What Is Tor Exit Node?

A Tor exit node is the last relay in a Tor circuit, the machine that sends a Tor user's traffic out to the open internet. To the website or service receiving it, the connection appears to come from the exit node's IP address rather than from the user, which is why exit addresses turn up so often in logs and threat feeds.

How Whisper models it

IPV4 (isTor)—OPERATES_EXIT_NODE→TOR_RELAY

An exit address carries isTor, and OPERATES_EXIT_NODE names the relay behind it by its fingerprint, the identity the Tor network itself uses.

Relays exiting from an IPOpen in Console →

MATCH (ip:IPV4 {name:"185.220.101.1"})-[:OPERATES_EXIT_NODE]->(r:TOR_RELAY) RETURN ip.isTor, r.fingerprint LIMIT 10

How Tor exits work

Tor sends traffic through three volunteer relays, each of which knows only the hop before it and the hop after. The exit relay removes the last layer of encryption and opens the connection to the destination. Relay operators choose whether to allow exit traffic and on which ports, and the Tor network publishes the list of relays and their exit policies, so exit addresses are public knowledge.

A relay is identified by its fingerprint, a hash of its identity key. The address a relay exits from can change when its operator moves hosting, and one address can carry several relays, but the fingerprint stays the same. Relays join and leave every day, so a Tor flag is only as current as the relay list behind it.

Why it matters for infrastructure analysis

Traffic from an exit node tells you the connection went through Tor and nothing about who sent it. That makes the flag useful triage context and a weak verdict on its own. Scanning, credential stuffing and fraud often arrive through Tor, and so do journalists, researchers and people avoiding censorship, which is why many organizations challenge exit traffic on login and payment pages and allow it elsewhere. For an analyst, finding that an indicator is a Tor exit usually ends the attribution trail at that hop and turns the investigation toward the behaviour rather than the address.

How it appears in the graph

WhisperGraph marks exit addresses with isTor on the IPV4 node, derived from the feeds that list them, and names the kind of egress in egressClasses. OPERATES_EXIT_NODE links the address to a TOR_RELAY node identified by the relay's fingerprint, so you can confirm an address is an exit, recover the relay behind it, and walk back from a relay to the addresses it exits from. The same address carries its reconciled verdict, which weighs the Tor listing together with every other feed that lists it.

Where this shows up

See it in a live investigation: Is this domain or IP actually dangerous?

Go hands-on with the campaign pivoting recipes.