I have been running a tor relay for about a year and according to my munin graph It normally receives, on average, just under 2,000 incoming tcp connections on port 443 every 5 minutes.

In the last few days that figure has increased to about 10,000 and spiked to about 19,000 incoming requests every 5 minutes.

First thought was DDOS but traffic is not high enough to cause any problems.

I did some digging and in a 5 minute period received the following requests to the port tor is listening on (number of requests and source ip address)

   2722 SRC=107.167.22.79
   1355 SRC=107.167.22.90
   1334 SRC=104.37.244.131
   1237 SRC=213.251.185.14
    604 SRC=188.247.130.32
     13 DST=178.200.216.58
      7 SRC=92.63.110.232
      6 SRC=5.196.8.208
      6 SRC=200.76.82.231
      6 DST=93.158.248.243

Just wondering if others are seeing a large number of requests from the above ip addresses or if it's just me. If it is just me then I can easily just block these ip addresses.