From what I've seen Tor is a very useful tool for good, however, many exit node IPs seem to have tons of automated reports for SSH abuse or scanning on AbuseIPDB. Is there a reason that Tor keeps port 22 open on exit nodes unlike ports for mail servers?
1 Answer
When I look at my servers I see lots of scanning on port 22. Most of them are not via Tor exits, but using other machines. So I think it doesn't make much difference if Tor would disable that by default.
In the case of port 22 it is in the hands of the administrator to take care of appropriate means. If the port scanning bothers you one good idea is to change the SSH port. Usually the scanning stops or is drastically reduced. Furthermore one could check if the SSH daemon is operated in a secure manner.