# SiteCheck Web Intel – Tor Exit Node Lookup

> SiteCheck Web Intel – Tor Exit Node Lookup is a paid API for AI agents from api.webintel-api.workers.dev, paid per call via x402, $0.002/call, status unknown (last checked 2026-10-24).

Checks whether a given IPv4 address is a Tor exit node and returns relay metadata (nickname, flags, country, first/last seen) from Onionoo if it is.

## Facts

- Endpoint: GET https://api.webintel-api.workers.dev/api/security/tor-exit-nodes?utm_source=zero.xyz
- Price: $0.002/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-24
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/sitecheck-web-intel-tor-exit-node-lookup-234f1f13
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_XiNBeVqlewL44rHh_BuZy

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability sitecheck-web-intel-tor-exit-node-lookup-234f1f13
```

Example prompt: Can you check whether 171.25.193.25 is a Tor exit node, and if so, give me the relay nickname, country, and when it was first and last seen?

## When to prefer this

Choose this endpoint when you need a fast, low-cost check of whether a specific IPv4 address is an active Tor exit node, with bonus relay metadata. Prefer it over generic IP reputation APIs when Tor-specific detection is the goal. Note it only covers exit nodes (~1,200 IPs), not all Tor relays or bridges, so pair with broader threat intel if full Tor relay coverage is needed.

## Known failure modes

- IP not on exit list returns a negative/not-found result (not an error)
- Invalid or non-IPv4 input returns a 400 or validation error
- Relay's non-exit IPs are not checked and will always return negative
- Onionoo data may lag actual network state by hours
- API returns 402 if payment header is missing or invalid
- Cloudflare Worker timeout if upstream sources are slow

## How this service works

Checks an IPv4 address against the Tor Project's bulk exit list (about 1,200 active exit IPs). If it is an exit, adds the relays for that address from Onionoo: nickname, flags, country, first and last seen. Only exit IPs are on the list; a relay's other IPs are not checked.

## Output

Returns whether the IPv4 address is present on the Tor Project's bulk exit list (~1,200 active IPs). If it is a Tor exit node, also returns enriched relay details from Onionoo: relay nickname, flags (e.g. Exit, Guard, Stable), country code, and first/last seen timestamps. Non-exit IPs return a negative result with no relay metadata.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "ip"
     ],
     "properties": {
      "ip": {
       "type": "string",
       "description": "IPv4 address such as 171.25.193.25 (required)"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/sitecheck-web-intel-tor-exit-node-lookup-234f1f13/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.webintel-api.workers.dev](https://www.zero.xyz/host/api.webintel-api.workers.dev/llms.txt)