Explore OpenCTI or OpenAEV platform with 30 days Free Trial!
XTM Hub by Filigran
Sign Up

Dan.me.uk (EXIT Nodes only)

Infrastructure & Attack Surface Visibility
Detection & Response Enablement

Overview

Ingest IPs: The IP list provided by dan.me.uk contains addresses known to be used by TOR nodes. This list contains only IPs linked to EXIT nodes of the TOR infrastructure.

The “EXIT” IP list provided by dan.me.uk includes all active EXIT nodes participating in the TOR (The Onion Router) network.

All IPs on the EXIT list will connect directly to public-facing services, they are all essential to the functioning of TOR. Entry and relay nodes, responsible for securely passing traffic within the TOR network but do not make outbound connections to the internet, are excluded from this specific list.

This list is updated frequently and can be used in network firewalls, monitoring systems, or analytics platforms to flag or manage TOR-related activity comprehensively.

There should be a 30-minute gap between each call.

Basic information

Filigran
Jean-Philippe Salles
CSV Feeds
Threat Intelligence Feed
Free
August 18, 2026
100+
70+

    We use cookies to run XTM Hub. Necessary cookies are always on, optional cookies (functionality, analytics, marketing) are used with your consent. Accept all, reject all, or manage your choices anytime in "Cookie settings".