bulk Exit List exporting tool.

If you use the Bulk Exit List exporting tool be sure to get a fresh list often and expire the old blocks since the list of IP addresses change.

  • 2
    No matter how up-to-date your list is, Many exit nodes aren't even on that list isn't it? – Pacerier Dec 30 '14 at 14:43
  • 2
    @Pacerier Why wouldn't they be? – Sven Slootweg Mar 29 '15 at 16:57
  • 2
    @Pacerier Not as far as I am aware, unless you run your own parallel Tor network (which kind of defeats the point). For a node to be taken into consideration when building circuits, it needs to be available in the node directory - and that is what those block lists are built from. – Sven Slootweg Apr 6 '15 at 6:01
  • 1
    @SvenSlootweg If you have a regular internet connection at home with a dynamic ip address (which can change each time you disconnect and reconnect) and run an exit node then you won't be on that list initially. Conversely, when my isp recycles the ip addresses and i end up with one which was previously used and which did end up on the list then i'd be pointlessly blocked, costing the site traffic. As time goes by, and more and more people run exit nodes you'll end up pointlessly blocking more and more people. – user146043 Nov 4 '15 at 15:06
  • 1
    @Alex Of course. There's a reason I don't encourage people to block anything. There are often much better ways to deal with abuse, such as requiring moderator activation/confirmation from "high-risk" users. – Sven Slootweg Nov 5 '15 at 15:42

Blocking Tor is wrong because (ab)users and IP addresses are not the same. By blocking Tor you will also block legitimate users and harmless restricted Tor exit nodes configured with conservative exit policies.

For example, if you concerned about attacks on SSH (port 22) then blocking only Tor will do little to increase security. What you really might need is dynamic synchronised blacklist like http://denyhosts.sourceforge.net/ that track offenders disregarding of their affiliation with Tor.

Denyhosts will automatically block Tor exit nodes that allow Tor to access port 22 without unnecessary denying access to anonymous users and operators of Tor exit nodes who never let offenders to attack your SSH services.

  • 1
    Apparently DenyHosts is dormant since 2008 so it is better to use actively maintained Fail2ban instead. – Onlyjob Nov 17 '14 at 1:30
  • 4
    Your suggestions are for defending against breakers, not spoofers. The asker is asking how to stop cheaters from having multiple accounts. – Pacerier Dec 30 '14 at 14:47

The Tor Project actually provides its own list here:



In .NET it's possible and simple. I have implemented it on my site.

Let's say your site has an external IP address of for argument's sake. Real TOR IP address at the time of posting:

Imports System.Net
Imports System.Net.Sockets
Imports System.Web

Private Function IsTorExitNode(sIP As String) As Boolean

    ' Reverse your IP ( then pass to the string, I have just created it as one for this example
        Dim strTor As String = ""
        Dim host As IPHostEntry = Dns.GetHostEntry(strTor)

        If host.AddressList.Length = 0 Then
            Return False
            If host.AddressList(0).ToString() = "" Then
                Return True
                Return False
            End If
        End If
    Catch ex As SocketException
        Return False
    End Try
End Function


Reversed IP address:
Port: 80
Reversed IP address: (your external site IP address)

If the address is a TorExitNode it will return

In your Global.asax file, you can use the Application_Start to check if IP address returns true and then redirect them away from your site:

If IsTorExitNode("") = True Then Response.Redirect("http://www.google.co.uk")

Now, as soon as they hit your site they are redirected away from it.

TOR has a list of IP addresses, but obviously they change all the time so using my function would be the best way as it's always real-time.


You can use the TorDNSEL service to perform a live query about whether a specific IP address is a Tor exit node. You query the service via a specially-formed DNS request.

Here is some sample PHP code that performs the lookup:

function isTorExitNode() {
    $serverPort = $_SERVER['SERVER_PORT'];
    $remoteAddr = reverseIp(getClientIp());
    $serverAddr = reverseIp($_SERVER['SERVER_ADDR']);
    $placeholders = '%s.%s.%s.ip-port.exitlist.torproject.org';
    $name = sprintf($placeholders, $remoteAddr, $serverPort, $serverAddr);
    return ( gethostbyname($name) === '' );

function getClientIp() {
    if (isset($_SERVER['HTTP_CF_CONNECTING_IP'])) {
        return $_SERVER['HTTP_CF_CONNECTING_IP'];
    return $_SERVER['REMOTE_ADDR'];

function reverseIp($ip) {
    $ipParts = explode('.', $ip);
    return $ipParts[3] . '.' . $ipParts[2] . '.' .
           $ipParts[1] . '.' . $ipParts[0];

if (!isTorExitNode()) {
    // Do nothing
} else {
    Die("Sorry, You cannot use TOR network!!!");

Important Notes:

  • This example supports IPv4 addresses only, not IPv6.

