How Suspicious Relays Are Flagged and Removed from Tor

The Tor network relies on thousands of volunteer-operated relays to provide online privacy, but malicious actors occasionally deploy coordinated groups of relays to compromise user anonymity or manipulate traffic. To protect the network, the Tor Project and its community utilize automated scanning, anomaly detection, community reporting, and directory authority voting to identify, flag, and permanently remove suspicious relay groups before they can harm users.

Identifying Suspicious Relays

The detection of malicious or coordinated relay clusters relies on several automated tools and manual investigations:

• Automated Scanners: Tools like exitmap and automated probing systems continuously monitor exit nodes for malicious behavior, such as SSL stripping, traffic sniffing, DNS poisoning, or injecting malicious payloads into unencrypted HTTP traffic.
• Sybil Detection Tools: Software such as sybil-hunter analyzes relay metadata, uptime patterns, software versions, and network locations to detect large batches of relays brought online simultaneously by a single entity attempting a Sybil attack.
• Network Anomaly Monitoring: The Network Health team and community members monitor metrics for unusual spikes in network capacity, suspicious clustering of relays within specific Autonomous System Numbers (ASNs) or IP subnets, and misconfigured MyFamily declarations.
• Community Reports: Security researchers and Tor users frequently report anomalous behaviors, suspicious relay configurations, or malicious exit nodes directly to the Tor Project’s Network Health team.

The Flagging Process

Once suspicious activity is detected, relays are mitigated through Tor’s consensus mechanism, which is managed by a small group of trusted servers called Directory Authorities (DirAuths).

Directory Authorities vote hourly to generate the network consensus document that tells Tor clients which relays are safe to use. When a relay is deemed suspicious:

1. BadExit Flag Assignment: If an exit relay is manipulating traffic, DirAuths vote to assign it the BadExit flag. The relay remains part of the network for routing intermediate traffic (as a middle relay) but clients are prevented from using it as an exit point.
2. BadDirectory / De-flagging: If a relay attempts to manipulate directory information, authorities can strip its directory flags.
3. Revoking Valid and Running Flags: For severe threats, such as suspected deanonymization or correlation attacks, DirAuths withhold the Valid and Running flags, rendering the relay entirely invisible and unusable to all Tor clients.

Permanent Removal and Blocking

If an operator violates the Tor Relay Operator Expectations or engages in sustained malicious behavior, DirAuth operators take permanent actions:

• Fingerprint Blacklisting: The cryptographic fingerprints of the malicious relays are added to exclusion lists (AuthDirReject configuration) on the Directory Authorities, permanently denying them entry into the network consensus.
• IP and Subnet Banning: When attackers deploy rotating keys across the same network infrastructure, authorities implement IP address or entire CIDR block rejections to prevent new relays from registering from those hosting providers.

Through this multi-layered process of proactive scanning, community oversight, and consensus-driven moderation, the Tor network isolates and neutralizes malicious relay clusters to preserve user privacy and routing integrity.