I have a database (hadoop) of the users who access my website (their IPs) and i want to check if those users either use proxy networks or the TOR network and block them.

I also want to differentiate between an legitimate proxy and fake proxy. In case of tor i want to block all tor traffic.

I also have request_headers in the database and i can see X-Forwarded-For for some of the records. So that i can extract the forwarded ip and the original one but how to detect this proxy is a legitimate or its a tor ip?

  • 1
    For check if is a Tor node you can check check.torproject.org/exit-addresses for example
    – camp0
    May 8, 2019 at 11:39
  • 1
    I think the comment from camp0 should be enough information from the point of information security. How to implement your checks in Python is a programming problem, i.e. off-topic here. May 8, 2019 at 11:41

1 Answer 1


This script can be used to get the list of a list of possible Tor nodes that might contact one of your servers. This is basically a list of tor exit nodes which contacted that ip address : But for your use case this is there : https://check.torproject.org/cgi-bin/TorBulkExitList.py?ip=YOUR_SERVER_IP&port=YOUR_PORT

This is a very raw python snippet that should work for you:

import requests
USER_IP = ''
data = requests.get('https://check.torproject.org/cgi-bin/TorBulkExitList.py?ip=' + YOUR_SERVER_IP + '&port='+ YOUR_SERVER_PORT)
if(data.status_code == 200):
    responsedata = str(data.text)
    ip_lists = responsedata.split('\n')[3:]#1st three lines are comments
    if(USER_IP in ip_lists):
        print("Tor usage detected")
        print("Not Tor")
    print("Unable to connect . Error code :" + str(r.status_code))

Ideally you should save the data on disk and then query it because:

  • This list is updated only after 16hr.
  • You cannot query more than 4-5 times in 1hr. (Not really sure about the exact number of times and duration)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .