Note that this page is no longer maintained! If you want to report a bad relay, have a look at this page.

Known Bad Relays

This is a summary of tor relays that have been flagged as bad, being either malicious or misconfigured. Its purpose is to use past events to make trends more evident and help aid investigations of future suspicious activity. Most bad relays are caught thanks to our wider community, so many thanks for all your help and vigilance!

In almost all cases we're unable to contact the operator to resolve the issue so if your relay's listed below then please let us know so we can fix the issue.

Bad relays fall into three categories:

• BadExit - Never use as an exit node (for nodes that appear to mess with exit traffic)
• Invalid - Never used unless AllowInvalidNodes is set (by default this only allows for middle and rendezvous usage)
• Reject - Dropped from the consensus entirely

What is a bad exit?

A bad exit is one that breaks stuff, either maliciously or through misconfiguration.

Suspected “bad exits” should be reported to tor-assistants@tpo.

The most common misconfiguration I have seen is using OpenDNS as a host's nameserver with what I think is the OpenDNS default config. Services such as OpenDNS lie to you, under the name of protecting you. The result is for instance getting redirected to their webpage when you want to visit evil sites such as https://www.torproject.org/.

One example of either misconfiguration or actual intended malicious behavior is exit nodes that do man in the middle attacks on outgoing https connections, do SSL stripping (i.e. replacing !https:// links with !http:// links), or do man in the middle attacks on other protocols like ssh.

Whenever Directory Authority operators find such nodes, or somebody points them out to an operator, they are given the BadExit label. That will cause Tor clients to avoid them for exit connections. They are still useful and will get used for other positions in a circuit.

The tor directory authority operators who vote on the 'BadExit' flag have the last say on what constitutes being a bad exit. In general we'll flag for the following...

• Tampering with exit traffic in any way. This is often accidental (for instance filtering by anti-virus).
• Only allowing plain-text traffic, for instance just allowing traffic through ports 80 and 143. This is because these relays are highly suspicious to be sniffing traffic. For the discussion on this see this thread.
• Numerous exits that collectively provide a high amount of bandwidth but are obviously related without setting the MyFamily entry.

Individual Bans

As of April 2013 this list is no longer being maintained. The authority operators have decided to coordinate via a torrc one of them considers to be 'secret' (despite that it's essentially public via the consensus). I've made numerous requests to be kept in the loop regarding bad-exiting which have been ignored so I give up on trying to keep track of this. Someone else can take over maintaining it if they have the time.

Ban Groups

trotsky

IP Addresses

Between 17-23:00 (UTC) 226 exiting relays, all with largely identical nicknames ("trotsky*") and exit policies were added to the tor network. No family or contact information was set, and the IPs came from several countries (mostly eastern European) making it look like a potential botnet. They disappeared roughly a week later.

On 10/2/10 between 21-20:00 (UTC) another 383 exit relays were added, this time more gradually. Others have periodically appeared outside these windows. These relays appear to be on residential connections, most having very poor connectivity (rransom reports that some are dialup).

network

• network51b9450 (64.191.53.37:9001)
• network17b661a (64.191.59.245:9001)

Unfortunately there isn't documentation for why these relays are bad. They all begin with the nickname "network", reportedly run Windows Server 2003, and only accept IM traffic (jabber and irc on ports 5222, 5223, and 6666-6669).

Research

• 2014-01-21 article Scientists detect “spoiled onions” trying to sabotage Tor privacy network and the actual paper Spoiled Onions: Exposing Malicious Tor Exit Relays contains the list of relays found.