  • It could take a couple of seconds to get a response, so be careful about introducing delays into your site rendering.

  • 1
    Please, instead of only posting your code, always consider to describe what your code does and how to use it. – Murmel Oct 30 '17 at 8:04
  • It may not be a well-formatted answer, but it works. +1 – JBH Nov 7 '17 at 19:53
  • 1
    See torproject.org/projects/tordnsel.html.en for the context – Angstrom Nov 23 '17 at 8:41
  • 1
    @CemArslan - may want to check that the client is coming from IPv4 address, and not IPv6. – Angstrom Nov 23 '17 at 8:55
  • I added some additional explanation to the code snippet to make it more useful. 🙂 – Simon East Mar 19 at 2:17

It's a fact, that the best application defence is its code and security, not a firewall blocklist. If it's an essential matter for you to have real true users - you have to use two-factor authentication. Blocklists are totally useless nowadays.

  • Not sure why someone down-voted you, there is some merit to your answer, but it is too categorical. Of course, the code and its security is the first and best line of defense. But it does not hurt to implement defense in depth, especially if you have been exposed to the "quality" of some corporate code bases. – Tony BenBrahim Mar 22 '14 at 4:03
  • 1
    I saw alot of code in my practice - and banning Tor users, making blacklists backfires on a website in a bad way. It blocks a normal users badly and in a hard way. Open your app, use IPS in-lined and look at user's behaviour. Firewalling is not effective any more – Alexey Vesnin Mar 30 '14 at 16:01
  • 1
    Look at your user's behavior is nice if you have 20. and 20 flows in your system. scale this, and this approach doesn't scale.. – JAR.JAR.beans Jan 8 '15 at 8:50
  • 2
    Thus one must write code to analyze the traffic much as the users will write code to circumvent your analysis. – Darren Ringer Feb 3 '15 at 23:16

Here (see https://github.com/RD17/DeTor) is a simple REST API to determine whether a request was made from TOR network or not.

The request is: curl -X GET http://detor.ambar.cloud/.

The response is:

  "sourceIp": "",
  "destIp": "",
  "destPort": "8080",
  "found": true 

As a bonus you can add a badge to your site to detect whether a user comes from TOR or not:

<img src="http://detor.ambar.cloud/badge" />

  • this service doesn't seem to exist anymore – billynoah Jul 13 at 2:41

I found a list of all the Tor nodes updated every half an hour: https://www.dan.me.uk/tornodes

This SHOULD include the exit, entries and bridge nodes used to connect and browse through Tor.

Use this Perl script to gather the IP addresses from a downloaded webpage:

perl -lne 'print $& if /(\d+\.){3}\d+/' downloadedwebpage.html > listofips.out

It will give you a list of IP addresses , one per line. I have tried to find something that will do this without the Perl script, but after many hours searching I could not find one.

I hope this helps.

I also found some good information here too on the same site: https://www.dan.me.uk/dnsbl

  • 3
    It's pointless to block non-exit tor nodes - all the visible traffic comes from the exits. (I can't check the format of that list because the operator blocks tor nodes from reading it - a very stupid move.) – Andreas Krey Mar 9 '15 at 19:03

(This was written for a PHP specific question that was subsequently deleted and linked here as a duplicate).

Disclaimer: Consider the impact of blocking all Tor users as raised in the best answer here. Consider only blocking functions such as registration, payment, comments etc and not a blanket block on everything.


Here are two pure PHP solutions. The first downloads and caches a Tor node list and compares the visitor IP against the list. The second uses the Tor DNS Exit List project to determine if the visitor is using Tor via DNS lookups.

Method #1 (Checking IP against a Tor relay list):

Using the following set of functions we can determine if an IP belongs to the Tor network by checking it against a dynamic list that gets downloaded and cached for 10 minutes. Feel free to use this list but please cache for 10 minutes when possible.

