The Ebury botnet that's been around for a decade now is likely spying on Tor exit ssh tunnels looking for other criminals logging into their h4xxr jump boxes, ransomware deployments they can intercept and exploit themselves, financial crime market operators, crypto drug dealers etc.

- Default route is over tor and you didn't make an exception for ssh.

- Hide where you are in the world from your employer, who owns the server. (On vacation?)

- You're hacking the server.

Remote admin some shady server you control and do not want LE seeing a direct inbound ssh from you in Upper Sandusky, Ohio.

> Why would you want to access hosts via ssh over TOR?

When you're behind a restrictive firewall which blocks anything other than HTTP/HTTPS (like at an Internet café), or when there's some upstream routing issue making reaching the server directly impossible from your location (these can be a pain to diagnose).

Or perhaps it's simply your default: you proxy everything through Tor, and need a reason to not go through it.

TOR provides anonymity at the network level, SSH does not.

No public IP. you can use an onion service instead

How does this use case differ?

People ssh over Tor for the same reason they use Tor for any network activity: To make confidential 1) your identity to the remote host and 2) your activities to your network providers (including your ISP/workplace/etc.).

If you want only confidential content, ssh is sufficient and so is https for web browsing. If you want the other things, you must use Tor or maybe something similar.

If the SSH host is a backdoor you installed in a company you hacked, you don't want the FBI tracing it back to you.