February 2026 - tor-relays - lists.torproject.org

handle malicous IPv6 systems abusing the /64 hostmask
by Toralf Förster 15 Feb '26

15 Feb '26

I extended my DDoS solution [1] by blocking systems where malicous connections attempts where observed from up to 256 IPv6 addresses of the same /64 block within 24 hours from hosters providing /64 hostmasks. For now it is rather a quirk than a generic solution. But it works well. And it extends the solution to accept now manual block requests like ipset add tor-ddos6-5443 <IPv6 address> -exist [1] https://github.com/toralf/torutils?tab=readme-ov-file#details -- Toralf

2 2

Tor Node infected with ransomware
by skankhunt42 14 Feb '26

14 Feb '26

Hello there, today I woke up to an execution error of the relayor playbook. I then tried to look into the affected node (tor-nl1.skankhunt42.pw; nickname skankhunt42nl1) and couldn't SSH into it. So I went to the hosters VNC console and found a ransomware notice: Your files are encrypted, requires payment for decrypting Contact us: Telegram: @cloudcone_raidbot UUID: bfaa20d9-7b11-417d-a702-cfa95d6c203c I then tried to boot into recovery and look at the disk but as expected, partition table and ext4 superblocks were gone. hexdump head of the disk was just the ransomware note shown above. I was running Ubuntu 24.04 Minimal with ESM enabled and unattended-upgrades, everything else managed by relayor. I obviously checked the other nodes for unsual SSH logins (as they had the same SSH key) and didn't found anything. I am rotating the keys for now and shut down the VPS at HostSlick. Not sure if there is something to further investigate maybe. What's odd is that I couldn't find anything about "cloudcone_raidbot", doesn't even exist on telegram. I really want to understand what I did wrong. Maybe someone with more experience may take a look at it? Best, skankhunt42

4 4

Issues with My Tor Relay
by stay.hydrated834＠passmail.net 13 Feb '26

13 Feb '26

Hello there, For the past week I’ve been running a Tor relay using the Tor‑Relay plugin on my OpenSense. While the relay appears to be functioning, I’ve noticed a few irregularities: 1. Selective blocking: Some IP addresses that connect to me are being denied by default, whereas others with similar characteristics connect without any issue. 2. Low bandwidth usage: The relay isn’t consuming much bandwidth. I’m not sure whether this is normal while the relay is still learning its capacity or if something else is limiting traffic. 3. No connections on port 9030: So far, I haven’t seen any inbound connections to the directory port (9030). For testing, the following IP is reachable via ICMP ;) - 109.199.164.117 – Port 9001 (OR) / DIR 9030 Could you advise on why these behaviors are occurring and whether any configuration changes are needed? Thanks for your help, and stay hydrated!

3 2

Call for more Snowflake proxies!
by gus 07 Feb '26

07 Feb '26

Dear relay operators, The Snowflake network is currently overloaded and we need more Snowflake proxies. If you have spare bandwidth or available servers, please consider running Snowflake proxies. As online censorship continues to increase around the world -- particularly with the recent Internet restrictions in Iran[1] --, we are seeing a significant increase on snowflake usage. We urgently need more Snowflake proxies to help handle this surge and ensure that users can continue to access the open Internet. Please share this call with your friends, communities, hackerspaces and anyone who may be able to help! Gus ### How to help There are multiple ways to run snowflake proxies: - Option 1: Run a browser-based proxy. Click the link below, switch it ON and leave the tab open: https://embed-snowflake.torproject.org/ - Option 2: Install Snowflake browser extension: https://snowflake.torproject.org/#addonBtns - Option 3: Run Snowflake standalone proxy (recommended for relay operators): https://community.torproject.org/relay/setup/snowflake/ - Option 4: Install Orbot (iOS/Android) and enable Kindness mode. https://orbot.app/ ### FAQ for relay operators Q: I'm operating a Tor relay, can I run a Snowflake proxy on the same IP? A: It might not be helpful for censored users as Tor relays are frequently blocked on censored regions. Q: I'm operating a Tor bridge, can I run a Snowflake proxy on the same IP? A: It might expose your bridge IP address and censors might take this opportunity to block your bridge. Q: Can I run Snowflake proxy for a short period? A: Yes. Proxies can run for any amount of time. Even short periods help increase available capacity. Q: Do I need to share my Snowflake proxy manually? A: No. Your proxy is automatically distributed by the Snowflake broker. After setup, no further action is required. Q: Where can I see Snowflake proxy statistics? A: Snowflake proxy statistics are available from Tor Collector. You can download the data here: https://collector.torproject.org/recent/snowflakes/ [1] Censorship analysis in Iran: https://gitlab.torproject.org/tpo/anti-censorship/censorship-analysis/-/iss… -- The Tor Project Community Team Lead

2 2

Hetzner Netscan False Positives
by tor_appliedprivacy.net 06 Feb '26

06 Feb '26

Hi, we just wanted to let you know that we got a Hetzner network contact yesterday here at 39C3 to try to get this issue solved at the root. We can not promise anything at this point but we will likely update this thread in a few weeks (January) about the status with Hetzner on this topic. best regards, tor(a)appliedprivacy.net

