The Tor dataset tracks the IP addresses participating in the Tor network, with a flag distinguishing exit nodes, whose addresses actually originate user traffic, from middle relays that never do.
It is rebuilt continuously from the Tor consensus so new relays appear and retired ones disappear within a day.
Available formats
| Format | Description | Size |
|---|---|---|
| CSV | Plain text, one range per line. Import into any database or data warehouse. | 464 KB |
| CSV (zipped) | Same file compressed for faster downloads and cheaper storage. | 96.7 KB |
| MMDB | Binary format for instant lookups with standard MMDB readers. | 2.1 MB |
Latest build: 10,664 records. Files are regenerated every day and published with MD5, SHA-1, SHA-256 and SHA-512 checksums so you can verify every download.
What's inside
The CSV file starts with a header line and contains one record per row, with the following fields:
| Column | Description |
|---|---|
ip_end | Last IP address of the range, inclusive. |
ip_start | First IP address of the range, IPv4 or IPv6. |
is_exit_node | Whether the range operates as a Tor exit node (true) or a relay only (false). |
The MMDB variant carries the same data in a memory-mapped binary tree, compatible with the standard MMDB reader libraries available for every major programming language.
What you can build
- Challenge or sandbox Tor exit traffic on sensitive actions
- Distinguish exit nodes from harmless middle relays in threat feeds
- Measure Tor usage across your audience
- Comply with policies that require flagging anonymized access
Related use case: Cyber security
Datasets are available with an Ipregistry subscription and download from your dashboard, or over a stable URL for automated syncs. Prefer live data? The same intelligence is served by the Ipregistry API.