[tor-relays] Bridge Sees 100x Clients Starting 2019-08-31

[George]

Roger Dingledine:
> On Wed, Oct 09, 2019 at 12:31:31AM -0700, Porcelain Mouse wrote:
>>> Are most of your new clients from Iran?  We believe that some popular
>>> third-party software started using our bridges, causing these spikes.
>>
>> Yes.
>>
>> So, I'm seeing the same symptoms, again after about a week of almost no
>> traffic.  FYI.
> 
> Thanks for running a bridge!
> 
> I've heard versions of your stories from three or four other people who
> run bridges too. The basic pattern seems to me that suddenly they have
> tens of thousands of extra bridge users, and it lasts for a week or so
> and then the traffic vanishes again.
> 
> I assume that somebody is shipping a Tor client and a custom bridge list
> in some software that has this many users. And they keep updating their
> software with newer bridge lists.
> 
> I remain curious what the software is. :)

I too have heard those stories.

Yes, it's usually a few weeks from a particular country, then the unique
users dies down and flat lines under 100 a day.

I suspect Roger is right on the cause, and it would be nice to know
what's behind it.  In the past, I suspected a bridge IP became viral
among a group of people, but now, some circumvention application seems
more likely.

I don't think the bridge IP is being blocked from the respective
country, since a decent number of connections do continue from that
particular country.

g