171–180 of 262 posts
Earlier quoted context omitted.
The interesting question is if there is a bot net spreading in Germany since the 17th of June. What would be the likelihood of that going undetected. If you like conspiracy theory, the rise in one country could point to state actors.
Why would it be so localized to one country? Does Germany have a unique enemy compared to other NATO countries?
Looking at the chart it seems to line up with the war in Ukraine. Germany was a target of Prigozhin’s Internet Research Agency (troll farms). I wonder if we will see a drop in Tor usage now that his coup has failed and his organization is being dissolved.
I think you're missing the last week of that chart. The huge influx happened very recently, not months ago.
Earlier quoted context omitted.
I faced a recent distributed attack averaging 20,000 RPS[1] around the same time which makes me think that there might be a bot. I wonder if there’s a network of website operators similar to NANOG or the RIPE NCC mailing lists where I could compare my own experience with those of other operators. [1] https://news.ycombinator.com/item?id=36561930
Why not CAPTCHA protect these pages instead of blocking tor? Same attack can go through regular web.
I'll probably migrate to some proof-of-work based schemes and some algorithms to detect anomalous requests, but it would require some engineering work on my part (for a free website FWIW), and the quickest way to mitigate it would be to block Tor.
[flagged]
I constantly use tor as a way to get a third view when debugging connection issues for customers and malware infected websites. If you ever experience the issue of a customer saying they can't connect, but when you test it it works perfectly fine, tor is great to verify if the issue might effect more customers. As a side effect of it being ipv4 only, you can also test issues when one protocol work but not the other (…
Earlier quoted context omitted.
Could be that someone is using a Cloud Provider in Germany, for example Hetzner
Doubt it. Hetzners smallest machine is something like $4/month, additional IPv4 addresses come with extra cost. They have quite tight service quotas, and this 2M additional IPs would be almost their entire IPv4 pool.
Hetzner (and other German entities) seem to operate quite a few relays though: https://metrics.torproject.org/rs.html#aggregate/as not sure if this might have something to do with it...
if you configure the graph to show more years you can see the similarities: https://metrics.torproject.org/userstats-relay-country.html?...
Earlier quoted context omitted.
EU? Basically researchers tries to get PII from people connected to Tor without consent of these people.
That's an interesting argument. Not sure it would hold up. I don't think an IP alone counts as PII, since the ISP would have to be queried to actually get any contact info.
Earlier quoted context omitted.
Why not CAPTCHA protect these pages instead of blocking tor? Same attack can go through regular web.
I already have per-IP ratelimiting, and I'm against using captchas have bad UX (including the much-hailed Turnstile). I'll probably migrate to some proof-of-work based schemes and some algorithms to detect anomalous requests, but it would require some engineering work on my part (for a free website FWIW), and the quickest way to mitigate it would be to block Tor.
Earlier quoted context omitted.
Why would it be so localized to one country? Does Germany have a unique enemy compared to other NATO countries?
Maybe German state itself is the actor.
(e.g., if you single-handedly double the network traffic, then an outside observer can figure out what ingress/egress traffic is yours)