<html><head></head><body>By the way Jerry Gamblin checked the list against the tor exit nodes and found 191 that have been used in this hacking...<br>
There you can find his thread with the whole listing..<br>
<br>
<a href="https://twitter.com/JGamblin/status/814627227656683521">https://twitter.com/JGamblin/status/814627227656683521</a><br>
<br>
Regards <br>
0x23<br><br><div class="gmail_quote">Am 2. Januar 2017 09:39:50 MEZ schrieb tor-relays-request@lists.torproject.org:<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
<pre class="k9mail">Send tor-relays mailing list submissions to<br /> tor-relays@lists.torproject.org<br /><br />To subscribe or unsubscribe via the World Wide Web, visit<br /> <a href="https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays">https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays</a><br />or, via email, send a message with subject or body 'help' to<br /> tor-relays-request@lists.torproject.org<br /><br />You can reach the person managing the list at<br /> tor-relays-owner@lists.torproject.org<br /><br />When replying, please edit your Subject line so it is more specific<br />than "Re: Contents of tor-relays digest..."<br /><br /><br />Today's Topics:<br /><br /> 1. Re: Grizzly Steppe (Rana)<br /><br /><br /><hr /><br /><br />Message: 1<br />Date: Mon, 2 Jan 2017 10:39:40 +0200<br />From: "Rana" <ranaventures@gmail.com><br />To: <tor-relays@lists.torproject.org><br />Subject: Re: [tor-relays] Grizzly Steppe<br />Message-ID: <03ed01d264d3$c4700b40$4d5021c0$@gmail.com><br />Content-Type: text/plain; charset="utf-8"<br /><br />My bet is that the recorded IP address dates back to the days when your node<br />was an exit. Naturally the Russian hackers have used Tor, probably in tandem<br />with a VPN - it would have been stupid of them not to, and stupid they are<br />not. <br /> <br />And you are right - now the US government will blame Tor exit operators for<br />the sheer stupidity of email operators in political shops such as DNC that<br />do not force their users to encrypt email end to end. PGP is too much<br />trouble for them.<br /> <br />If I am right there is nothing you can do now, you have already closed the<br />exit. If they pressure you, migrate your relay to another IP.<br /> <br />Rana<br /> <br />From: tor-relays [mailto:tor-relays-bounces@lists.torproject.org] On Behalf<br />Of Dr Gerard Bulger<br />Sent: Monday, January 02, 2017 10:15 AM<br />To: tor-relays@lists.torproject.org<br />Subject: [tor-relays] Grizzly Steppe<br /> <br />I ran an exit node, but gave up after too many abuse reports that annoyed my<br />ISP. So I turned al exit ports off, and reports stopped as a rely. After<br />months and many terabytes of data I get an abuse complaint that my tor IP<br />has been used for espionage. <br /> <br />"NCSC have been made aware of a report and associated malicious indicators<br />released by the United States Government relating to malicious cyber<br />activity. A copy if the report and indicators can be found at the following<br />link:-<br /><a href="https://www.us-cert.gov/security-publications/GRIZZLY-STEPPE-Russian-Malicio">https://www.us-cert.gov/security-publications/GRIZZLY-STEPPE-Russian-Malicio</a><br />us-Cyber-Activity<br />Details within this report indicate network assets which may have been<br />compromised or associated with malicious activity. We have identified the<br />following IP address from this report as x.x.x.x As a minimum, it is<br />recommended that you check systems and any available logs concerned with the<br />above addresses for indications of malicious activity"<br /><br />There are no other details as to HOW my tor relay is being used. The<br />espionage seems to relay on the stupidity of recipients on receiving emails<br />asking for passwords. I am not sure HOW ISP or relay service can stop that.<br />Or is it that my relay was being used to transfer the data?<br /> <br />I assume my IP was found by way of a DNS leak which I need to look into.<br />There is nothing else I can do as a relay to stop this or is there?<br /> <br />Gerry<br /> <br /> <br /> <br />-------------- next part --------------<br />An HTML attachment was scrubbed...<br />URL: <<a href="http://lists.torproject.org/pipermail/tor-relays/attachments/20170102/5fcbf7d5/attachment.html">http://lists.torproject.org/pipermail/tor-relays/attachments/20170102/5fcbf7d5/attachment.html</a>><br /><br /><hr /><br /><br />Subject: Digest Footer<br /><br /><hr /><br />tor-relays mailing list<br />tor-relays@lists.torproject.org<br /><a href="https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays">https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-relays</a><br /><br /><br /><hr /><br /><br />End of tor-relays Digest, Vol 72, Issue 4<br />*****************************************<br /></pre></blockquote></div><br>
-- <br>
Diese Nachricht wurde von unterwegs versendet.</body></html>