ip.tor_exit
The address is a known Tor exit node.
What it looks at#
Looks the address up against the Tor Project’s own bulk exit-node list
(check.torproject.org/torbulkexitlist) — the list Tor publishes specifically so
services can identify traffic leaving its network.
Exit nodes change turnover fairly quickly; this check is only as fresh as the last reference-data refresh (CLAUDE.md: “that staleness is accepted until launch, where the refresh cadence is set”).
Why it matters#
Tor is legitimate privacy technology, and plenty of real people use it for ordinary reasons. It’s also a common way to route around per-IP abuse limits and disposable-email enforcement in bulk, so at a signup or contact form it’s a signal worth surfacing rather than silently ignoring.
What to do#
Medium severity — this is a population signal, not proof of abuse. Most operators
combine it with other checks (ip.hosting_provider, the email-side checks on
/v1/signups) rather than blocking on it alone.