-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 > by looking at https://metrics.torproject.org/platforms.html > https://metrics.torproject.org/versions.html I noticed a little > spike in relays at the beginning of the month (actually I was > visiting metrics to see if some ticket made progress ;) > > On 2015-04-01 someone (it was likely a single entity) signed up 20 > exits @ Choopa LLC. If you go back in time on that AS you find > similar events. So this potential entity might run 40 exits. If you > condense all properties and do not restrict your search to the > Choopa AS (AS20473) the potential operator likely runs 55 exits. > > Fun part: Maxmind had no AS info on some IPs (4) that are also part > of AS20473, so they got filtered out in the first result set where > I only looked into AS20473 (40 relays), but these relays found > there way back into the result set (55 relays) on the next > iteration due to other similarities. So I'm pretty confident in the > linkability of these exit relays. > > Details: > https://raw.githubusercontent.com/nusenu/misc-files/master/finding_the _hidden_choopa_family.txt > > > > Common properties: (ordered from more to less significant > property) > > - *last_restarted* - first_seen (in groups) - DirPort (auto) - > Nickname (not matching put similar naming style) - exit policy - no > declared family - ORPort - two instances per IP - no contactInfo - > tor version
Four days after I send this email the dirport changed on almost all the listed relays from auto (quite unique property) to 0 (probably after the operator read this email) also relevant for this thread https://lists.torproject.org/pipermail/tor-talk/2015-April/037549.html -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJVOWOyAAoJEFv7XvVCELh03dQP/RjlF02hbz7K54LA2ZUjZukH ktOhp6ff3IDk2kw4CyEsZ5CNYzxtEirobFkFwKOwnQ695s6yFePwhQPtOY6Yi754 5oU86Q/Y0vdM37HrM2kUlNtWn3B5Mtf0fmo1NFh5HvFhW6V3fDxTSUIbVm6LD3Vr P1HCarQmfVa76JZSJ5ovkkHJ8mUA519MP07WWZdzpsna5nq2kPw5TTd22RE8yWvM CznH2XxIdFwNRkVLWX6N7rkSZppYAA2iy2JiaeicT2OCpF9zWLSDUyuWWE/iruuz ySdeF78yqBVSHr5VbeA7Gl+suAaYlmOFOmjhOuKxlrmeYwVz3O0tFGzWRTbY9iL7 E2htpWz2yMIz+CMctV7vN40c8lu4p3LIU8E2YqKynbZVOVgz68oKdivFdB5ak5KU OSW4clENKYrZjkZ7HWY0sVdWyPKjQk7PLHH+YoxCMuFyDF/vyZHkEagx5O0pFX2Q kMIMLtBJatMRmyzpKkmuuEIm8Eh2ZgP26Ue2DZ6fgrodZO2vreHzAtQtkZWyYrok SOA3eBTzFNxnUaQtzaKOrkX5zx1rnaca/GliozyPtVcz696CW2q2w79J7xe1QG8p AbLqTrluNb4NhFGsvKGUcC0tDHuRH5jSsGh/UH07O3vhwb9ra+0i4/oR1t9fZNeS UH9ebMA+n1Yo9rieA2iC =CkU3 -----END PGP SIGNATURE----- -- tor-talk mailing list - tor-talk@lists.torproject.org To unsubscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
