[metrics-team] Question

[David Fifield]

On Wed, Jan 06, 2021 at 02:38:00PM +0000, Kai Dorner wrote:
> I have a question about the directly connecting users. Between 2012 and 2020
> the chart shows three main peaks (2013, end of 2017 and mid 2019). Do you have
> any explanation why this is so?

You can sometimes find answers to questions like this at the Metrics
Timeline:
https://gitlab.torproject.org/tpo/metrics/timeline

The 2013 increase was because of a botnet that used Tor to communicate:

|2013-08-19|~2014-04-28||<OR> relay|Relay users increase globally from about 800K to over 5M, when computers in the [Mevade/Sefnit botnet](https://en.wikipedia.org/wiki/Mevade_Botnet) began using Tor to communicate. The user count decreased in the following months through efforts to clean up the botnet. Sometime in 2014-04, the botnet switched from using Tor to using SSH.|[blog post](https://blog.torproject.org/blog/how-to-handle-millions-new-tor-clients) [tech report](https://research.torproject.org/techreports/botnet-tr-2013-11-20.pdf) [analysis](https://blog.fox-it.com/2013/09/05/large-botnet-cause-of-recent-tor-network-overload/) [switch to SSH](https://www.facebook.com/notes/protect-the-graph/sefnit-is-back/1448087102098103)||

The 2017 event was localized to Germany but it was big enough to affect
the global statistics. The cause is still unknown (that's what the "X"
in the last column represents).

|2017-09-26|2017-10-22|de|<OR> relay|Steady increase of relay users in Germany, from 180k to around 500k. It would increase further starting 2017-12-10.|[de graph](https://metrics.torproject.org/userstats-relay-country.html?start=2017-08-15&end=2017-12-01&country=de&events=off) [Reddit thread](https://www.reddit.com/r/TOR/comments/7b53kq/direct_users_from_germany_go_from_200k_to_500k_in/) [ticket](https://bugs.torproject.org/24669)|X|
|2017-12-10|2018-02-01|de|<OR> relay|Further, slow increase of relay users in Germany, from 500k to over 1.5M.|[graph](https://metrics.torproject.org/userstats-relay-country.html?start=2017-11-01&end=2018-01-15&country=de&events=off) [Reddit thread](https://www.reddit.com/r/TOR/comments/7ldrox/tor_usage_in_germany_what_happend/) [ticket](https://bugs.torproject.org/24669)|X|

The 2019 event was caused by Tor being temporarily unblocked in Iran.

|2019-05-16|2019-06-23|ir|relay|Tor becomes directly accessible in Iran, leading to an explosion in relay users up to about 1.5 million, before being blocked again.|[ticket](https://bugs.torproject.org/30636) [comment about end](https://bugs.torproject.org/30636#comment:25) [tor-talk thread](https://lists.torproject.org/pipermail/tor-talk/2019-June/045221.html) [Reddit thread](https://www.reddit.com/r/TOR/comments/bw4byr/surge_in_users/) [comment](https://bugs.torproject.org/30636#comment:30) [Reddit thread](https://www.reddit.com/r/TOR/comments/c4lwdj/today_iran_government_blocked_tor_bootsraping_in/)||