377 Tor Exit Relays Redirected SSH to 12 Interception Servers October 1-5

Directory data shows 59 operators altered exit policies between October 1-4, reaching 7.46% of total exit capacity at peak. Scans by researcher kaba confirmed 333 relays forwarding to the same interception infrastructure; the Tor Project removed all flagged nodes by October 5 after observing the policy pattern. The change also enabled plaintext mail ports on most relays while disabling encrypted ones, shifting traffic types carried without operator consent. Evidence consists of public consensus archives and direct port scans rather than host compromise indicators. No attribution beyond the shared exit policy and host keys appears in the directory data or mailing list analysis. The pattern matches prior supply-chain style access to Linux hosts running Tor, where non-exit machines were converted to exits. Operators must now audit torrc integrity and key-based authentication to prevent replay of stolen passwords. Future monitoring will focus on sudden policy shifts in the consensus rather than individual relay uptime.