Roger Dingledine:
On Wed, Oct 09, 2019 at 12:31:31AM -0700, Porcelain Mouse wrote:
Are most of your new clients from Iran? We believe that some popular third-party software started using our bridges, causing these spikes.
Yes.
So, I'm seeing the same symptoms, again after about a week of almost no traffic. FYI.
Thanks for running a bridge!
I've heard versions of your stories from three or four other people who run bridges too. The basic pattern seems to me that suddenly they have tens of thousands of extra bridge users, and it lasts for a week or so and then the traffic vanishes again.
I assume that somebody is shipping a Tor client and a custom bridge list in some software that has this many users. And they keep updating their software with newer bridge lists.
I remain curious what the software is. :)
I too have heard those stories.
Yes, it's usually a few weeks from a particular country, then the unique users dies down and flat lines under 100 a day.
I suspect Roger is right on the cause, and it would be nice to know what's behind it. In the past, I suspected a bridge IP became viral among a group of people, but now, some circumvention application seems more likely.
I don't think the bridge IP is being blocked from the respective country, since a decent number of connections do continue from that particular country.
g