TOR Traffic Uptick

TOR Traffic is up (a lot) in the past month: https://metrics.torproject.org/hidserv-rend-relayed-cells.png?start=2020-06-11&end=2020-09-11 It's been suggested that the traffic is related to recent state sponsored attacks: https://web.archive.org/web/20200911160601/https://blogs.microsoft.com/on-the-issues/2020/09/10/cyberattacks-us-elections-trump-biden/ What's your guess lain?

I'd prefer to think it's just people buying drugs online after lockdown.

>>12290 the rates are pretty stable since june. wouldn't we see more of a gradual uptick starting earlier if that were the case?

>>12289 Such a spike does not look like natural growth. Some ideas : * The admin of a tor based botnet fuarked up and now due to cascading effect he is accidentally creating a mountain of unmanageable traffic. * Tor network has some routing bug that now makes the traffic exponential, the error is not yet detected * Some new attack that tries to overload tor nodes/links to identify them * A few countries have added some firewalls and now more people use tor to watch soykaff * Chinese firewalls has cracks that allows some tor traffic from china to join up with the rest of tor network * feds accidentally turned up the slidebar for the tor node VM's, the bill has not yet arrived to his desk. * fix or bug in the graph / data collection for the graphic With only this data as symptom the patient could have anything.

>>12306 I like all of these scenarios because they're funny

>>12306 >The admin of a tor based botnet CEO of botnet

Seems like DDOS attack against onion service(s) based on increase of onion service traffic and Tor user traffic. It is also spelled Tor, not TOR, this is important for not looking like an fool.

>>12289 >What's your guess lain? The traffic is related to state-sponsored attacks. They generate a lot of chatter to cover up their real traffic flows and slow down the network to hinder actions of other actors. It's kind of pointless from the technical standpoint, it's not like the amount of traffic on the Tor affects traceability, but high brass of CIAKGBBBQ+ may have a different opinion.

related: https://www.reddit.com/r/TOR/comments/iqowar/massive_increase_in_onion_traffic_in_recent_days/

Rumor has it that it's related to Strontium, a Russian group focused on the US election.

>>12289 Election year.

>>12306 - china sites/services/apps blocked in india and some non-china sites also got blocked from spam reports, indians use tor since it's free - internet around the world had been throttled due to the spike of userbase, tor somewhat unthrottles (probably not applicable since it's likely slower) >>12335 Sounds like that USB/NAND company.

It is just a sign that the second Meme War (MW II) is about to commence. May the random number gods be merciful on our personas.

>10Gb/s Surprisingly low, actually. I mean, you could generate that with just a handful of residential connections and probably DDOS the whole network. >>12306 seems like a likely list. >>12335 I can believe it, but what are they doing with that bandwidth?

>>12341 Perhaps people really do avoid using Tor for high bandwidth applications, like big downloads or high resolution video. After factoring these out, the traffic numbers seem more sensible to me.

>>12341 Most high bandwidth activities on tor are painful because of things like captchas and just flat out blocking tor although if you can get through or use an alternative frontend the actual amount of data is fine. The documentation probably scares most people off from torrenting and some exits just block all torrent traffic anyway. Its still a niche thing and I'd also bet that most people using it are either privacy nerds who wouldn't be using many high bandwidth things anyway or people using it for a specific utility where they are mostly just using accessing small pages.

Botnet That's not organic growth, probably not humans doing it

Lately I see lot of traffic is going through German IP. Could it be correlated? I know there are lot of haxor enthusiasts in Germany but it made me suspicious at the point of changing circuit as I see it pass through a German IP. Sometimes (on a clearnet site) the 2 IPs are German.

>>12375 There are just loads of nodes in Germany, set something like ExcludeExitNodes {DE} if you are worried. I think the traffic increase could actually be related to popularity, related to political climates around the globe.

>>12370 I doubt that Trump mentioned Tor or something, but you usually see a similar spike when someone highly visible mentions a thing.

.. looks like the spike is over

>>12400 I suppose that confirms that it wasn't organic at all. I wonder which botnet it was.

>>12375 That damned turtle is the causant. It takes a soykafton of time to load. Who ever thought that having a 2956x2117 PNG on the frontpage was a good idea?

>>12402 > botnet I'd like to speculate it was recon/mapping hidden services.

>>12400 someone tried testing something, and concluded the experiment. My money is on a Russian hacking group

>>12410 >muh russian haxors

>>12375 It just so happens that a lot of privacy advocates are Germans. I'm not surprised at this.

>>12411 Russian, Chinese, and other hacking groups and troll factories are a part of the real world. Hard to believe there are people who still don't get it.

>>12414 must be a result of the last american elections. everything is fake news

>>12427 To be fair there's good reason to be sensitive about this stuff A lot of people legitimately believe Trump wouldn't have won was it not for Russians running facebook ads

maybe someone was testing a DDOS attack, in case they need to stop some file transfer at some time in the future

>>12429 True, but to write off that this stuff is happening for contrarian sake isn't the way either.

>>12414 Just like Iran hackers, Vietnamese hackers, European hackers and US and Israel Hackers and their propaganda machines, what is your point I don't get it?

>>12375 This is because most nodes are c*nt*b* VPS, because they're cheap and have unlimited bandwidth.

>>12385 i don't think the same guy who posted a 220x116 pic of the american flag (https://nitter.snopyta.org/realDonaldTrump/status/1212924762827046918) mentioned the tor network

Scaleway and OVH also provide similar cheap VPS services, with unlimited bandwidth.

well maybe take into consideration the recent events. Covid causing a lot of people to stay home more often. Also the riots. You seriously think they don't use tor to communicate?