How I handle malicious traffic on Hidden Services

During the alpha release of my custom WAF, I realized a few things about handling malicious traffic. When I first built it, I was too confident and directly killed Tor circuits. But if you kill a circuit, Tor can automatically rotate and switch to a new one. Back then I only relied on circuit IDs or I2P destinations. I started with manual parsing, which was quite dangerous, and eventually moved to…