@georgengelmann There is an attacker spoofing TCP packets with the source IP to pretend to mass-connect to ssh honeypots - meaning that Tor relays are getting TCP RST packets and abuse reports.

Such attack shouldn't be possible, but BCP38 has seen little implementation.

It's best to reply to such abuse reports noting that such was an IP spoofing attack and none of such connections came from your server.

https://forum.torproject.org/t/tor-relays-tor-relays-source-ips-spoofed-to-mass-scan-port-22/15498 (too bad you cannot view the issue comments without running proprietary gitlab JavaScript).