[tor-relays] Sybil Attack on 2025-11-20 - please setup your AROIs :)

Hi,

as some of you might have noticed, yesterday 2025-11-20 someone added ~900 new tor relays
to the tor network.

They used nickname schemes from other operators:

* NTH
* prsv
* Quetzalcoatl
* for-privacy.net
* relayon
* DFRI
* bauruine
...

For this reason I wanted to encourage every operator, especially the large once to
setup their AROI.
Here is a howto:

Why?
You get nice timeseries graphs of your relays.
example: Operator: artikel10.org | OrNetStats

And it helps to **automatically** tell false-friends apart especially since families have become so
large that we can no longer use that as a good signal because family must be splitted if they become too large for the
descriptor limit.

A good example is nothingtohide.nl, all of their relays have a proper AROI configuration and they verify properly:

Here are 3 examples of large relay operators
where AROI verification fails (partially):

If you are one of them or if you know them please ping them if you can:

* quetzalcoatl-relays.org Tor Relays :: Contact :: email:Quetzalcoatl_relays[]proton.me...
* emeraldonion Tor Relays :: Family 34933f
* prsv.ch Tor Relays :: Contact :: email:admin[]prsv.ch url:https://prsv.ch/...

kind regards,
nusenu

ยทยทยท

--

_______________________________________________
tor-relays mailing list -- tor-relays@lists.torproject.org
To unsubscribe send an email to tor-relays-leave@lists.torproject.org

2 Likes

They used nickname schemes from other operators

It looks like they're even doing that for small operators. For example,
I only run 5 relays, named forest1 through forest5. They cloned one of
my relays, forest3, a total of 6 times. Each forest3 relay has a stolen
ContactInfo from some other random operator. Needless to say, I only
run one of Relay Search.

Whoever is doing this may have been testing it out as early as a few
weeks ago. I noticed back then that there was another forest3 (the same
relay that is being impersonated now) which was down when I noticed it.
I assumed it was just a coincidence at the time. It no longer shows in
the Metrics page as it has been down for too long.

Will these (and the other new relays) be taken down soon?

As an aside, it's strange that these are all non-exits. That would
indicate a somewhat more sophisticated attack than a typical MITM from
rogue exits, but a sophisticated threat actor should realize that
adding 900+ relays at once with stolen Nickname and ContactInfo fields
would raise red flags. Could it be some naรฏve researcher with a budget
and a lax IRB? I don't understand this.

Regards,
forest

ยทยทยท

_______________________________________________
tor-relays mailing list -- tor-relays@lists.torproject.org
To unsubscribe send an email to tor-relays-leave@lists.torproject.org

1 Like

It looks like all the newly added relays, or at least all the ones that
I was looking at, have shut down. I suppose whoever put them up has now
realized that they have been detected. Will all the fingerprints be
blacklisted anyway?

Regards,
forest

ยทยทยท

_______________________________________________
tor-relays mailing list -- tor-relays@lists.torproject.org
To unsubscribe send an email to tor-relays-leave@lists.torproject.org

Actually, the relays are still running, at least at this moment. (You
can check this yourself by telneting to their ORPort.)

They appear down on the metrics page because they are no longer in the
consensus, because a threshold of the directory authorities are rejecting
them (as of about 30 hours ago).

--Roger

ยทยทยท

On Fri, Nov 21, 2025 at 08:15:16PM -0000, forest-relay-contact--- via tor-relays wrote:

It looks like all the newly added relays, or at least all the ones that
I was looking at, have shut down. I suppose whoever put them up has now
realized that they have been detected. Will all the fingerprints be
blacklisted anyway?

