<html><head></head><body><div dir="auto">Hello John,<br><br>Unfortunately I don't have an answer and are not familiar with this problem. It's not exactly clear to me what is scanning what. Are the complains about traffic coming from your relay as port scanning devices around the internet on port 22? Or lots of incoming traffic scanning your port 22 because it's open?<br>Which OS do you use?<br>Are they sure the IP address is your relay only? Or do you share an IP in a cluster for example?<br><br>It seems improbable that exit relay traffic is leaking through, as that would make many guard and middle relays sensitive for abuse complaints.<br><br>I hope someone has some insights about this and you can resolve your issue.<br><br>Regards,</div><br><br><div style='font-size:10.0pt;font-family:"Tahoma","sans-serif";padding:3.0pt 0in 0in 0in'>
<hr style='border:none;border-top:solid #E1E1E1 1.0pt'>
<b>From:</b> <div dir="auto">John Crow via tor-relays <tor-relays@lists.torproject.org></div><br>
<b>Sent:</b> July 24, 2023 12:07:44 AM GMT+02:00<br>
<b>To:</b> <div dir="auto">tor-relays@lists.torproject.org</div><br>
<b>Cc:</b> <div dir="auto">admin@prsv.ch</div><br>
<b>Subject:</b> <div dir="auto">[tor-relays] Receiving abuse reports for Non-Exit Relay</div><br>
</div>
<br>
<div style="font-family: Arial, sans-serif; font-size: 14px;">Hello all, <br></div><div style="font-family: Arial, sans-serif; font-size: 14px;"><br></div><div style="font-family: Arial, sans-serif; font-size: 14px;">In the past 24 hrs, I have been receiving complaints from my hosting provider that they're receiving hundreds of abuse reports related to port scanning. I have no clue why I'm all of the sudden receiving abuse reports when this non-exit relay has been online for months without issues. In addition, I have other non-exit relays hosted by the same provider with no issues and more across other providers.<br></div><div style="font-family: Arial, sans-serif; font-size: 14px;"><br></div><div style="font-family: Arial, sans-serif; font-size: 14px;">I proceeded to reinstall the OS and reconfigure Tor. I was then quickly notified by my hosting provider again of more abuse reports all showing port 22 as target port. <br></div><div style="font-family: Arial, sans-serif; font-size: 14px;"><br></div><div style="font-family: Arial, sans-serif; font-size: 14px;">I have not changed my torrc at all and it's still setup as a non-exit relay. No other applications/services were installed alongside Tor. Tor Metrics does not show the relay as Exit either.<br></div><div style="font-family: Arial, sans-serif; font-size: 14px;"><br></div><div style="font-family: Arial, sans-serif; font-size: 14px;">It feels like Tor Exit Traffic is leaking through my non-exit relay?</div><div style="font-family: Arial, sans-serif; font-size: 14px;"><br></div><div style="font-family: Arial, sans-serif; font-size: 14px;">Has anyone else experienced any behavior similar to this? Any ideas on how to fix or prevent this?</div><div style="font-family: Arial, sans-serif; font-size: 14px;"><br></div><div style="font-family: Arial, sans-serif; font-size: 14px;">prsv admin<br></div><div dir="auto">--<br>/ Jonathan van der Steege<br><br>My GnuPG key is: c6f32128e7522f4acb878d6a4a9f0b50ace75416<br><<a href="https://keys.openpgp.org/search?q=jonathan@jonakeys.nl">https://keys.openpgp.org/search?q=jonathan@jonakeys.nl</a>></div></body></html>