I host a small collection of TOR exit nodes to the clear net. Believe it or not, the number one complaint I get in my inbox is not due to illegal materials coming through the nodes (of which I have not ever been notified), but due to DDOS & botnet traffic. I get these emails multiple times a week. I'm sympathetic to these services, although I'm not willing to take down my exit nodes due to these complaints, I do wish to minimize this sort of traffic.
I'm a believer in the values that the community around tor upholds. However, I also believe that we as exit node maintainers have an obligation to maintain legitimate traffic, while actively reducing malicious traffic.
So far, I've done a few things. My first is to restrict all traffic allowed through my exit nodes to DNS, HTTP, and HTTPS ports. Although this does not directly impact malicious traffic, doing this allows me to serve much more legitimate traffic.
The second thing is to observe the traffic coming through my node. If I suddenly start to see large amounts of traffic to a site that doesn't normally see this traffic, I add a small delay in the delivery of such traffic (500ms-2s). This does not have a measurable effect, as far as I'm aware.
So I'm here, and my question is as such: As a TOR exit node maintainer, what can I do to reduce the amount of malicious traffic which comes through my nodes? Specifically in regards to DDOS & Botnet traffic, as this seems the most realistically reducible.
