[tor-bugs] #28898 [Obfuscation/Censorship analysis]: Huge drop of users in UAE

[Tor Bug Tracker & Wiki]

#28898: Huge drop of users in UAE
---------------------------------------------+---------------------
 Reporter:  anadahz                          |          Owner:  dcf
     Type:  defect                           |         Status:  new
 Priority:  Medium                           |      Milestone:
Component:  Obfuscation/Censorship analysis  |        Version:
 Severity:  Normal                           |     Resolution:
 Keywords:  ae, censorship, block            |  Actual Points:
Parent ID:                                   |         Points:
 Reviewer:                                   |        Sponsor:
---------------------------------------------+---------------------

Comment (by dcf):

 It looks to me more like it's the ''end'' of some weirdness that begain in
 2017. The states from the UAE have been weird for a long time and we don't
 know why. My guess is that this is not a blocking event or a loss of real
 users, but rather something else artificial. Here is the decrease with
 more context:

 https://metrics.torproject.org/userstats-relay-
 country.html?start=2016-01-01&end=2019-01-01&country=ae&events=off
 [[Image(userstats-relay-country-ae-2016-01-01-2019-01-01-off.png,75%)]]

 These are the relevant [[doc/MetricsTimeline]] entries (I'm about to go
 refactor these):
 ||=start date =||=end date =||=places =||=protocols =||=description
 =||=links =||
 ||2017-01-15 ||2017-03-01 ||ae ||<OR> relay ||Huge increase in relay users
 (400k+). An anonymous contributor suggests that it may be a botnet, based
 on the large number of hosts with an open SMB port in the UAE.
 ||[https://metrics.torproject.org/userstats-relay-
 country.html?start=2017-01-01&end=2017-06-01&country=ae&events=off graph]
 [https://lists.torproject.org/pipermail/metrics-
 team/2017-January/000284.html metrics-team thread]
 [https://www.reddit.com/r/TOR/comments/5pbukk/united_arab_emirates_went_from_10k_tor_users_to/
 reddit thread] [https://bugs.torproject.org/25137#comment:10 comment about
 botnet] ||
 ||2017-03-01 ||2017-07-01 ||ae ||<OR> relay ||Another increase in relay
 users, with a slower rate of growth than the previous one.
 ||[https://metrics.torproject.org/userstats-relay-
 country.html?start=2017-01-01&end=2017-09-01&country=ae&events=off graph]
 ||
 ||2017-07-01 || ||ae ||<OR> relay ||Sudden drop in relay users.
 ||[https://metrics.torproject.org/userstats-relay-
 country.html?start=2017-01-01&end=2017-09-01&country=ae&events=off graph]
 ||
 ||2017-07-01 ||2017-08-30 ||ae ||<OR> relay ||Slow increase in relay
 users. ||[https://metrics.torproject.org/userstats-relay-
 country.html?start=2017-06-01&end=2017-11-01&country=ae&events=off graph]
 ||
 ||2017-09-01 || ||ae ||<OR> relay ||Relay users remain volatile but
 flatten their rate of growth. ||[https://metrics.torproject.org/userstats-
 relay-country.html?start=2017-06-01&end=2018-02-01&country=ae&events=off
 graph] ||

 For a while, there was also a weird increase in obfs3 users in the UAE.

 https://metrics.torproject.org/userstats-bridge-
 country.html?start=2016-01-01&end=2019-01-01&country=ae&events=off
 [[Image(userstats-bridge-country-ae-2016-01-01-2019-01-01.png, 75%)]]

 ||=start date =||=end date =||=places =||=protocols =||=description
 =||=links =||
 ||2017-02-06 ||~2017-08-01 ||ae ||obfs3 ||Increase in obfs3 users from the
 UAE, from 5K to 100K. Other transports not affected.
 ||[https://metrics.torproject.org/userstats-bridge-
 transport.html?start=2017-01-01&end=2017-08-01&transport=obfs3&transport=obfs4&transport=meek&transport=%3COR%3E
 transport graph] [https://metrics.torproject.org/userstats-bridge-
 country.html?start=2017-01-01&end=2017-08-01&country=ae UAE bridge graph]
 [https://bugs.torproject.org/21345 ticket] ||

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/28898#comment:2>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online