Detect anonymous traffic from the Tor network
VerifyWall identifies connections from known Tor exit nodes, flagging high-anonymity traffic that frequently correlates with abuse.
What it is
Tor (The Onion Router) is an anonymity network that routes traffic through multiple encrypted relays worldwide. Traffic exits through "exit nodes" — the final relay before reaching your server. While Tor serves legitimate privacy needs, it is disproportionately used for fraud, account abuse, and circumventing security controls.
Why it matters for SaaS
Tor traffic represents an outsized share of abuse on SaaS platforms. Because Tor completely masks the user's real IP and location, it's the tool of choice for creating fraudulent accounts at scale, carding attacks, and credential stuffing. The anonymity makes it nearly impossible to correlate or ban repeat offenders using traditional IP-based methods.
How VerifyWall detects it
VerifyWall monitors the Tor network in real time, maintaining an up-to-date list of all active exit nodes. When an IP check is performed, we cross-reference the IP against known exit nodes from the Tor directory authority consensus. The "tor" reason is flagged with high confidence, as Tor exit node lists are publicly verifiable.
Risk score impact
Tor exit node detection adds 70 points to the risk score, reflecting the high correlation between Tor usage and fraudulent activity on SaaS platforms.
API response example
When this threat type is detected, the API returns a response like this:
{
"data": {
"id": "a1b2c3...",
"type": "checks",
"attributes": {
"subject": "176.10.99.200",
"subject_type": "ip",
"risk_score": 70,
"risk_level": "medium",
"reasons": [
"tor"
],
"details": {
"ip": "176.10.99.200",
"country_code": "CH",
"is_vpn": false,
"is_tor": true,
"is_datacenter": false
}
}
}
}Frequently asked questions
How accurate is Tor exit node detection?
Extremely accurate. Tor exit node lists are published by the Tor directory authorities and updated frequently. VerifyWall monitors these lists in real time, achieving near 100% detection rate for traffic originating from known exit nodes.
Should I block all Tor traffic?
It depends on your use case. Some platforms block Tor outright, while others use it as one signal among many. VerifyWall provides the detection — you configure the response. Many customers require additional verification (like phone number) for Tor users rather than blocking them entirely.
Can Tor users bypass detection using bridges?
Tor bridges hide the fact that a user is connecting to Tor from their ISP, but the traffic still exits through public exit nodes. VerifyWall detects traffic at the exit node level, so bridge usage doesn't affect detection accuracy.
Related resources
Integration Guides
Ready to protect your platform?
Start detecting tor exit node threats in minutes with a single API call.