How Tor Verifies Malicious Exit Relays

Maintaining trust and security within the Tor network is critical to safeguarding user privacy. When users or automated systems detect potentially harmful activities from Tor exit nodes—such as traffic manipulation, SSL stripping, or cryptocurrency address hijacking—the Tor Project relies on a structured investigation protocol. This article outlines how the Tor Network Health team receives reports, reproduces malicious behavior through automated scanning and manual analysis, and mitigates threats by flagging or removing bad relays from the network consensus.

Investigations generally begin through two primary channels: community reports submitted directly to the Network Health team and automated network monitoring. To proactively detect malicious actors, the Tor Project and independent security researchers deploy automated scanning frameworks, such as Exitmap. These scanners route synthetic traffic through every active exit node to test for common tampering techniques, including DNS poisoning, invalid TLS certificate injection, and modifications to unencrypted HTTP traffic.

Once a specific exit relay is flagged or reported, the Network Health team works to manually reproduce and verify the behavior in an isolated testing environment. The team crafts targeted probes to observe how the relay handles data compared to known clean exits. This step is necessary to distinguish between deliberate malicious manipulation by the relay operator and benign issues, such as unintentional relay misconfigurations or aggressive traffic filtering imposed by an upstream Internet Service Provider (ISP).

If malicious activity is confirmed, the Tor Project takes immediate action through the Directory Authorities—the trusted servers responsible for publishing the Tor network’s consensus document. The authorities apply the BadExit flag to the offending relay’s fingerprint. This flag allows the node to continue functioning as a middle or guard relay to support overall network bandwidth, while preventing Tor clients from ever selecting it as an exit point. In extreme cases involving coordinated malicious relay networks, the Directory Authorities reject the relay fingerprints entirely, blocking them from the network altogether.