What to Do If You Hit a Malicious Tor Exit Node

Tor exit nodes are the final gateway between the Tor network and the open internet, making them prime targets for malicious actors looking to intercept, alter, or snoop on unencrypted traffic. If you suspect you have connected through a compromised or malicious exit node—due to unexpected certificate warnings, altered web content, or suspicious redirects—you must act immediately. This guide outlines the essential steps to disconnect, assess potential exposure, secure your accounts, and report the compromised relay.

1. Terminate the Current Circuit Immediately

The quickest way to cut off a compromised exit node is to force the Tor Browser to build a new path through the network.

• Request a New Identity: Click the “New Identity” button (the broom icon) or press Ctrl + Shift + U (Windows/Linux) or Cmd + Shift + U (macOS). This restarts the browser, clears cookies, cache, and all active circuits.
• Request a New Tor Circuit for this Site: If you only want to switch paths for the specific website you are viewing, click the circuit icon in the URL bar and select “New Tor Circuit for this Site” (or press Ctrl + Shift + L).

2. Assess What Data Was Exposed

Exit nodes can only intercept data passing between the exit node and the destination server. Determine what was exposed based on the connection type:

• HTTPS Sites with No Warnings: If you were using end-to-end encryption (HTTPS) and received no SSL/TLS warnings, your payloads, passwords, and sensitive data remained encrypted. The exit node could only see the IP address/domain of the server you contacted.
• HTTP Sites (Unencrypted): Any plaintext traffic (searches, unencrypted credentials, downloaded files, form inputs) was completely visible to the exit node and could have been captured or modified.
• Bypassed Certificate Warnings: If you encountered an SSL/TLS error and proceeded anyway, an attacker may have performed a Man-in-the-Middle (MitM) attack or SSL stripping, potentially compromising encrypted data.

3. Secure Compromised Accounts

If you entered credentials, tokens, or personal information while connected through the suspected node:

1. Change Passwords Immediately: Use a clean, secure connection (or a new, verified Tor identity) to change passwords for any services accessed during the session.
2. Terminate Active Sessions: Log into your account settings and select “Log out of all other sessions” or revoke active authentication tokens.
3. Enable Two-Factor Authentication (2FA): Ensure hardware- or app-based 2FA is active on all critical accounts to block unauthorized logins even if credentials were leaked.

4. Report the Malicious Relay

The Tor Project actively tracks and removes malicious relays to protect the community. If you have evidence of a bad exit node (such as injected scripts, forged certificates, or traffic tampering):

• Note down the exit node’s IP address or fingerprint (available in the Tor circuit display in your browser URL bar).
• Email the details to bad-relays@lists.torproject.org or file an issue through the Tor Project’s GitLab portal, including the node’s fingerprint and a description of the malicious behavior.

5. Prevent Future Exit Node Attacks

• Keep HTTPS-Only Mode Enabled: Ensure HTTPS-Only Mode is turned on in Tor Browser settings to block unencrypted connections automatically.
• Never Bypass Certificate Errors: An SSL/TLS warning on Tor is a strong indicator of exit node tampering.
• Use Onion Services (.onion): When possible, access websites via their native .onion addresses. Onion-to-onion traffic is end-to-end encrypted within the network and does not use exit nodes at all.