[tor-relays] Webiron at it again...

[Schokomilch NOC]

Monday we received their usual spam about our exit-node sending spam, 
and of course instead of implementing the TorDNSEL on their sites, they 
rather want us to block a whole /24 range.

Anyhow, one line caught our eyes:

"Tor: Please note as the abuse from Tor has gotten out of hand, we do 
not give free passes to abuse coming from Tor exits. See the leader 
board linked below for more details on the issue."

They also include a link to some fancy unresolved abuse ranking[1].

 From that ranking we can see that they currently have 116 unresolved Tor 
abuse cases and at least 500 unresolved non-Tor cases.
Assuming that 616 cases are enough we can try to calculate with 99% 
certainty, the true interval of the difference in Tor and non-Tor abuse.

We will use 500/616 = 0.812 as an estimate for all non-Tor abuse and
we will use 116/616 = 0.188 as an estimate for all Tor abuse.

One can easily calculate that there is a difference of 62.3% between the 
81.2% non-Tor and 18.8% Tor abuse cases.

However this percentage (62.3%) is just one impression of a sample. 
Imagine we would sample 100 hosters just like webiron
and then see what their difference is. And we want to be 99% sure that 
our measured value is within the interval. The formula can be found 
here[2].

Then we would receive an interval from 0.51 to 0.73.

What this boils down to:

If we were to check 100 companies that send abuse reports like Webiron, 
in 99 cases we would find a difference between Tor and non-Tor abuse to 
range between 51% and 73%:

Two concrete examples:

Tor abuse could be as high as 24.5% (lower end of the interval -> 0.51 = 
75.5 non-Tor - 24.5 Tor)
or as low as 13.5% (higher end of the interval -> 0.73 = 0.865 Non-Tor - 
0.135 Tor)

I think that having a tiny bit less than 1/4 of all abuse reports 
originating from Tor is a pretty great value and not "out of hand" at 
all.


P.S.:
We are pretty sure that this calculation is correct, but don't take our 
word for it.

Also on a funny note: Their mx server blocks our mx server, so we can't 
even reply to their email, even though the Tor-exit runs on a different 
IP than the mx.



[1] https://www.webiron.com/abuse_web_leaderboard/
[2] 
http://www.kean.edu/~fosborne/bstat/06d2pop.html?ModPagespeed=noscript