# Question about running snowflake browser extension
**URL:** https://forum.torproject.org/t/question-about-running-snowflake-browser-extension/14085
**Category:** Support
**Tags:** snowflake
**Created:** [August 14, 2024, 2:49pm UTC](https://forum.torproject.org/t/question-about-running-snowflake-browser-extension/14085 "2024-08-14T14:49:36Z")
**Posts on this page:** 20
**Page:** 1
### Author:  [@ekkcodeer](https://forum.torproject.org/u/ekkcodeer)
#### Post date: [August 14, 2024, 2:49pm UTC](https://forum.torproject.org/t/question-about-running-snowflake-browser-extension/14085/1 "2024-08-14T14:49:36Z")
Hi guys, I occasionally take a look at the users who connect via my snowflake in the Edge browser. Most of them are users from Iran and Russia. Today I discovered a web address of the Russian site called Kribrum ru. This was the first site that did not point to an individual user but to a company. I have no idea what it means, perhaps it is even uncritical, hence my question whether anyone knows this site or even knows more about the company. I have switched off snowflake for now.
---
### Author:  [@ebanam](https://forum.torproject.org/u/ebanam)
#### Post date: [August 14, 2024, 2:53pm UTC](https://forum.torproject.org/t/question-about-running-snowflake-browser-extension/14085/2 "2024-08-14T14:53:31Z")
@ekkcodeer, I am not sure how you are getting this info. Snowflake doesn’t work this way.
ref. [https://snowflake.torproject.org/](https://snowflake.torproject.org/)
> There is no need to worry about which websites people are accessing through your Snowflake proxy. Their visible browsing IP address will match their Tor exit node, not yours.
---
### Author:  [@SirNeo](https://forum.torproject.org/u/SirNeo)
#### Post date: [August 14, 2024, 3:07pm UTC](https://forum.torproject.org/t/question-about-running-snowflake-browser-extension/14085/3 "2024-08-14T15:07:25Z")
I don’t think you can see which sites are visited. Those russian site/company is from other plugin 🙂
user → snowflake proxy (your mozzila) → tor entry → tor middle → tor exit → website
Only tor exist can see the exit but doesn’t know client IP.
---
### Author:  [@Vort](https://forum.torproject.org/u/Vort)
#### Post date: [August 14, 2024, 6:28pm UTC](https://forum.torproject.org/t/question-about-running-snowflake-browser-extension/14085/4 "2024-08-14T18:28:11Z")
@ekkcodeer, Tor is for everyone. It does not matter who connects to your proxy. Except for cases of DDoS attack, but even that is a reason to add bans to firewall and not to “switch off snowflake”.
@ebanam @SirNeo look like you misunderstood him.
---
### Author:  [@BobbyB](https://forum.torproject.org/u/BobbyB)
#### Post date: [August 14, 2024, 10:04pm UTC](https://forum.torproject.org/t/question-about-running-snowflake-browser-extension/14085/5 "2024-08-14T22:04:46Z")
I think this is saying he can see who is connected to his machine and not the site visited. The image looks like a netstat or tcpview output.
I can see this if I use the debugging option in Firefox.
It looks something like this:
a=candidate:2218299339 1 udp 1694498815 x.xx.xx.xx 47226 typ srflx raddr 0.0.0.0 rport 47226 where x.xx.xx.xx is the IP address
It’s all encrypted UDP packets.
See this thread where we discuss this [A follow up question about Snowflake](https://forum.torproject.org/t/a-follow-up-question-about-snowflake/13971)
---
### Author:  [@WofWca](https://forum.torproject.org/u/WofWca)
#### Post date: [August 15, 2024, 10:36am UTC](https://forum.torproject.org/t/question-about-running-snowflake-browser-extension/14085/6 "2024-08-15T10:36:59Z")
I looked at their website. They claim to do internet data gathering and analysis, funded by grants from the Russian government. Checks out.
How do you know that this is related to Snowflake though?