6 9

Re: Question about Snowflake proxy on non-exit tor relay
by gus 06 Feb '26

06 Feb '26

Hi, Yes, it applies to all relays, independent of their flags (exit, guard, middle.). Thank you! Gus On Fri, Feb 06, 2026 at 10:58:43AM +0100, Tor-relay wrote: > Hi, > > I have a question regarding the following FAQ entry: > > “Q: I'm operating a Tor relay, can I run a Snowflake proxy on the same IP? > A: It might not be helpful for censored users as Tor relays are frequently > blocked in censored regions.” > > Does this limitation also apply to non-exit relays, or is it mainly a > concern for exit relays? > > Thanks in advance. > > > On Thu, Feb 5, 2026, 17:34 gus via tor-relays < > tor-relays(a)lists.torproject.org> wrote: > > > Dear relay operators, > > > > The Snowflake network is currently overloaded and we need more Snowflake > > proxies. > > > > If you have spare bandwidth or available servers, please consider > > running Snowflake proxies. > > > > As online censorship continues to increase around the world -- > > particularly with the recent Internet restrictions in Iran[1] --, we are > > seeing a significant increase on snowflake usage. We urgently need more > > Snowflake proxies to help handle this surge and ensure that users can > > continue to access the open Internet. > > > > Please share this call with your friends, communities, hackerspaces and > > anyone who may be able to help! > > > > Gus > > > > ### How to help > > > > There are multiple ways to run snowflake proxies: > > > > - Option 1: Run a browser-based proxy. Click the link below, switch it > > ON and leave the tab open: https://embed-snowflake.torproject.org/ > > > > - Option 2: Install Snowflake browser extension: > > https://snowflake.torproject.org/#addonBtns > > > > - Option 3: Run Snowflake standalone proxy (recommended for relay > > operators): > > https://community.torproject.org/relay/setup/snowflake/ > > > > - Option 4: Install Orbot (iOS/Android) and enable Kindness mode. > > https://orbot.app/ > > > > ### FAQ for relay operators > > > > Q: I'm operating a Tor relay, can I run a Snowflake proxy on the same IP? > > A: It might not be helpful for censored users as Tor relays are > > frequently blocked on censored regions. > > > > Q: I'm operating a Tor bridge, can I run a Snowflake proxy on the same IP? > > A: It might expose your bridge IP address and censors might take this > > opportunity to block your bridge. > > > > Q: Can I run Snowflake proxy for a short period? > > A: Yes. Proxies can run for any amount of time. Even short periods help > > increase available capacity. > > > > Q: Do I need to share my Snowflake proxy manually? > > A: No. Your proxy is automatically distributed by the Snowflake broker. > > After setup, no further action is required. > > > > Q: Where can I see Snowflake proxy statistics? > > A: Snowflake proxy statistics are available from Tor Collector. You can > > download the data here: > > https://collector.torproject.org/recent/snowflakes/ > > > > [1] Censorship analysis in Iran: > > https://gitlab.torproject.org/tpo/anti-censorship/censorship-analysis/-/iss… > > -- > > The Tor Project > > Community Team Lead > > _______________________________________________ > > tor-relays mailing list -- tor-relays(a)lists.torproject.org > > To unsubscribe send an email to tor-relays-leave(a)lists.torproject.org > > -- The Tor Project Community Team Lead

1 0

Tor Relay Operator Meetup at FOSDEM 2026
by Alexander Hansen Færøy 05 Feb '26

05 Feb '26

Hello Tor Relay Operators, We will not only have a booth at FOSDEM this year, but we will also have a Relay Operator Meetup. The event will take place as a BOF on the Sunday (2026-02-01) at 13:00 to 14:00 in room H.3244. I'll do a little intro when we arrive, but I'll make sure we have enough time for a long Q&A session. Remember, this is an excellent opportunity to show up, ask questions, perhaps answer some questions, and say hi to some of your fellow Tor operators. For more information, please check out: https://fosdem.org/2026/schedule/event/DRMMAB-tor_relay_operator_meetup/ See you there! Cheers, Alex -- Alexander Hansen Færøy

2 4

appliedprivacy.net relays moved to the happy family setup
by tor_appliedprivacy.net 03 Feb '26

03 Feb '26

Today we enabled the happy family setup across all our relays. Since all our relays run in a single /24 we also removed MyFamily at the same time. This should help reduce the overhead introduced by MyFamily.

2 1

Re: Tor Node infected with ransomware
by skankhunt42 03 Feb '26

03 Feb '26

Hi, Thank you for the replies. At the time of writing I was in total panic mode and rotated all my keys. Only after that I saw all these posts from users across different hosters facing the same issue. It was a good practice to just re-evaluate my OPSEC, though. I opened a support ticket with my hoster (HostSlick) and got a reply about 12 hours later. I didn't want to re-deploy until they gave confirmation they are clean again. Luckily, with the awesome relayor playbook I recovered the relay, I just lost the Guard flags, but I think thats fine for now, they'll come back :) However, I decided to turn my back on that hoster and cancelled my VPS, will be up for a few more months. We already had a few disagreements when the problem with spoofed IP abuse reports arose last year. My relay was suspended (without any notice) at the time for multiple days and it took some time to explain to the hoster that the packets did not came from me. PS: Thanks Marco, I will look into a centralized solution for collecting logs, just to make any future incidents easier to understand. Best, skankhunt42

1 0

upcoming CIISS update
by nusenu 01 Feb '26

01 Feb '26

Hi, I'm working on a new contactinfo information sharing specification version. Current version (2): https://nusenu.github.io/ContactInfo-Information-Sharing-Specification/ Some likely changes will be: * add happy family proof https://gitlab.torproject.org/tpo/core/torspec/-/merge_requests/407/diffs * add signal username field https://support.signal.org/hc/en-us/articles/6712070553754-Phone-Number-Pri… * maybe add keyoxide field as suggested by boldsuck: https://github.com/nusenu/ContactInfo-Information-Sharing-Specification/iss… Feel free to send me your suggestions and opinions before 2025-06-30 by creating github issues or by replying to this thread. kind regards, nusenu -- https://nusenu.github.io

3 5