There are many bridges in Onionoo that seem to follow a common naming convention: two dictionary words concatentated, then truncated to 16 characters. That, plus the fact that many of them run on the same platform, run only the obfs4 transport, and have related last_restarted times, makes me think they are somehow related and perhaps malicious. In a sample of 200 Onionoo bridges, 19% followed the convention. I noticed this by accident and I'm not planning to look into it more, so I'm dropping notes here.
I downloaded https://onionoo.thecthulhu.com/details?type=bridge ("bridges_published":"2016-11-28 21:41:02") and manually looked at the first 200 entries (of ~2500). I picked out the ones that followed the naming convention: two dictionary words concatenated and truncated to 16 characters; the 40 matches are appended to this message. Of those, only 2 (mapletalon and coffledtileries) don't match the others with respect to transports.
The words look like they are randomly chosen from a dictionary and some of them are esoteric or proper names. For example, cubicsrepugned = cubics + repugned instinctivevital = instinctive + vital stegosaurscontin = stegosaurs + contin(ue?) famishmentbarrac = famishment + barrac(ks?) Trobriandersbacc = Trobrianders + bacc(hannal?) friablerecitativ = friable + recitativ(e?) Ruidosospostcopu = Ruidosos + postcopu(latory?) introspectpacifi = introspect + pacifi(c?) cosponsorsangula = cosponsors + angula(r?)
Here's the list of 40 bridges I selected manually out of the 200. Notice that 17 of them have a last_restarted time withing 10 minutes of 2016-11-11 00:00:00.
$ ./nodeinfo < suspicious-bridges.json hashed_fingerprint nickname first_seen last_seen last_restarted platform transports BD2B73AE5F68276BE4E01534F97A28E992B24894 mapletalon 2015-05-01 22:57:41 2016-11-28 21:41:02 2016-10-18 17:48:08 Tor 0.2.8.9 on Linux obfs3,scramblesuit,obfs4,fte 89BD7F3C63464D389B73914FAA818EBF61EE6B46 coffledtileries 2015-12-30 16:52:56 2016-11-28 21:41:02 2016-11-07 12:20:31 Tor 0.2.8.9 on Linux obfs3 D6EC04069E89F08CAE4CBA0E2BE44FFD282BAB07 Trobriandersbacc 2016-09-04 05:38:16 2016-11-28 21:41:02 2016-11-10 00:05:41 Tor 0.2.8.9 on Linux obfs4 5ECF6C485B3DD05EDB9F95073257B8C33C755EE2 ElchoCanarian 2016-11-09 03:41:02 2016-11-28 21:41:02 2016-11-10 11:07:26 Tor 0.2.8.9 on Linux obfs4 FCA481C317E434590CFA06E77A4AE7F5E2E371A3 sailboaterecthym 2016-09-22 15:38:16 2016-11-28 21:41:02 2016-11-11 00:01:10 Tor 0.2.8.9 on Linux obfs4 8A1D76B37B8BB17C35454454E19C729C1AC47E8A orbitalprogymnas 1970-01-01 00:00:00 2016-11-28 21:41:02 2016-11-11 00:01:15 Tor 0.2.8.9 on Linux obfs4 4B9C80E3798BAB6B21D7256EE47EA20BF8F4576C Davossoutdroppin 2016-10-18 16:41:01 2016-11-28 21:41:02 2016-11-11 00:01:18 Tor 0.2.8.9 on Linux obfs4 