It’s easy if you’re running an IPv6-only exit, whereas not all ISPs give multiple IPv4 addresses. My IP address was consistently blocked as a Tor node.Ī common recommendation is to run it from a separate IP. I stopped because I could not access services anymore (e.g., Skype) that I really needed. In research published this week and shared with The Record, Nusenu said that at one point, there was a 16% chance that a Tor user would connect to the Tor network through one of KAX17’s servers, a 35% chance they would pass through one of its middle relays, and up to 5% chance to exit through one.ĭecem10:22 have run an exit node for some time (months, not years) a long time ago. KAX17’s focus on Tor entry and middle relays led Nusenu to believe that the group, which he described as “non-amateur level and persistent,” is trying to collect information on users connecting to the Tor network and attempting to map their routes inside it. For example, a threat actor that Nusenu has been tracking as BTCMITM20 ran thousands of malicious Tor exit nodes in order to replace Bitcoin wallet addresses inside web traffic and hijack user payments. Nusenu said this is strange as most threat actors operating malicious Tor relays tend to focus on running exit points, which allows them to modify the user’s traffic. The actor’s servers are typically located in data centers spread all over the world and are typically configured as entry and middle points primarily, although KAX17 also operates a small number of exit points. Grouping these servers under the KAX17 umbrella, Nusenu says this threat actor has constantly added servers with no contact details to the Tor network in industrial quantities, operating servers in the realm of hundreds at any given point.

Since 2017, someone is running about a thousand-10% of the total-Tor servers in an attempt to deanonymize the network:

Tor project decline server numbers will