By Muhsen Sakka • October 10, 2026

On October 10, 2026, the snapshot contained 14 exit addresses matched to the cloud range list, 56 matched to hosting holder names, and 1,135 matched to neither list. These are exit address counts, not relay counts or bandwidth measurements.

Tor exit addresses matching cloud and hosting lists

Tor exit nodes matched cloud and hosting lists at different rates in this snapshot. The table groups the 1,205 exit addresses by list match.

Top hosting and cloud providers operating Tor exit addresses

The provider names below matched the source lists for these exit addresses. A match does not identify an individual relay or measure traffic volume.

Why hyperscale cloud providers restrict Tor exit addresses

Major hyperscale cloud platforms, such as Amazon Web Services (AWS), Google Cloud, and Microsoft Azure, prohibit or strictly limit Tor exit node deployment under their Acceptable Use Policies. Because exit addresses forward unencrypted outbound traffic from anonymous users, destination servers frequently log the exit node's IP address when reporting automated port scans, brute-force attempts, or web spam.

For cloud providers managing millions of IP addresses, handling automated abuse complaints and DMCA notices generated by exit addresses creates significant operational overhead. As a result, hyperscale cloud providers account for only 14 exit addresses (1.16%), with Linode hosting 13 and DigitalOcean hosting 1.

Conversely, specialized unmanaged hosting providers such as FranTech Solutions (21 addresses) and netcup GmbH (6 addresses) permit exit node operations provided operators set up dedicated SWIP/WHOIS ARIN records and handle abuse tickets promptly.

Geographical distribution of cloud and hosting exit addresses

Geographic routing analysis shows that commercial hosting exit addresses are concentrated in North America and Western Europe, where major server hosters offer cheap high-speed transit connections. This dataset does not measure geographic distribution or bandwidth.

Hosting exit addresses in North America are primarily concentrated in key connectivity hubs such as Ashburn (Virginia), Chicago, and Dallas. Operating exit addresses near major internet exchanges minimizes path latency when forwarding anonymous web traffic to international destinations.

Abuse management and reverse WHOIS attribution

To operate a Tor exit node successfully on commercial hosting infrastructure, operators must configure reverse DNS (rDNS) pointers clearly identifying the node as a Tor exit relay. Furthermore, registering custom SWIP (Sub-delegated WHOIS Information Protocol) contact records with ARIN or RIPE NCC ensures that automated network abuse reports route directly to the relay operator rather than triggering server termination by the datacenter provider.

Unmanaged hosting providers like FranTech Solutions and DataWagon offer dedicated abuse handling frameworks, allowing relay operators to manage high bandwidth volumes without risking account suspensions. European hosters like OVH SAS (8 addresses) and Leaseweb (6 addresses) require strict adherence to local telecom notice protocols.

Economic factors and unmetered bandwidth hosting

Running a high-capacity Tor exit relay requires substantial unmetered outbound network bandwidth. A single fast exit node can consume 50 to 100 Terabytes of data transfer per month. On major cloud providers like AWS or Google Cloud, outbound bandwidth charges range from $0.05 to $0.09 per Gigabyte, making a high-traffic exit node prohibitively expensive (costing several thousand dollars monthly).

In contrast, budget VPS and dedicated server hosters offer unmetered 1 Gbps or 10 Gbps connection ports for a fixed monthly fee of $10 to $50. This economic reality drives Tor exit relay operators toward specialized hosting platforms like FranTech, netcup, Contabo, and Vultr rather than hyperscale cloud platforms.

Relay flag assignments and bandwidth weights

Tor directory authorities assign specific relay flags based on node performance and exit policy definitions. To receive the Exit flag, a relay must allow outbound connections to at least two common ports (such as port 80 for HTTP and port 443 for HTTPS) and meet minimum bandwidth thresholds (at least 1.2 MB/s capacity).

Relays with high uptime and fast connections also receive the Fast and Stable flags. High-capacity exit addresses hosted in well-connected commercial datacenters carry higher consensus bandwidth weights, meaning the Tor client selection algorithm routes a higher proportion of anonymous traffic circuits through those nodes.

How we measured Tor exit node hosting infrastructure

Our method checks the listed exit addresses against published cloud IP ranges and a list of hosting holder names. A match depends on those lists and registry holder records; no match does not establish that an address is residential or independent. The measured timestamp for this release is October 10, 2026 at 06:55:44 UTC.

The system cross-references the 1,205 exit addresses in this snapshot against IP range JSON feeds published by Amazon, Google, DigitalOcean, and Linode, as well as server ASN records from European and North American hosting providers. Limits include potential white-label resellers operating VPS nodes on upstream provider bandwidth without distinct WHOIS attribution.

Detecting Tor exit addresses and next steps

Identifying whether an incoming request originates from a Tor exit relay hosted in a datacenter helps security teams distinguish automated scripts from authentic user sessions. To check if an IP address belongs to an active Tor exit relay, cloud provider, or hosting network, use our free proxy, VPN, and Tor check tool.

To inspect general network ownership, Autonomous System Numbers, and reverse DNS hostnames for any IP, use our IP lookup tool. For further insights into network privacy and proxy detection, read our practical articles on how to check if your VPN is working and proxy vs VPN features.