Exit node: https://atlas.torproject.org/#details/463DC28452F676B7A6597A... https://fraudguard.io/?ip=5.196.143.10

Non-exit node: https://atlas.torproject.org/#details/EF4BD6E8E5817690B79C67... https://fraudguard.io/?ip=108.61.199.202

It does not seem to make a distinction between exit and relay nodes, they are both deemed "tor_tracker".

A number of large vendors like Barracuda and Tipping Point do this. A friend of mine one time found that they were unable to log in to pay their TV bill a few days after setting up a relay node. After he made enough noise about this, their engineers investigated, and sure enough, Tipping Point flags a relay node as suspicious for no good reason, and the IPS was blocking his traffic.

On a side note, companies really don't like to deal with people who can't access their site. Being told over and over "It's your ISP", even when on a conference call with said ISP (and nevermind how difficult it was to get that set up with someone who understands the problem) was infuriating.

Not sure, but I've been put on an IP banlist for simply operating a non-exit relay in the past. Had to switch my home IP. The myth that is perpetuated that if you run a non-exit relay that you'll have no problems with IP bans is definitely wrong.

It's my fault. I'll try to find a way to get this data and eventually adjust my code to not include non-exit relays or at least recategorize them as a lower severity.

Not your fault - not talking about your service specifically! My IP was banned by several other companies (I assume from a list that was purchased from a third party) like Hulu/Netflix because I was simply relaying non-exit traffic.

TOR and people who speak for the service often say that it's safe to run a non-exit relay. It isn't. It's tracked and punished. I know from first-hand experience.

I've been running Tor relays from home for about a year. Only sites I've found to block me are Monoprice and Apple's support forums. Hulu and Netflix are fine.

Does Tor use it's own port? If so, how hard would it be to switch it to use something like 80, 23, or even 8080?

The IP of a Tor relay is publicly distributed, that's how other nodes know to connect to it.

You can see for yourself: https://atlas.torproject.org

Although at a guess, most of these services probably do the simplest thing possible and go by an open port.

Why would they increase the threat profile of an IP in any way at all? An exit node, sure, but a relay? What possible threat could a relay pose?

Agreed it was a mistake on my part, I'll fix it up shortly to include only exit nodes.

Thanks, I really appreciate it.

Due to a similar IP reputation service, I couldn't pay my taxes from home this year, just because I had run a non-exit Tor relay recently. It's a big problem.

ETA: I'd also strongly recommend not marking an IP address specially in any way just for having a non-exit relay -- from what I've seen, the clients of IP reputation vendors also don't understand the distinction, so they block both kinds if told about both kinds. It's an attractive nuisance.

Doesn't really matter - it happens. I'm not specifically talking about the OP's service but rather another third party list that was purchased by other companies. My IP was banned. Whether it should have been or not is up for debate, but I can tell you I was confused for a week straight when I was getting cryptic Hulu/Netflix/Bank/etc error messages.

i worked in fraud analytics and the consensus was that fraudulent activity weighted higher from certain networks than from others. i wasn't in the position to question the decision regarding threats where i was, i just implemented the risk level rating in software.