IPTor0x is a Python script that analyzes a list of IP addresses and determines which ones are TOR exit nodes. The results are displayed in the terminal and saved in an HTML report with a professional design.
- Checks if an IP is a TOR exit node by querying the official TOR exit list.
- Input file is configurable via
-i/--input(defaults toIPs.txt). - Validates every entry in the input file and skips invalid or duplicate lines instead of crashing.
- Aborts with a clear error (no misleading report) if the TOR exit list can't be downloaded.
- Generates HTML and CSV reports with categorized results, including a live search filter per table and a responsive layout.
- Lists ignored invalid/malformed entries in their own report section for auditability.
- Optional run log (timestamps, warnings, errors) via the
--logflag. - HTML and CSV reports are generated by default; skip both with
--no-report. - Displays results in a terminal output.
No external dependencies needed — the script only uses Python's standard library (Python 3.6+).
IPs.txt already ships in this repo with example IPs — replace its content with the IPs you want to check, or point to another file with -i.
Run with the default IPs.txt:
python IPTor0x.pyCheck a different file instead of IPs.txt (e.g. one list per incident):
python IPTor0x.py -i incident_42.txtKeep an audit trail of the run (timestamps, warnings, errors) in iptor0x.log:
python IPTor0x.py --logOnly care about the terminal output, skip writing report files:
python IPTor0x.py --no-reportCheck a custom file, log the run, but don't generate report files:
python IPTor0x.py -i incident_42.txt --log --no-report| Flag | Default | Description |
|---|---|---|
-i FILE, --input FILE |
IPs.txt |
File with the list of IPs to check (one per line). |
--log |
off | Also write a detailed, timestamped run log to iptor0x.log. |
--no-report |
off | Skip generating report_IPTor0x.html and report_IPTor0x.csv; only print results to the terminal. |
-h, --help |
— | Show the full list of options and exit. |
The script generates a tor_report.html file containing the analysis results.
The script downloads the TOR exit node list from check.torproject.org. Many corporate web filters and proxies (Zscaler, Palo Alto, Forcepoint, Bluecoat, etc.) categorize torproject.org under "Anonymizers / Proxy Avoidance", which is commonly blocked or flagged by SOC monitoring — even though the intent here is defensive (checking whether known IPs are TOR exit nodes). If the script fails to run in a corporate environment, this is the most likely cause. It's advisable to request a proxy allowlist exception for this domain, or coordinate with your security team before running it.
If you want to improve the script or add new features, feel free to contribute! Fork the repository and submit a pull request.
Developed by corvus0x.
This project is licensed under the MIT License. You are free to use and modify it as needed.