> [@ekkcodeer](#):
>
> perhaps it is even uncritical
It is uncritical enough not to turn off Snowflake because of this.
About whether it is ethical to post the info about who connects to your Snowflake: I think it’s OK in this case. They’re watching us, we’re watching them.
---
### Author:  [@ekkcodeer](https://forum.torproject.org/u/ekkcodeer)
#### Post date: [August 15, 2024, 10:40am UTC](https://forum.torproject.org/t/question-about-running-snowflake-browser-extension/14085/7 "2024-08-15T10:40:00Z")
It was resmon but it could have been tcpview too … I usually use wireshark
---
### Author:  [@ekkcodeer](https://forum.torproject.org/u/ekkcodeer)
#### Post date: [August 15, 2024, 10:40am UTC](https://forum.torproject.org/t/question-about-running-snowflake-browser-extension/14085/8 "2024-08-15T10:40:43Z")
> [@ebanam](#):
>
> Their visible browsing IP address will match their Tor exit node, not yours.
you mean that [kribrum.ru](http://kribrum.ru) would operate a Tor exit node in Russia, which I now see in my connection … ?
---
### Author:  [@ekkcodeer](https://forum.torproject.org/u/ekkcodeer)
#### Post date: [August 15, 2024, 10:40am UTC](https://forum.torproject.org/t/question-about-running-snowflake-browser-extension/14085/9 "2024-08-15T10:40:50Z")
kk … turned it on again … I just didn’t want to give the evil ruzzen a chance to try something … irony off
---
### Author:  [@ekkcodeer](https://forum.torproject.org/u/ekkcodeer)
#### Post date: [August 15, 2024, 10:40am UTC](https://forum.torproject.org/t/question-about-running-snowflake-browser-extension/14085/10 "2024-08-15T10:40:54Z")
> [@SirNeo](#):
>
> Those russian site/company is from other plugin
Well that’s wrong … proven by Snowflake
---
### Author:  [@SirNeo](https://forum.torproject.org/u/SirNeo)
#### Post date: [August 15, 2024, 10:52am UTC](https://forum.torproject.org/t/question-about-running-snowflake-browser-extension/14085/11 "2024-08-15T10:52:46Z")
Yes i wanted to say users and I have typed sites, don’t know why, and completely forgot about netstat, my mistakes 🙂
iago.eecs.umich.edu is the same with [snowflake-02.torproject.net](http://snowflake-02.torproject.net) so that connection is legit.
Regarding the 2nd IP, maybe someone who is working at kribrum wanted to browse the free internet from work, or maybe that company tools are not working because of restrictions and they use snowflake like other users to browse free internet, what’s the problem?
---
### Author:  [@ekkcodeer](https://forum.torproject.org/u/ekkcodeer)
#### Post date: [August 15, 2024, 11:26pm UTC](https://forum.torproject.org/t/question-about-running-snowflake-browser-extension/14085/12 "2024-08-15T23:26:13Z")
> [@SirNeo](#):
>
> iago.eecs.umich.edu is
broker address
---
### Author:  [@ekkcodeer](https://forum.torproject.org/u/ekkcodeer)
#### Post date: [August 15, 2024, 11:26pm UTC](https://forum.torproject.org/t/question-about-running-snowflake-browser-extension/14085/13 "2024-08-15T23:26:23Z")
> [@WofWca](#):
>
> About whether it is ethical to post the info about who connects to your Snowflake
A username looks like this
username -----\> J/br:vRLUeUFASSzVopJS
It is cryptic and randomly generated
> [@WofWca](#):
>
> How do you know that this is related to Snowflake though?
simply watch your net traffic stun activities
---
### Author:  [@WofWca](https://forum.torproject.org/u/WofWca)
#### Post date: [August 16, 2024, 8:40am UTC](https://forum.torproject.org/t/question-about-running-snowflake-browser-extension/14085/14 "2024-08-16T08:40:13Z")
> [@ekkcodeer](#):
>
> broker address
To be precise, it’s the Snowflake server (bridge / relay).
