Example result
IP address 102.130.113.9, taken from the Tor Project bulk exit list, checked on 2026-10-19.
- Reading
- High likelihood of an anonymizing network
- Tor exit list
- Listed
- Cloud and hosting ranges
- Not in a published range
- Network owner
- AS328364 Host Africa (Pty) Ltd
Captured 2026-10-19.
How it works
- Enter an IPv4 or IPv6 address, such as one from a signup, a login or a server log.
- The address is checked against the Tor Project exit list and the address ranges that cloud and hosting providers publish.
- You get a likelihood reading, which list it matched, and the network that owns the address.
What this check covers
It reads two lists: the Tor Project exit list, and the address ranges that major cloud and hosting providers publish for their own networks. Traffic from those addresses is often automated or routed through a proxy.
How to use the reading
Treat a high or elevated reading as a reason to look closer, for example to add a verification step, not as proof of abuse. A hosting range also holds plenty of ordinary services, and a Tor exit carries traffic from many people.
Treat "not flagged" as the absence of a match on these lists, nothing more.
The address lists this check reads and how each one moves the reading
| List | What it holds | Effect on the reading |
|---|---|---|
| Tor exit list | Addresses the Tor Project publishes as exit relays of the Tor network. | High likelihood of an anonymizing network. |
| Cloud and hosting ranges | Address ranges that cloud and hosting providers publish for their own networks. | Elevated likelihood of a proxy, VPN endpoint or automated traffic. |
| Neither list | Any other public address, including home and mobile connections. | Not flagged. |
Sources
- Tor Project bulk exit list read 2026-10-19
- Amazon Web Services published IP ranges, one of the provider range lists read 2026-10-19
- DB-IP IP to ASN Lite (network owner), CC BY 4.0 read 2026-10-19
This tool is run by LookValid. It is not connected to any agency, company or service named on this page.
Frequently asked questions
Does this detect a VPN?
Only in the sense that many VPN endpoints sit in published hosting ranges, which gives an elevated reading. It does not detect consumer VPN apps or residential proxies, because those addresses are on none of the lists it reads.
What does "not flagged" mean?
The address is not a listed Tor exit and is not inside a published cloud or hosting range. It does not mean the connection is direct or safe.
Why is a hosting address only elevated, not high?
Cloud and hosting ranges hold many normal services, such as websites and corporate gateways. A Tor exit is a stronger signal, so it rates higher.
How fresh is the Tor list?
The Tor Project republishes its exit list continually because exit relays come and go. A very recent exit may be missing and a retired one may linger for a short time.
Can I check private addresses like 192.168.1.1?
No. Private, loopback and other reserved addresses are not public internet addresses, so there is nothing to look up for them.