Cloudflare identifies requests coming from Tor exit nodes with the continent code T1. If you do not want Tor traffic on your zone, this example custom rule blocks requests from the Tor network using the ip.src.continent field.
-
When incoming requests match:
If you are using the expression editor:
(ip.src.continent eq "T1") -
Then take action: Block
If you prefer not to block Tor traffic outright, use the Managed Challenge action instead.