> [@ekkcodeer](#):
>
> simply watch your net traffic stun activities
I mean, for that particular connection how did you figure it out? That it correlated timing-wise with STUN activity?
---
### Author:  [@ekkcodeer](https://forum.torproject.org/u/ekkcodeer)
#### Post date: [August 16, 2024, 4:30pm UTC](https://forum.torproject.org/t/question-about-running-snowflake-browser-extension/14085/15 "2024-08-16T16:30:19Z")
> [@WofWca](#):
>
> I mean, for that particular connection how did you figure it out? That it correlated timing-wise with STUN activity?
I haven’t looked at the whole thing from the perspective of the snowflake coding (I don’t know anything about the Go stuff) but by simply observing. It doesn’t seem to be part of the snowflake code but rather based on a peculiarity of WebRTC to use STUN. It is only visible if you are behind a NAT. My little program shows it like this.
---
### Author:  [@ekkcodeer](https://forum.torproject.org/u/ekkcodeer)
#### Post date: [August 19, 2024, 11:37am UTC](https://forum.torproject.org/t/question-about-running-snowflake-browser-extension/14085/16 "2024-08-19T11:37:27Z")
> [@WofWca](#):
>
> To be precise, it’s the Snowflake server (bridge / relay).
Ah … ok … I see I still have a lot to learn in order to understand and monitor the whole system … So I can still incorporate a lot into my work and progress project which I will put online on a small website and occasionally develop further … the snowflake monitor is on [cvision.lima-city.de](http://cvision.lima-city.de) … observers are welcome
---
### Author:  [@SirNeo](https://forum.torproject.org/u/SirNeo)
#### Post date: [August 19, 2024, 1:01pm UTC](https://forum.torproject.org/t/question-about-running-snowflake-browser-extension/14085/17 "2024-08-19T13:01:47Z")
So this kribrum are bots that are crwaling the internet via Snowflake because clear net is banned in Russia
---
### Author:  [@ekkcodeer](https://forum.torproject.org/u/ekkcodeer)
#### Post date: [August 19, 2024, 2:30pm UTC](https://forum.torproject.org/t/question-about-running-snowflake-browser-extension/14085/18 "2024-08-19T14:30:55Z")
> [@SirNeo](#):
>
> So this kribrum are bots that are crwaling the internet via Snowflake because clear net is banned in Russia
They even have a YouTube channel
> **[Крибрум - мониторинг социальных медиа](https://www.youtube.com/channel/UCt9n_0koVQfBjs9b5u9gWKg?view_as=subscriber)**
>
> Канал компании "Крибрум", представляющей ведущую российскую систему мониторинга и анализа контента социальных сетей.
Channel info
_ **The channel of the company Kribrum, which is the leading russian system for monitoring and analyzing the content of social networks.** _
One video is titled
_ **Destructive groups in social networks during distance learning** _
It all looks like russian propaganda channel … why should they use crawler bots via snowflake to reach clear net ?
And everything takes place in public
all looks … mmh … let’s say strange ?
Okay maybe it’s a bit off topic …
---
### Author:  [@WofWca](https://forum.torproject.org/u/WofWca)
#### Post date: [August 19, 2024, 6:32pm UTC](https://forum.torproject.org/t/question-about-running-snowflake-browser-extension/14085/19 "2024-08-19T18:32:02Z")
Interesting idea.
Though I should mention that from some Russian VPS / VDS providers you can still access Tor directly.
---
### Author:  [@ekkcodeer](https://forum.torproject.org/u/ekkcodeer)
#### Post date: [August 20, 2024, 11:40am UTC](https://forum.torproject.org/t/question-about-running-snowflake-browser-extension/14085/20 "2024-08-20T11:40:41Z")
For government-loyal providers, the system will certainly be able to leave one or two doors open so that they certainly don’t have to use Tor or other means to access the internet. If such people use Tor or Snowflake, then they want to find out something about the function of bypass systems
[Next page](https://forum.torproject.org/t/question-about-running-snowflake-browser-extension/14085.md?page=2)