[tor-talk] DocTor's 'Possible Sybil Attack' (2015-06-03) report

nusenu nusenu at openmailbox.org
Wed Jun 3 21:24:10 UTC 2015


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512


DocTor reported a possible sybil attack:
https://lists.torproject.org/pipermail/tor-consensus-health/2015-June/005842.html

based on their signup and AS patterns this looks reasonable

lookup based on *nicknames* (onionoo data from 2015-06-03 18:00:00):
[1]
https://raw.githubusercontent.com/nusenu/tor-network-observations/master/doctors_sybil_attack_report_2015-06-03.txt

Relays of that group started to signup on 2014-11-17


lookup based on fingerprints (onionoo data from 2015-06-03 20:00:00)

https://github.com/nusenu/tor-network-observations/blob/master/doctors_sybil_attack_report_2015-06-03_by_fingerprint.txt


the following relays might be false positives
(based on the granular timeing information in combination with AS
information + comparison with [1])

- - siccam
- - Cannabinoid420
- - 467A957A5923616A92B63E69030C547F1C546370
- - DF6D49F7FF2327B8383B07521CDDF3DF12B5638D
- - 9D5BA8ACB8EDFD41F82351B563738CC4DE354A52
- - Hackosaurusrex
- - 6C405EC95C51E1D796392AAE29CF35B9E9B3468F


If you operate that undeclared family consisting of 65 relays consider
using MyFamily ;)
-----BEGIN PGP SIGNATURE-----

iQIcBAEBCgAGBQJVb3B6AAoJEFv7XvVCELh0m6kP/37bcu6DqxtIhFh05c8gI8A7
228nrFvmomBbnyS0dnnVChvo+98sPvwox92c4zVlItDbQ3Xqd6G4JtU+aJhE7nI/
qzNnRKS4rCXHJ0vZYpy33FAtFofSiRA+RjoqQnFIQK8JoF+pnVAL1OY0oOgvNqrJ
2vnGuEpxrbe1c+7R6A+HrJiftgSjv3MxSJXW2WJnKsy7RxcMuJKqw7Dtxam1v53s
T4+lYP7ZrLRNFoV5BoFqQJGxL6EfoNZejKndPwTSk57dYDoC42sDS9IuECEOnRs5
NXBPVCRCyEJKbDx6PQU58kv56ZcSU0jOI8r/bCkJnOw3op9lHUdk1AH8lKxhyJJz
A51WEpp0BSWBWCXlpoMPsMkOk+ynST9mFV8UFDQh6L4yuh76bmHRlRl5HZMWYPTY
zMJWCOiBcQNfgIwwYb/nQsQOXThD1iU7fMXYF6aGI7PLH+oT/KXMb1EZ3tDahvKx
bc+J16jxjcbScfZBgAV2eF3aX3UeA7nYnpLvGFAbaxkn4lgXoUzWzfNbi7va+fwc
NnUN6q50JHxGsHJwf6vKNL7ZeNkD7E+1VQj8Yu5PKW+QEeUypXluPqtFUQLfezxr
+Enflai9DZMNoKDRYwd//tzYqeDe9x3UhkJwq9YpBsKhJ26OPk3qVJjDrdGkhWq/
HXQI131m92clmC1khzrw
=EiS0
-----END PGP SIGNATURE-----


More information about the tor-talk mailing list