At my company we soft-ban IPs for malicious activity for 12 hours, if there's definite proof of known exploits being used. As a result tor is de-facto banned,

At my company we soft-ban IPs for malicious activity for 12 hours, if there's definite proof of known exploits being used. As a result tor is de-facto banned, as well. But we don't target tor specifically, we just handle it as any other activity.