Hi,
A few notes. I don't know if I have missed it but I don't recall seeing bridges mentioned in this discussion.
I too have gotten an abuse message/info/alert from my hosting provider (Nov 8, 03:20 hrs) and I have an OBFS4 BRIDGE, no middle or exit node. And it has always been a bridge, from the initial installation/deploy 5+ years ago. My server was noted as being "blocked in Russia" earlier on the relay search tor metrics page, I have noted that this info have been removed from the page, I don't know if that is due to the server not being blocked (unlikely?) or the info have been removed from all pages, due top false positives etc(?).
This leads me to wonder if this "DOS attack" is being orchestrated from Russia somehow?
A tor op
On Sunday, November 10th, 2024 at 9:36 AM, Roger Dingledine arma@torproject.org wrote:
On Sun, Nov 10, 2024 at 03:15:59AM -0000, tor-operator@urdn.com.ua wrote:
I can confirm that the attack has not stopped and that we continue to monitor spoofed packets with Tor relay's IP addresses including the addresses of relays that are at our network.
This continues to trigger the sending of reports from the same amateurs.
Hi! Can you send me (off-list) the details of what you are seeing?
I see several possible scenarios:
(1) The attack stopped in some places but not in others. Or more specifically, some addresses are no longer being targeted but others still are.
(2) The attackers moved to some new host and started up the attack again, but only to some addresses. Or, some new attacker heard about all the excitement and decided to give it a go.
(3) You are misreading your packets and actually it is more benign than you think or otherwise we can find an expected explanation for what you are seeing.
#1 seems unlikely. #2 is definitely possible and we should look for evidence that it has happened, so we can pull in our friends and allies to do their work again. I am hoping for #3. :)
Thanks, --Roger
tor-relays mailing list -- tor-relays@lists.torproject.org To unsubscribe send an email to tor-relays-leave@lists.torproject.org