[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Re: [tor-talk] Analyzing the (little) spike in relays on 2015-04-01 (Family@Choopa LLC)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
> by looking at https://metrics.torproject.org/platforms.html
> https://metrics.torproject.org/versions.html I noticed a little
> spike in relays at the beginning of the month (actually I was
> visiting metrics to see if some ticket made progress ;)
>
> On 2015-04-01 someone (it was likely a single entity) signed up 20
> exits @ Choopa LLC. If you go back in time on that AS you find
> similar events. So this potential entity might run 40 exits. If you
> condense all properties and do not restrict your search to the
> Choopa AS (AS20473) the potential operator likely runs 55 exits.
>
> Fun part: Maxmind had no AS info on some IPs (4) that are also part
> of AS20473, so they got filtered out in the first result set where
> I only looked into AS20473 (40 relays), but these relays found
> there way back into the result set (55 relays) on the next
> iteration due to other similarities. So I'm pretty confident in the
> linkability of these exit relays.
>
> Details:
> https://raw.githubusercontent.com/nusenu/misc-files/master/finding_the
_hidden_choopa_family.txt
>
>
>
> Common properties: (ordered from more to less significant
> property)
>
> - *last_restarted* - first_seen (in groups) - DirPort (auto) -
> Nickname (not matching put similar naming style) - exit policy - no
> declared family - ORPort - two instances per IP - no contactInfo -
> tor version
Four days after I send this email the dirport changed on almost all
the listed relays from auto (quite unique property) to 0
(probably after the operator read this email)
also relevant for this thread
https://lists.torproject.org/pipermail/tor-talk/2015-April/037549.html
-----BEGIN PGP SIGNATURE-----
iQIcBAEBCgAGBQJVOWOyAAoJEFv7XvVCELh03dQP/RjlF02hbz7K54LA2ZUjZukH
ktOhp6ff3IDk2kw4CyEsZ5CNYzxtEirobFkFwKOwnQ695s6yFePwhQPtOY6Yi754
5oU86Q/Y0vdM37HrM2kUlNtWn3B5Mtf0fmo1NFh5HvFhW6V3fDxTSUIbVm6LD3Vr
P1HCarQmfVa76JZSJ5ovkkHJ8mUA519MP07WWZdzpsna5nq2kPw5TTd22RE8yWvM
CznH2XxIdFwNRkVLWX6N7rkSZppYAA2iy2JiaeicT2OCpF9zWLSDUyuWWE/iruuz
ySdeF78yqBVSHr5VbeA7Gl+suAaYlmOFOmjhOuKxlrmeYwVz3O0tFGzWRTbY9iL7
E2htpWz2yMIz+CMctV7vN40c8lu4p3LIU8E2YqKynbZVOVgz68oKdivFdB5ak5KU
OSW4clENKYrZjkZ7HWY0sVdWyPKjQk7PLHH+YoxCMuFyDF/vyZHkEagx5O0pFX2Q
kMIMLtBJatMRmyzpKkmuuEIm8Eh2ZgP26Ue2DZ6fgrodZO2vreHzAtQtkZWyYrok
SOA3eBTzFNxnUaQtzaKOrkX5zx1rnaca/GliozyPtVcz696CW2q2w79J7xe1QG8p
AbLqTrluNb4NhFGsvKGUcC0tDHuRH5jSsGh/UH07O3vhwb9ra+0i4/oR1t9fZNeS
UH9ebMA+n1Yo9rieA2iC
=CkU3
-----END PGP SIGNATURE-----
--
tor-talk mailing list - tor-talk@xxxxxxxxxxxxxxxxxxxx
To unsubscribe or change other settings go to
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk