I run an onion pi (a wireless router that redirects all of my traffic over tor, here's a how to)

Anyways I installed maltrail on my onion pi to see what's going on; found these exit nodes scanning my ports on my onion pi every day. Just want to warn the community.


1 Answer 1


These aren't scanning your ports, these are your connections to the Tor network. This is your Pi recording that it is connecting to them.

I think this should serve as an example of why blacklisting, especially without knowledge, is harmful.

These are your guards, that's why only 3 appear and the ports on their side are always the same. This log shows you making outbound connections to the tor network.

  • How often are the guards rotated then? The Tor daemon will rotate guards even when I'm not using the pi? Commented May 25, 2016 at 12:45

Not the answer you're looking for? Browse other questions tagged .