[bruceallmighty]

Try running some of the IPs through a proxy detection API like https://ipinfo.io/products/proxy-vpn-detection-api or https://proxycheck.io/

You can't trust those services 100% but you can use them to turn up the level of turnstile/captcha/verification on those clients.

I'm somewhat concerned that you don't know what you'd be looking for (or to verify Tor) if you're running an ecommerce platform, fraud is an almost certain outcome for any store and merchant providers (Paypal, Stripe, Adyen, etc) want zero to do with helping you solve that (even if you're only embedding their Javascript!)

[reincoder]

I work for IPinfo. If the OP sends me a list of problematic IP addresses, we would be happy to look into them and send back the parent IP ranges. This way, they can block them on the firewall or through a simple IP-based blocklist.