---
title: "Tor Exit and Hosting IP Check"
url: "https://lookvalid.com/tools/vpn-proxy-detection.md"
canonical_url: "https://lookvalid.com/tools/vpn-proxy-detection"
last_updated: "2026-10-19"
type: "tool"
summary: "Check an IP address against the Tor exit list and published cloud and hosting ranges and get a likelihood reading for proxy or anonymizing traffic."
related: ["https://lookvalid.com/docs/api/ip.md"]
---

# Tor Exit and Hosting IP Check

Check an IP address against the Tor exit list and published cloud and hosting ranges and get a likelihood reading for proxy or anonymizing traffic.

Enter an IP address to see whether it is a listed Tor exit or sits in a published cloud or hosting range, with a likelihood reading built from those two lists and the name of the network that owns the address.

## Facts

- Free, no account needed. The address you enter is sent from your browser to LookValid's lookup service to be checked. The service keeps the result, address included, for up to seven days so repeat checks are quick.
- Related API product: [ip](https://lookvalid.com/docs/api/ip.md), 1 credit through the API.

## How it works

1. Enter an IPv4 or IPv6 address, such as one from a signup, a login or a server log.
2. The address is checked against the Tor Project exit list and the address ranges that cloud and hosting providers publish.
3. You get a likelihood reading, which list it matched, and the network that owns the address.

## Example result

IP address 102.130.113.9, taken from the Tor Project bulk exit list, checked on 2026-10-19. Captured 2026-10-19.

- Reading: High likelihood of an anonymizing network
- Tor exit list: Listed
- Cloud and hosting ranges: Not in a published range
- Network owner: AS328364 Host Africa (Pty) Ltd

## What this check covers

It reads two lists: the Tor Project exit list, and the address ranges that major cloud and hosting providers publish for their own networks. Traffic from those addresses is often automated or routed through a proxy.

## How to use the reading

Treat a high or elevated reading as a reason to look closer, for example to add a verification step, not as proof of abuse. A hosting range also holds plenty of ordinary services, and a Tor exit carries traffic from many people.

Treat "not flagged" as the absence of a match on these lists, nothing more.

## The address lists this check reads and how each one moves the reading

| List | What it holds | Effect on the reading |
| --- | --- | --- |
| Tor exit list | Addresses the Tor Project publishes as exit relays of the Tor network. | High likelihood of an anonymizing network. |
| Cloud and hosting ranges | Address ranges that cloud and hosting providers publish for their own networks. | Elevated likelihood of a proxy, VPN endpoint or automated traffic. |
| Neither list | Any other public address, including home and mobile connections. | Not flagged. |

## Sources

- [Tor Project bulk exit list](https://check.torproject.org/torbulkexitlist), read 2026-10-19
- [Amazon Web Services published IP ranges, one of the provider range lists](https://ip-ranges.amazonaws.com/ip-ranges.json), read 2026-10-19
- [DB-IP IP to ASN Lite (network owner), CC BY 4.0](https://db-ip.com/db/download/ip-to-asn-lite), read 2026-10-19

## Questions

### Does this detect a VPN?

Only in the sense that many VPN endpoints sit in published hosting ranges, which gives an elevated reading. It does not detect consumer VPN apps or residential proxies, because those addresses are on none of the lists it reads.

### What does "not flagged" mean?

The address is not a listed Tor exit and is not inside a published cloud or hosting range. It does not mean the connection is direct or safe.

### Why is a hosting address only elevated, not high?

Cloud and hosting ranges hold many normal services, such as websites and corporate gateways. A Tor exit is a stronger signal, so it rates higher.

### How fresh is the Tor list?

The Tor Project republishes its exit list continually because exit relays come and go. A very recent exit may be missing and a retired one may linger for a short time.

### Can I check private addresses like 192.168.1.1?

No. Private, loopback and other reserved addresses are not public internet addresses, so there is nothing to look up for them.

## Related

- [IP Intelligence reference](https://lookvalid.com/docs/api/ip.md)