_______________________________________________
tor-relays mailing list -- tor-relays@lists.torproject.org
To unsubscribe send an email to tor-relays-leave@lists.torproject.org

1 Like

That's because onionoo sometimes returns 13 relays I had shutdown nearly two years ago. And digitalcourage uses the .social tld for AROI and not the .de

ยทยทยท

On 11/23/25 16:36, Tor at 1AEO via tor-relays wrote:

tuxli: 13 out of 95. Error: Fingerprint not found in rsa-fingerprint.txt (13 relays)
digitalcourage.de: 30 out of 30. Error: 404 Not Found for .well-known/tor-relay/rsa-fingerprint.txt

_______________________________________________
tor-relays mailing list -- tor-relays@lists.torproject.org
To unsubscribe send an email to tor-relays-leave@lists.torproject.org

Hi,

hereโ€™s metastable-void/็œŸ็ฉบ, the head of Tor Operations division at Menhera/Human-life Information Platforms Institute (AS63806).

thanks for the advice. since weโ€™re the largest relay operator in Japan and we are expanding soon, Iโ€™ll seriously consider setting up AROI.

Cheers,

ยทยทยท

โ€“
Yuka MORI / metastable-void
<mori@menhera.ad.jp>

On Sat, Nov 22, 2025 at 5:17 forest-relay-contactโ€” via tor-relays <tor-relays@lists.torproject.org> wrote:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

It looks like all the newly added relays, or at least all the ones that
I was looking at, have shut down. I suppose whoever put them up has now
realized that they have been detected. Will all the fingerprints be
blacklisted anyway?

Regards,
forest
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEvLrj6cuOL+I/KdxYBh18rEKN1gsFAmkgyEIACgkQBh18rEKN
1gsk9BAAkm2wMhguM5xYOU+bHkJn090KcXpbT/3sSeeDYMas2n4npgjZURuLULzZ
qVV9Lc9WMXmV5kfmNuzooFbbjb63DdrktGg/5ae74lmkgejY9puKogGdTgdGlSeg
mJKOHn0j8VNJEaWtHO1InpvL1AEjNukXpNnQJD4MHW+PGsylcE6MyaLd/XVeOQEG
j10l8tfB95h4Enk7FOq6YVPo525VtpGsdrCLbTKWMAqHs8NRigBuXp8iRobpMniM
EGkDvIXv+Thv60FGeyqKxL3EvgDf/5dkmQN3Ix4xwsEkz85CwseYBajX7V0tvh2X
tdxiZHPUDsCTSqETw2Sw/IhgzfdcnbW7fxeCup9+3qHsePJe4aYasyl41cxpk5U4
VPPgxyOrX2S/x5w3T92P1rFvZ9sdevog8p+kDe4GU5MpiauivS6S32PLGDjAJGX9
fTJJuQOfccX1stJv8M8baBFpvcMHtf/wqHjLEeo/MeNX9xw62ZW8kT/fEhDjtLxe
vE54u0MHoy4WGEylouWb9xA0Bvim/zOcISL/79AgRuJXrDQcGdM9bYvJSgBoZe3x
b+Jg2vkJMH9jJhhJlhGnM2+B/FneOLq/37BzsqTiabGdyoSyAIJAUVHq5F0THc8E
PpUOuBqhjUefI1qBMWt3E4YivigI8Ub9HVirbQhBeEqWQuuUzMo=
=tN0q
-----END PGP SIGNATURE-----


tor-relays mailing list โ€“ tor-relays@lists.torproject.org
To unsubscribe send an email to tor-relays-leave@lists.torproject.org

โ€“
You received this message because you are subscribed to the Google Groups โ€œIT Operations Centerโ€ group.
To unsubscribe from this group and stop receiving emails from it, send an email to itops+unsubscribe@menhera.com.
To view this discussion visit https://groups.google.com/a/menhera.com/d/msgid/itops/176375611620.1309.15744379596169693132%40lists-01.torproject.org.
For more options, visit https://groups.google.com/a/menhera.com/d/optout.

This stuff indeed started happening to my relay a couple of weeks ago, it's as if they're spinning up new relays from the same location. Relay Search
The real me is Relay Search

Might be worth checking out the AROI thing.

Could it be some naรฏve researcher with a budget

and a lax IRB?

Wouldn't that 'researcher' want to interact with the community and seem less sketchy though?

ยทยทยท

_______________________________________________
tor-relays mailing list -- tor-relays@lists.torproject.org
To unsubscribe send an email to tor-relays-leave@lists.torproject.org