to protect users you would reject serving requests originating from non-VPN/Tor IP addresses.
how can you get and keep updated a list of
- the Top/most secure VPN providers's IP addresses? (others won't be approved by/work with the service)
- Tor exit nodes IP addresses?