[tor-relays] OrNetRadar spots botnet joining the tor network? (79 relays, 38 countries, 67 ASes)

[Roger Dingledine]

On Tue, Mar 08, 2016 at 12:56:06AM +0000, nusenu wrote:
> this smells like a botnet to me:
> 
> http://article.gmane.org/gmane.network.onion-routing.ornetradar/1073
> http://article.gmane.org/gmane.network.onion-routing.ornetradar/1074

Agreed. With wide-open exit policies too. Yuck. Thanks.

Usually these sorts of things disappear within a day or so of appearing. I
guess because the operator realizes this isn't going to actually do
whatever he/she thought it would.

Once it does disappear, we might be wise to put the addresses on a
watchlist to see if they reappear later.

--Roger