[metrics-bugs] #30636 [Metrics/Analysis]: Something funky is going in Iran: numbers of relay users flies off to 1M+

[Tor Bug Tracker & Wiki]

#30636: Something funky is going in Iran: numbers of relay users flies off to 1M+
------------------------------+------------------------------
 Reporter:  cypherpunks       |          Owner:  metrics-team
     Type:  task              |         Status:  new
 Priority:  Medium            |      Milestone:
Component:  Metrics/Analysis  |        Version:
 Severity:  Normal            |     Resolution:
 Keywords:  ir                |  Actual Points:
Parent ID:                    |         Points:
 Reviewer:                    |        Sponsor:
------------------------------+------------------------------

Old description:

> [[Image(userstats-relay-country-ir-2019-03-01-2019-06-11-off.png,600px)]]
> [https://metrics.torproject.org/userstats-relay-
> country.html?start=2019-03-01&end=2019-06-11&country=ir link]
>
> [[Image(userstats-bridge-country-ir-2019-03-01-2019-06-11.png,600px)]]
> [https://metrics.torproject.org/userstats-bridge-
> country.html?start=2019-03-01&end=2019-06-11&country=ir link]
>
> [[Image(userstats-bridge-combined-ir-2019-03-01-2019-06-11.png,600px)]]
> [https://metrics.torproject.org/userstats-bridge-
> combined.html?start=2019-03-01&end=2019-06-11&country=ir link]

New description:

 [[Image(userstats-relay-country-ir-2019-04-01-2019-09-03-off.png,600px)]]
 [https://metrics.torproject.org/userstats-relay-
 country.html?start=2019-04-01&end=2019-09-03&country=ir link]

 [[Image(userstats-bridge-country-ir-2019-04-01-2019-09-03.png,600px)]]
 [https://metrics.torproject.org/userstats-bridge-
 country.html?start=2019-04-01&end=2019-09-03&country=ir link]

 [[Image(userstats-bridge-combined-ir-2019-04-01-2019-09-03.png,600px)]]
 [https://metrics.torproject.org/userstats-bridge-
 combined.html?start=2019-04-01&end=2019-09-03&country=ir link]

--

Comment (by dcf):

 Replying to [comment:32 xhdix]:
 > and again..
 > The ability to connect directly to Tor was blocked, and it was blocked
 through the list of IPs in the collector.

 How do you know that it was blocked using the CollecTor?

 > It looks like an app (probably an unofficial telegram) uses <OR>. (Due
 to a sharp increase and decrease)

 In the recent past, I've seen two large but brief spikes of users from IP
 addresses located in Iran, on two of my vanilla bridges. (In the second
 case, the bridge is actually supposed to be a meek bridge, but the Iranian
 IP addresses were connecting to one of its exposed ORPorts.)

 It would be an interesting experiment to go through CollecTor data and see
 if any other bridges have experienced spikes like this. A hypothesis is
 that a Telegram app, or whatever it is, chooses one bridge to use for a
 day, then changes to another one. If that were the case, we would be able
 to identify spikes rolling temporally across multiple bridges.

 https://metrics.torproject.org/rs.html#details/272EB44C8992B8088BD8E8A12DB23B56478EB885
 [[Image(history-eRYaZuvY02FpExln-20190903.png)]]

 https://metrics.torproject.org/rs.html#details/AA033EEB61601B2B7312D89B62AAA23DC3ED8A34
 [[Image(history-starman-20190903.png)]]

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/30636#comment:33>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online