[tor-talk] Exit node stats collection?

[mirimir]

On 09/03/2013 08:39 PM, Elrippo wrote:

> I have to disagree with you on behalf of SPAM.
> 
> I opened Port 25 on one of my exits. In a week I got blacklisted by Google and some DNSBL's for sending spam.
> It took me quite a time to erase my IP from these lists...
> 
> I can live with port 587 for submission, but I will never open port 25 again.

Did you do this test recently, since mid August 2013?

While I'm sure that some spammers send email via Tor, I don't see why
botnet owners would do that. I doubt that they care much if some of
their slaves get blacklisted.

> mirimir <mirimir at riseup.net> schrieb:
>> On 09/03/2013 06:34 PM, Roman Mamedov wrote:
> 
>>> With the influx of "popularity" that Tor now sees, we need a way to
>> figure out
>>> who/what are all these new "users" and what are they actually doing.
> 
>> If this is a botnet, it's likely that slaves, for the most part, are
>> just visiting C&C hidden services.

I may have to disagree with myself. I just looked at
<https://metrics.torproject.org/performance.html#connbidirect> and the
fraction that mostly writes has increased dramatically since mid August.

And so I propose a more-specific hypothesis: this is a botnet for
collecting information from slaves, not for sending spam. If so, I
wonder what it's after.

>> If that's the case, there should be no increase in exit traffic. If
>> slaves are sending spam, they won't be using Tor for that.
> 
>> SNIP
> 
>> --
>> tor-talk mailing list - tor-talk at lists.torproject.org
>> To unsusbscribe or change other settings go to
>> https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk
> 
>