Where you want to enforce the Tor check, you can simply use:

$isTorUser = isTorUser($_SERVER['REMOTE_ADDR']);

if ($isTorUser) {
    // blocking action

Here is the code which you can put in a separate functions file and include when you want to run the check. Note, you may want to adjust some of it to change the path to the cache file.


function isTorUser($ip)
    $list = getTorExitList();

    if (arrayBinarySearch($ip, $list) !== false) {
        return true;
    } else {
        return false;

function getTorExitList()
    $path = __DIR__ . '/tor-list.cache';

    if ( file_exists($path) && time() - filemtime($path) < 600 ) {
        $list = include $path;
        if ($list && is_array($list)) {
            return $list;

    $data = file('https://openinternet.io/tor/tor-node-list.txt');
    if (!$data) {
        return array();

    $list = array();

    foreach($data as $line) {
        $line = trim($line);
        if ($line == '' || $line[0] == '#') continue;

        list($nick, $ip) = explode("\t", $line);
        $list[] = $ip;


    file_put_contents($path, sprintf("<?php return %s;", var_export($list, true)));

    return $list;

 * Perform binary search of a sorted array.
 * Credit: http://php.net/manual/en/function.array-search.php#39115
 * Tested by VigilanTor for accuracy and efficiency
 * @param string $needle String to search for
 * @param array $haystack Array to search within
 * @return boolean|number false if not found, or index if found
function arrayBinarySearch($needle, $haystack)
    $high = count($haystack);
    $low = 0;

    while ($high - $low > 1){
        $probe = ($high + $low) / 2;
        if ($haystack[$probe] < $needle){
            $low = $probe;
        } else{
            $high = $probe;

    if ($high == count($haystack) || $haystack[$high] != $needle) {
        return false;
    } else {
        return $high;

Method #2 (Checking IP against the Tor DNS Exit List Project):

The DNS exit check is a bit more robust in that it takes into account the relay's exit policy and looks at what IP and port on your server the client is connecting to and if such exit traffic is permitted, it will return a match. The potential downfall is that if the DNS project is down temporarily, DNS requests can hang before timing out slowing things down.

For this example, I will use a class from a library I wrote and maintain called TorUtils.

First, you'll need to install it with Composer using composer require dapphp/torutils and include the standard vendor/autoloader.php code in your application.

The code for the check: $isTor = false;

try {
    // check for Tor using the remote (client IP), server IP, and server Port (e.g. 80, 443).
    $isTor = TorDNSEL::IpPort(
} catch (\Exception $ex) {
    // This would likely be a timeout, or possibly a malformed DNS response
    //echo $ex->getMessage() . "\n";

if ($isTor) {
    // blocking action

Additional Considerations

If your application uses PHP sessions, I'd highly suggest caching the "isTorUser" response into the session (along with the source IP) and only run the check initially or when the IP changes (e.g. $_SERVER['REMOTE_ADDR'] != $_SESSION['last_remote_addr']) as not to perform many duplicated lookups. Even though they try to be very efficient, it's a waste to do over and over for the same IP.


Detecting Tor traffic is rather easy. The main way to do this is to monitor the Tor exit node list and compare the IP against the list.

I had the need to do such a thing recently and built a small Ruby gem to keep the list of exit nodes up to date and provide a simple way to detect exit nodes. I also wrote a small executable you can use to detect exit nodes.

The gem is open source and can be found here: tor-guard

Installing the gem is simple enough:

$ gem install tor-guard

Using the library in your own Ruby code can be done as follows:

require 'tor-guard'

if TorGuard.exit_node?('')
    puts "Yep, it's an exit node!"

The executable is also easy to use:

$ tg && echo "Yep, it's an exit node"


It is possible due to the tor project publishing a list of exit proxies.

The list of exit proxies can be downloaded directly from the project at https://check.torproject.org/exit-addresses in space delimited text form.

I have written a python script to add iptables rules for all exit nodes that reject all packets from them. You can find the script on github here: https://github.com/vab/torblock

If the Tor Project ever decides to stop publishing a list of exit nodes it will be possible to block them. Code would just need to be written to connect to the tor network and discover the exit nodes.


Yes, and in fact here is a script that will do it for all of your windows machines. Like others mentioned above, it's as simple as blocking all the exit nodes, but that takes a little work.


Your Answer

