And it helps to **automatically** tell false-friends apart especially since families have become so
large that we can no longer use that as a good signal because family must be splitted if they become too large for the
descriptor limit.
A good example is nothingtohide.nl, all of their relays have a proper AROI configuration and they verify properly:
Here are 3 examples of large relay operators
where AROI verification fails (partially):
If you are one of them or if you know them please ping them if you can:
_______________________________________________
tor-relays mailing list -- tor-relays@lists.torproject.org
To unsubscribe send an email to tor-relays-leave@lists.torproject.org
It looks like they're even doing that for small operators. For example,
I only run 5 relays, named forest1 through forest5. They cloned one of
my relays, forest3, a total of 6 times. Each forest3 relay has a stolen
ContactInfo from some other random operator. Needless to say, I only
run one of Relay Search.
Whoever is doing this may have been testing it out as early as a few
weeks ago. I noticed back then that there was another forest3 (the same
relay that is being impersonated now) which was down when I noticed it.
I assumed it was just a coincidence at the time. It no longer shows in
the Metrics page as it has been down for too long.
Will these (and the other new relays) be taken down soon?
As an aside, it's strange that these are all non-exits. That would
indicate a somewhat more sophisticated attack than a typical MITM from
rogue exits, but a sophisticated threat actor should realize that
adding 900+ relays at once with stolen Nickname and ContactInfo fields
would raise red flags. Could it be some naรฏve researcher with a budget
and a lax IRB? I don't understand this.
Regards,
forest
ยทยทยท
_______________________________________________
tor-relays mailing list -- tor-relays@lists.torproject.org
To unsubscribe send an email to tor-relays-leave@lists.torproject.org
It looks like all the newly added relays, or at least all the ones that
I was looking at, have shut down. I suppose whoever put them up has now
realized that they have been detected. Will all the fingerprints be
blacklisted anyway?
Regards,
forest
ยทยทยท
_______________________________________________
tor-relays mailing list -- tor-relays@lists.torproject.org
To unsubscribe send an email to tor-relays-leave@lists.torproject.org
Actually, the relays are still running, at least at this moment. (You
can check this yourself by telneting to their ORPort.)
They appear down on the metrics page because they are no longer in the
consensus, because a threshold of the directory authorities are rejecting
them (as of about 30 hours ago).
--Roger
ยทยทยท
On Fri, Nov 21, 2025 at 08:15:16PM -0000, forest-relay-contact--- via tor-relays wrote:
It looks like all the newly added relays, or at least all the ones that
I was looking at, have shut down. I suppose whoever put them up has now
realized that they have been detected. Will all the fingerprints be
blacklisted anyway?
_______________________________________________
tor-relays mailing list -- tor-relays@lists.torproject.org
To unsubscribe send an email to tor-relays-leave@lists.torproject.org
That's because onionoo sometimes returns 13 relays I had shutdown nearly two years ago. And digitalcourage uses the .social tld for AROI and not the .de
ยทยทยท
On 11/23/25 16:36, Tor at 1AEO via tor-relays wrote:
tuxli: 13 out of 95. Error: Fingerprint not found in rsa-fingerprint.txt (13 relays)
digitalcourage.de: 30 out of 30. Error: 404 Not Found for .well-known/tor-relay/rsa-fingerprint.txt
_______________________________________________
tor-relays mailing list -- tor-relays@lists.torproject.org
To unsubscribe send an email to tor-relays-leave@lists.torproject.org
It looks like all the newly added relays, or at least all the ones that
I was looking at, have shut down. I suppose whoever put them up has now
realized that they have been detected. Will all the fingerprints be
blacklisted anyway?
This stuff indeed started happening to my relay a couple of weeks ago, it's as if they're spinning up new relays from the same location. Relay Search
The real me is Relay Search
Might be worth checking out the AROI thing.
Could it be some naรฏve researcher with a budget
and a lax IRB?
Wouldn't that 'researcher' want to interact with the community and seem less sketchy though?
ยทยทยท
_______________________________________________
tor-relays mailing list -- tor-relays@lists.torproject.org
To unsubscribe send an email to tor-relays-leave@lists.torproject.org