Re: [tor-relays] relay got suspended

To: "tor-relays@xxxxxxxxxxxxxxxxxxxx" <tor-relays@xxxxxxxxxxxxxxxxxxxx>

Subject: Re: [tor-relays] relay got suspended

From: David Poulsen <atuaruk@xxxxxxxxxxxxxx>

Date: Sun, 25 Oct 2020 23:57:31 +0000

Cc: "tor-operator@xxxxxxxxxxxx" <tor-operator@xxxxxxxxxxxx>

Delivery-date: Mon, 26 Oct 2020 09:53:11 -0400

Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=protonmail.com; s=protonmail; t=1603670263; bh=eFWFp6XuMxuhbLajx5XwMTQDmp4btowKtViyzDGRTSM=; h=Date:To:From:Cc:Reply-To:Subject:In-Reply-To:References:From; b=wbEaoDuawjLeWif+Zh7/ZF/CqBjYY++XIRRqttLqPQPfTvXhiI17qlzL2bWrDAeHu HXaCFmIYKABxHjh7sDDlSfubxyViy/eSnZBIuYBFwn3ICGa21K6Oh9TJhl0avTu3Nw AMqRRT3SRRWIUzcTOk3C/MHbESx/f9bMEd27Ap+U=

In-reply-to: <CAHekb6G-0zKNdrSycySr=Yp7mO32yWOA_uc0dBPtMHsXsG105w@mail.gmail.com>

List-archive: <http://lists.torproject.org/pipermail/tor-relays/>

List-help: <mailto:tor-relays-request@lists.torproject.org?subject=help>

List-id: "support and questions about running Tor relays \(exit, non-exit, bridge\)" <tor-relays.lists.torproject.org>

List-post: <mailto:tor-relays@lists.torproject.org>

List-subscribe: <https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays>, <mailto:tor-relays-request@lists.torproject.org?subject=subscribe>

List-unsubscribe: <https://lists.torproject.org/cgi-bin/mailman/options/tor-relays>, <mailto:tor-relays-request@lists.torproject.org?subject=unsubscribe>

References: <CAHekb6G-0zKNdrSycySr=Yp7mO32yWOA_uc0dBPtMHsXsG105w@mail.gmail.com>

Reply-to: tor-relays@xxxxxxxxxxxxxxxxxxxx

Sender: "tor-relays" <tor-relays-bounces@xxxxxxxxxxxxxxxxxxxx>

Dear Adam & Paul,

There have been a quite unusual traffic here in Denmark too, I am situated on the island of Als running on STOFA A/S and TDC Yousee A/S networks, which are being redirecting as if the relays were under DDoS attack, by taking over the link and be a man in the middle?

Relays, bridges and exits have been not trustable and many certificates are wrong, so do a double, trible check even if you are connected to tor networks!

Regards

David

Sent with ProtonMail Secure Email.

‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐

On Sunday, October 25, 2020 8:15 PM, Paul Geurts <paulus@xxxxxxxxxxxx> wrote:

hi y'all,

one of my relays got suspended today, because of heavy ddos traffic.

Hello,

Today your VPS IP address was heavily attacked by a large DDoS, so we were forced to suspend the VPS and null the IP for the time being, since it had overloaded our upstream provider. We are keeping an eye on the situation, however in the meantime you will want to get your site behind a DDoS filter such as CloudFlare.

Let us know if you have any further questions.

Thank you!

Adam

has any of you see this behauvior? I think there is no use in putting a relay behind a ddos filter, or is there? In that case I'll just spin up another one.

relay in question is this one, almost 7 months with no interuption what so ever, no indication in the (munin) monitoring for high or higher traffic... because the vps is suspended I don't have the latest syslog so I don't know for sure whether anything has shown up there, but I am quite sure that yesterday there were no abnormal logging entries on this server.

https://metrics.torproject.org/rs.html#details/CDE4149F0DC65A7BE1AE440340BE1C7A18135E29

rgds,. Paul

Attachment: signature.asc
Description: OpenPGP digital signature

_______________________________________________ tor-relays mailing list tor-relays@xxxxxxxxxxxxxxxxxxxx https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays