So far 2020 is probably the worst year in terms of malicious Tor exit relay activity since I started monitoring it about 5 years ago. It demonstrates once more that current checks are insufficient to prevent such large scale attacks. In this post I want to give you an update on the malicious Tor relay situation for the first seven months of 2020 by looking at a single large scale malicious actor that is of ongoing concern. https) by the user decides whether a malicious exit relay can actually see and manipulate the transferred content or not. Tor exit relays are the last hop in the chain of 3 relays and the only type of relay that gets to see the connection to the actual destination chosen by the Tor Browser user.

Unfortunately instead of improving, things have become even worse, specifically when it comes to malicious Tor exit relay activity. In December 2019 I wrote about The Growing Problem of Malicious Relays on the Tor Network with the motivation to rise awareness and to improve the situation over time. Figure 1: Confirmed malicious Tor exit capacity (measured in % of the entire available Tor exit capacity) over time (by this particular malicious entity).

Mit tor relays