4 ms·
Yes, I think that the more revealing ratio would have been total malicious requests to all requests for each class of IP. If each Tor exit node is sending out
by legutierr 11y ago
Yes, I think that the more revealing ratio would have been total malicious requests to all requests for each class of IP. If each Tor exit node is sending out 30x as much traffic, with an average of 30 unique users per IP, then the cited ratios are meaningless.
The only thing that can be drawn from that data is that Tor makes IP-based reputation tools ineffective. The thing is, for many people that may be enough to justify what Cloudflare is doing.
- pfg 11y agoThat's what CloudFlare did in their blog post: > Based on data across the CloudFlare network, 94% of requests that we see across the Tor network are per se malicious.
- legutierr 11y agoThat number does not fit with the 1:380 ratio of Tor IPs that emitted malicious requests, though. That is, unless the vast majority of all Tor traffic is routed out of only a couple of exit nodes, which does not seem consistent with the way that Tor works. How can Cloudflare assert that 94% of all requests over Tor are malicious, when Akamai seems to be saying that less than 1% of Tor IPs contain malicious requests?