[tor-talk] Tor users from Finland jumped from 25 000 to 200 000

[Markus Ottela]

Hi,

Yikes, I wonder if this is my fault.

I've been experiencing weird behavior with Tor + Stem + Flask Onion 
Services dying randomly once every 1..5 days. I wrote a script that's 
making connections to a test an Onion Service to see when exactly the 
servers disappear -- and creating logs based on that. The system spins 
up new requests client instance for each connection, so those might be 
what's appearing on the graph. I'm just puzzled why they'd appear as 
different users, given that the public IP has remained static. (Also the 
script automatically spins up new Onion Service once it's been down for 
an hour, so that could explain the spikes.)

Again I'm not sure that's what this is about, but both the start time, 
and the most recent major downtime spikes match. I've killed testing, 
let's see if it returns to normal; I think there's enough data to open a 
ticket about my issue anyway.

So again, apologies if this is my fault.

Markus


On 11.1.2022 20.06, Juha Nurmi wrote:
> Hello,
>
> There have been around 25 000 Tor users from Finland. The number of users
> is very stable. Except right now I see a spike of 200 000 Tor users
> connected from Finland. Number of users starts to increase on Tuesday
> 2021-12-21.
>
> https://metrics.torproject.org/userstats-relay-country.html?start=2021-10-13&end=2022-01-11&country=fi&events=off
>
> In addition, there is a spike in non-direct bridge users from Finland as
> well.
>
> https://metrics.torproject.org/userstats-bridge-country.html?start=2021-10-13&end=2022-01-11&country=fi
>
> All this is happening only in Finland and we can easily see that from other
> countries nearby, like Denmark, Norway and Sweden, the number of connected
> users is flat stable. For instance, see numbers from Sweden:
>
> https://metrics.torproject.org/userstats-relay-country.html?start=2021-10-13&end=2022-01-11&country=se&events=off
>
> Someone could speculate that this is some kind of test carried out from
> Finnish IP range or a bot network infecting only Finnish machines like
> poorly configured home routers and installing malware communicating through
> Tor. Furthermore, there was known Tor censorship in Russia in December, see
> https://blog.torproject.org/tor-censorship-in-russia/.
>
> The fact we know is the increasing number of Tor users from Finland. Do we
> actually know something concrete behind this?
>
> Regards,
> Juha