Tor Analysis

The Tor analysis checker matches the client IP against the compiled Tor relay directory. Tor exit nodes are the most significant signal: they are the point at which anonymized traffic re-enters the public internet, and they are widely used by bots to avoid IP-based blocking. Guard and relay nodes carry lower risk but still indicate deliberate anonymization.

This checker runs in the cheap phase using the pre-loaded tor.mmdb database built from the Onionoo dataset.

How It Works

The checker looks up the client IP in tor.mmdb. When a match is found, it reads the relay record and evaluates several properties:

Running node: any active Tor relay applies runningNode as a base penalty.

Exit node: relays flagged as exit nodes apply an additional exitNode penalty. Exit nodes are the primary source of anonymized bot traffic because they are the visible egress point for Tor circuits.

Web exit capable: exit nodes with a policy that allows connections to ports 80 and 443 apply webExitCapable. An exit node that can reach web ports is more dangerous than one restricted to other protocols.

Guard node: relays flagged as guard nodes apply guardNode. Guard nodes are entry points to the Tor network and carry lower risk than exits.

Bad exit: relays flagged BadExit by the Tor directory authority apply badExit. These are nodes the Tor Project has marked as behaving maliciously or incorrectly.

Obsolete version: relays running an outdated Tor software version apply obsoleteVersion. Outdated relays may indicate misconfiguration or compromised infrastructure.

Configuration

await defineConfiguration({
  store: { main: { driver: 'sqlite', name: './bot-detector.db' } },
  checkers: {
    enableTorAnalysis: {
      enable: true,
      penalties: {
        runningNode: 15,
        exitNode: 20,
        webExitCapable: 15,
        guardNode: 10,
        badExit: 40,
        obsoleteVersion: 10,
      },
    },
  },
})

All weights live inside the penalties: {} sub-object.

Reason Codes