[tor-relays] Who is running the two biggest Exits in the network?

[Nagaev Boris]

On Fri, May 26, 2017 at 3:26 PM, nusenu <nusenu-lists at riseup.net> wrote:
>> Since about mid April there are just two similar Exits making up now about 4.5% exit probability together.
>> Located in Panama, run in the okservers.net network, AS395978 ,they don’t give up any further information about themselves.
>>
>> Personally I would feel better at least having a contact or even better, knowing who is giving that much effort.
>> Probably a MyFamily configuration should be placed as well?
>>
>> https://atlas.torproject.org/#details/29C92C854E0F6652A77F3A8B231D6932993969E8
>>
>> https://atlas.torproject.org/#details/2CA4B2F36C2DDECFCB0B5A0D3300ED30E68E2D62
>
> this post contains a few pints about these relay's location (more likely
> in Germany than Panama):
> http://www.hackerfactor.com/blog/index.php?/archives/762-Attacked-Over-Tor.html
> https://twitter.com/nusenu_/status/861189840796344320

>From the article: "The registration information bounces between
multiple countries and never actually identifies the source. And they
were all registered recently. If you talk to any cybersleuths about
identity theft, spam, online fraud, scams, and fronts, they will tell
you that misleading registration and bouncing between countries is a
big red flag. This is some type of front. And it's deep enough to
either be organized crime or a nation-state." Does it mean that
several percent of exit traffic go through nodes that are likely to be
"organized crime or a nation-state"?

PS. "and 8am in Moscow" was really unnecessary in the article. 1.
Nothing in the investigation points to Russia/Moscow. 2. Russian
hackers is a tired joke. 3. Russian IT people in Moscow hardly start
working at 8am :-)

> They are no longer at 4.5% exit prob.
> They make up 3.88% exit prob. as of 2017-05-26 13:00.
>
>



-- 
Best regards,
Boris Nagaev