# Pool.ntp.org traffic redirected to Tor Exit Node

**URL:** <https://community.ntppool.org/t/pool-ntp-org-traffic-redirected-to-tor-exit-node/2189>\
**Category:** Pool Development\
**Tags:** dns\
**Created:** [October 8, 2021, 5:26pm UTC](https://community.ntppool.org/t/pool-ntp-org-traffic-redirected-to-tor-exit-node/2189 "2021-10-08T17:26:14Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![RemiP](https://avatars.discourse-cdn.com/v4/letter/r/ebca7d/32.png) [@RemiP](https://community.ntppool.org/u/RemiP)\
**Post date:** [October 8, 2021, 5:26pm UTC](https://community.ntppool.org/t/pool-ntp-org-traffic-redirected-to-tor-exit-node/2189/1 "2021-10-08T17:26:14Z")

</div>

Hello,

The following IP address (37.228.129.2) is sometime returned while sending a DNS query for the following subdomains :

```auto
0.amazon.pool.ntp.org
0.ubuntu.pool.ntp.org
0.pool.ntp.org
pool.ntp.org
2.ubuntu.pool.ntp.org

3.debian.pool.ntp.org

```

This is still applicable today.

That IP address appears to be a Tor Exit Node since 14 days

 ![ntppool-torexitnode](https://us1.discourse-cdn.com/flex016/uploads/ntppool/original/1X/677c9dc38f2dc87366337b19c515416744fadc53.png)

Additionnaly, the IP does not seems to respond to ntp requests (ntpq -crv timed out).

Could you verify if this entry is obsolete ?

Regards,

---

<div class="post-metadata">

**Author:** ![marco.davids](https://sea2.discourse-cdn.com/flex016/user_avatar/community.ntppool.org/marco.davids/32/767_2.png) [@marco.davids](https://community.ntppool.org/u/marco.davids)\
**Post date:** [October 8, 2021, 5:40pm UTC](https://community.ntppool.org/t/pool-ntp-org-traffic-redirected-to-tor-exit-node/2189/2 "2021-10-08T17:40:43Z")

</div>

Hi RemiP and welcome!

> [@RemiP](#):
>
> Additionnaly, the IP does not seems to respond to ntp requests

It does respond from here at the moment. The mode 6 control command you issued (`rv`, or `readvar`) is not supposed to work for safety reasons.

Here’s the monitoring page:

[https://www.ntppool.org/scores/37.228.129.2](https://www.ntppool.org/scores/37.228.129.2)

---

<div class="post-metadata">

**Author:** ![RemiP](https://avatars.discourse-cdn.com/v4/letter/r/ebca7d/32.png) [@RemiP](https://community.ntppool.org/u/RemiP)\
**Post date:** [October 8, 2021, 5:57pm UTC](https://community.ntppool.org/t/pool-ntp-org-traffic-redirected-to-tor-exit-node/2189/3 "2021-10-08T17:57:45Z")

</div>

Thanks for the quick reply.  
Correct, it is restricted for mode 6, otherwise it is responding.  
Is it a violation of your use policy to share a NTP service on the same host than a Tor exit node ?

---

<div class="post-metadata">

**Author:** ![marco.davids](https://sea2.discourse-cdn.com/flex016/user_avatar/community.ntppool.org/marco.davids/32/767_2.png) [@marco.davids](https://community.ntppool.org/u/marco.davids)\
**Post date:** [October 8, 2021, 6:11pm UTC](https://community.ntppool.org/t/pool-ntp-org-traffic-redirected-to-tor-exit-node/2189/4 "2021-10-08T18:11:56Z")

</div>

> [@RemiP](#):
>
> Is it a violation of your use policy to share a NTP service on the same host than a Tor exit node ?

I don’t think it is, but I am not an admin, so not 100% sure.

It has lead to some complaints and [some discussion](https://community.ntppool.org/t/ntf-received-a-complaint-about-tor-servers-in-the-ntp-pool/1557) on this forum in the past though.