[tor-project] New UAE Users

[David Fifield]

On Tue, Mar 14, 2017 at 12:02:46AM +0000, Matthew Finkel wrote:
> It's interesting that the bridge users count began increasing a few days
> after relay users began decreasing. Actually, I found which bridge is
> supporting these new users. I confirmed it isn't one of the default bridges.
> 
> 
> {"version":"4.0",
> "relays_published":"2017-03-13 22:00:00",
> "relays":[
> ],
> "bridges_published":"2017-03-13 20:57:29",
> "bridges":[
> {"nickname":"Unnamed","hashed_fingerprint":"220B66EBF7625B31D3313491C0B888E488F2E66B","or_addresses":["10.64.118.173:56651"],"last_seen":"2017-03-13 20:57:29","first_seen":"2016-01-18 11:55:20","running":true,"flags":["Fast","HSDir","Running","Stable","V2Dir","Valid"],"last_restarted":"2017-03-09 06:48:03","advertised_bandwidth":2503701,"platform":"Tor 0.2.9.5-alpha on Linux","transports":["scramblesuit","obfs3","obfs4"]}
> ]}
> 
> https://onionoo.torproject.org/details?fingerprint=220B66EBF7625B31D3313491C0B888E488F2E66B
> https://atlas.torproject.org/#details/3E0908F131AC417C48DDD835D78FB6887F4CD126

Nice find. I think your second link (to atlas.torproject.org) is wrong,
because it's pointing to LeifEricson, which is one of the default
bridges. The right link should be:
https://atlas.torproject.org/#details/220B66EBF7625B31D3313491C0B888E488F2E66B

The disparity in bytes read/written is interesting. The bridge has about
6× more written bytes than read bytes. That could lend support to the
idea that the inflated statistics are caused by connections that are
prematurely terminated.