EFEB18D156E1E14837E417113B3971C04F4F5FBB Ruidosospostcopu 1970-01-01 00:00:00 2016-11-28 21:41:02 2016-11-11 00:01:21 Tor 0.2.8.9 on Linux obfs4 79C6F406B3D3927ABB881EB54323B29DF400F9E2 hypospadiasesdum 2016-10-03 03:38:17 2016-11-28 21:41:02 2016-11-11 00:02:30 Tor 0.2.8.9 on Linux obfs4 B3B7B975DCD1D7E59D65202DB8E6E2D75655B358 stegosaurscontin 2016-10-23 17:41:01 2016-11-28 21:41:02 2016-11-11 00:02:48 Tor 0.2.8.9 on Linux obfs4 43CBD641F40EE1563BB1AF7736175512A5B559A2 famishmentbarrac 2016-10-22 12:41:01 2016-11-28 21:41:02 2016-11-11 00:03:48 Tor 0.2.8.9 on Linux obfs4 1931388E3C53689BED98E0BEFA7052F07BCC7F70 instinctivevital 2016-10-27 20:41:01 2016-11-28 21:41:02 2016-11-11 00:04:48 Tor 0.2.8.9 on Linux obfs4 914CF5540F8B92672CA6C9AA270DA88928B6CA78 cubicsrepugned 1970-01-01 00:00:00 2016-11-28 21:41:02 2016-11-11 00:05:02 Tor 0.2.8.9 on Linux obfs4 F791DD628CA38C402E2126DAD106EA19C67252F4 wheelsolla 2016-10-08 10:38:17 2016-11-28 21:41:02 2016-11-11 00:05:04 Tor 0.2.8.9 on Linux obfs4 E5BA71654F739B20AA807362EBA4FE91B57331EC IQsmediator 2016-11-09 18:41:02 2016-11-28 21:41:02 2016-11-11 00:05:16 Tor 0.2.8.9 on Linux obfs4 C8A129620B9ACA9708EBF40F54536A4DB644260F impulsivenesssle 2016-10-17 05:38:17 2016-11-28 21:41:02 2016-11-11 00:05:31 Tor 0.2.8.9 on Linux obfs4 500F068CBA07D0E0CEB0343D1DFF2CB32AD77080 friablerecitativ 1970-01-01 00:00:00 2016-11-28 21:41:02 2016-11-11 00:05:37 Tor 0.2.8.9 on Linux obfs4 71A74F4F94606B455B3CCE0AE4A21D57D557B489 imaginarysoverco 1970-01-01 00:00:00 2016-11-28 21:41:02 2016-11-11 00:05:49 Tor 0.2.8.9 on Linux obfs4 E7A4C66517035A309C6D448070B964023D150A5F aidedarticularly 2016-09-06 04:38:16 2016-11-28 21:41:02 2016-11-11 00:06:08 Tor 0.2.8.9 on Linux obfs4 66B41CF3878A37254511C5E3F76F513F74075464 blessedergrisled 1970-01-01 00:00:00 2016-11-28 21:41:02 2016-11-11 00:06:31 Tor 0.2.8.9 on Linux obfs4 C724E07A07E2C820208CD22D19A3B1B1FD40B7F3 whensquincentena 2016-11-03 05:41:02 2016-11-28 21:41:02 2016-11-11 05:02:03 Tor 0.2.8.9 on Linux obfs4 6567256AC5857A83D57F6D3256FBAC5D8030803B pipagelengthwise 2016-09-24 21:38:16 2016-11-28 21:41:02 2016-11-12 05:01:58 Tor 0.2.8.9 on Linux obfs4 3168BC247CA693DF2871AD547F74DD93D9A8CB4E recessionalsFols 2016-11-13 00:41:02 2016-11-28 21:41:02 2016-11-14 00:01:12 Tor 0.2.8.9 on Linux obfs4 A9EE320C9BF3E5505C08CBB26135A9342435414B amasseracrimonio 2016-11-14 23:41:02 2016-11-28 21:41:02 2016-11-16 00:01:13 Tor 0.2.8.9 on Linux obfs4 666AAC1C83DC928E2E72F69A40B3DF31F008FCF0 harmonizeLorinda 2016-11-08 18:41:02 2016-11-28 21:41:02 2016-11-16 18:47:25 Tor 0.2.8.9 on Linux obfs4 5D0BE64E6C00322D31B9CE83E5117F9D8860D291 supernaturesPoto 1970-01-01 00:00:00 2016-11-28 21:41:02 2016-11-17 00:01:03 Tor 0.2.8.9 on Linux obfs4 C319A27A6B749518F8B5ABA508676E3A0307B5CE pitchwomanPetrar 