Tor Exit-Node Exposure
Anonymised traffic changes how you weigh a source. This tells you whether an address is a Tor exit node, and maps a whole network's exit presence by block and country — so you can size how much anonymised egress a given network carries when you're triaging where traffic really came from.
How it uses the graph
Traverses the threat-intel, BGP, GeoIP layers of the graph, in 6 steps:
How it walks the graph6 steps
01Exit-bearing IPs in scope
Finding the IPv4 addresses in this ASN that operate Tor exit nodes…
threat-intelBGPGeoIP
02Exit density by CIDR prefix
Clustering exit IPs into their /24 and /22 CIDR blocks…
threat-intelBGPGeoIP
03Exit density by announced prefix
Mapping exit IPs to the BGP-announced prefixes that carry them…
threat-intelBGPGeoIP
04Exit IPs by country
Aggregating the exit IPs by GeoIP country…
threat-intelBGPGeoIP
05Is this IP a Tor exit relay?
Is this IP a Tor exit relay?…
threat-intelBGPGeoIP
06Tor relay nodes on this IP
Tor relay nodes on this IP…
threat-intelBGPGeoIP
Why each step runs
- 01Exit-bearing IPs in scope. The cross-layer join from the addressing layer to the Tor-relay threat layer: every IP in the ASN that carries an OPERATES_EXIT_NODE edge, with its GeoIP country and the per-relay fingerprint. This is the anchor the clustering rolls up.
- 02Exit density by CIDR prefix. Rolls the exit IPs up by registered CIDR prefix (BELONGS_TO returns both the /24 and its enclosing /22), surfacing the saturated blocks worth blocklisting wholesale.
- 03Exit density by announced prefix. Rolls the exits up by the routed (ANNOUNCED_PREFIX) block and its country, tying the anonymizing infrastructure back to what the network actually announces.
- 04Exit IPs by country. Geographic roll-up of where this network's exit infrastructure is located — a single dominant country vs a spread tells you whether the exits are one operator's block or scattered tenancy.
- 05Is this IP a Tor exit relay?. Gives the definitive yes/no answer on whether the IP you entered is a known Tor exit relay, plus its fingerprint, the exit addresses it advertises, and where and when that intel was ingested.
- 06Tor relay nodes on this IP. Corroborates the verdict from the graph itself, listing each Tor relay node the IP operates as an exit for (an IP can host more than one relay fingerprint).