Most Tor exit nodes these days seem to be hosted on Cloudflare's datacenters, and/or I believe Cloudflare also keeps track of exit nodes and has some kind of special routing for them in order to give their users the option to block them - either way, they nearly always show up like this on Kokonotsuba's mod panel:
2405:8100:8000:5ca1::8f:5c6e
2405:8100:8000:5ca1::7e:d0d7
2405:8100:8000:5ca1::75:c9ac
2405:8100:8000:5ca1::76:5fb7
etc.

This means:
1. they stick out liek a sore thumb against all the usual IPv4 addresses of regular/VPN users
2. if we range ban 2405:8100:8000:5ca1 (which we temporarily do whenever it's being abused), it blocks the majority of Tor users