2016-11-18 16:41:02 2016-11-28 21:41:02 2016-11-18 16:23:52 Tor 0.2.8.9 on Linux obfs4 8F366D5100DC5806D03839434D20EE6508C3C6D5 xenogeniescondon 2016-11-22 01:41:02 2016-11-23 00:41:02 2016-11-22 01:21:38 Tor 0.2.8.9 on Linux obfs4 280608EF66099BC4DFE651E540B34EE2BAD53E0F Hofmannscrimply 2016-11-24 17:41:02 2016-11-25 16:41:02 2016-11-24 17:15:04 Tor 0.2.8.9 on Linux obfs4 75B88A93670C87243BEA433598B582BFA1FA38D5 otitisArchaeorni 1970-01-01 00:00:00 2016-11-28 21:41:02 2016-11-24 17:59:06 Tor 0.2.8.9 on Linux obfs4 8C585AA14CA728E03892BEC51284DFE39CD52641 streetyNavaratra 2016-10-22 18:41:01 2016-11-28 21:41:02 2016-11-24 23:01:07 Tor 0.2.8.9 on Linux obfs4 8475B61417F33A345F03A8939AAB8D011510A256 biffoximes 2016-11-26 05:41:02 2016-11-28 21:41:02 2016-11-26 05:22:06 Tor 0.2.8.9 on Linux obfs4 B296B50F26467B9BF85553C53AC9C4BA8B7D54E6 ephorscranberry 2016-11-26 15:41:02 2016-11-27 14:41:02 2016-11-26 15:05:01 Tor 0.2.8.9 on Linux obfs3 8292BA88B705EB5BC73EFBC49310FC2C57722AB7 memoirgores 2016-11-26 16:41:02 2016-11-27 22:41:02 2016-11-26 16:20:04 Tor 0.2.8.9 on Linux obfs4 48B85C391D285184D25F7F9C80CD1400BC361F30 cosponsorsangula 2016-11-27 06:41:02 2016-11-28 05:41:02 2016-11-27 06:12:34 Tor 0.2.8.9 on Linux obfs4 AD2FC88D84A85069D850011533A3ACA2F77A622C forequotedferric 2016-11-27 20:41:02 2016-11-28 21:41:02 2016-11-27 20:22:42 Tor 0.2.8.9 on Linux obfs4 3191235187A95599A4831D5B1891713A30B75110 dennetsreeder 1970-01-01 00:00:00 2016-11-28 21:41:02 2016-11-27 21:08:00 Tor 0.2.8.9 on Linux obfs4 3D6B08D309B3080697B74DEAE724E41FFC89B6BC introspectpacifi 2016-11-28 07:41:02 2016-11-28 21:41:02 2016-11-28 07:11:54 Tor 0.2.8.9 on Linux obfs4 1F4CAB0568389C049623E41FA8ECD546F4821C53 pamphletaryDille 2016-11-25 20:41:02 2016-11-28 21:41:02 2016-11-28 08:01:58 Tor 0.2.8.9 on Linux obfs4 1C3F2CC53203756A12A3E2AFB587CD535920767E schlierenasympto 2016-11-28 10:41:02 2016-11-28 21:41:02 2016-11-28 11:33:41 Tor 0.2.8.9 on Linux obfs4
On Mon, Nov 28, 2016 at 07:23:16PM -0800, David Fifield wrote:
There are many bridges in Onionoo that seem to follow a common naming convention: two dictionary words concatentated, then truncated to 16 characters. That, plus the fact that many of them run on the same platform, run only the obfs4 transport, and have related last_restarted times, makes me think they are somehow related and perhaps malicious. In a sample of 200 Onionoo bridges, 19% followed the convention. I noticed this by accident and I'm not planning to look into it more, so I'm dropping notes here.
I managed to get one of these bridges (nickname "thirsterworthwhi", hashed_fingerprint 6FA21996A631A9E51A53E4867E887F95BDD1145D) from BridgeDB. It is running in AS 14061, "DIGITALOCEAN-ASN - Digital Ocean, Inc., US".
tor-project@lists.torproject.org