Something funky is going in Iran: numbers of relay users flies off to 1M+

link

link

link

added component::metrics/analysis in Legacy / Trac ir in Legacy / Trac owner::metrics-team in Legacy / Trac priority::medium in Legacy / Trac severity::normal in Legacy / Trac status::new in Legacy / Trac type::task in Legacy / Trac labels

Woops, wrong component, my apologies.

Trac:

https://metrics.torproject.org/userstats-relay-country.png?start=2019-01-01&end=2019-06-01&country=ir

Trac:

https://metrics.torproject.org/userstats-bridge-country.png?start=2019-01-01&end=2019-06-01&country=ir

Trac:

https://metrics.torproject.org/userstats-bridge-combined.png?start=2019-01-01&end=2019-06-01&country=ir

Woops, wrong component, my apologies.

What component did you intend? I was thinking Censorship/Censorship Analysis, but possibly this is not related to censorship.

I [[/wiki/doc/MetricsTimeline?action=diff&version=322|added an entry]] on the Metrics Timeline.

Trac:
Keywords: N/A deleted, ir added
Description: https://metrics.torproject.org/userstats-relay-country.html?graph=userstats-relay-country&country=ir

to

link

link

link

Trac:
Cc: dcf to dcf, gaba

Trac:
Cc: dcf, gaba to dcf, gaba, phw

Trac:
Cc: dcf, gaba, phw to dcf, gaba, phw, mrphs

I just checked from a few different networks and also asked a number of people to test it from different ISPs and it seems like everyone is able to connect directly without a bridge. I'll update the ticket if I find out more.

According to the reports I gathered, it seems like all ISPs except for "Pars Online" are able to connect directly.

It now seems that 1/4 of the users in the Tor network are in Iran: https://metrics.torproject.org/userstats-relay-table.html?start=2019-05-30&end=2019-06-03

I looked at some relay extrainfo descriptors, to see if this is a fluke or what, and it looks like many relays are seeing not just a huge number of v3 consensus fetches from Iran, but also a huge variety of IP addresses fetching these consensus documents. So my current thought is that these really are a bunch of different Tor clients running in different places in Iran.

The shape of the growth makes me think it isn't many hundreds of thousands of people each one at a time deciding to install Tor Browser though. I wonder if Tor is now bundled in some software that many of them already had, and when it upgraded, they became Tor users? See for example how this happened in Ukraine two years ago, where the FreeU browser bundled a Tor client: legacy/trac#22369 (moved).

https://metrics.torproject.org/dirbytes.html makes it look like the directory load is growing with the recent pattern of Russian users, but not growing with the recent pattern of Iranian users. I wonder why that is.

I wonder how many of these are Orbot installations which were sitting on Android devices and now are suddenly connecting back to the network. Iranian users do have a habit of having all the censorship circumvention tools installed and try to see which one works everyday they pick up their phones. I asked Nathan to see if he can give us any statistics on how many active installation (through Google play store) we currently have in IR.

Tor Browser for Android without Orbot has been released. So, where are all that new users?

Google Play reports active users of Orbot in Iran has gone from 40k to about 70k in the last two months. This is a big spike, as before we would just grow a few k per month.

Iran is our legacy/trac#5 (closed) country, after Russia, India, US, and Ukraine.

Now, this is only measuring users who install Orbot from Google Play. If they are getting it from somewhere else, I don't think we can see those numbers.

Some unofficial telegram applications (e.g. Bgram) use Tor.

In the past month, several unofficial telegrams were removed by Google Play Protect service from users' devices. (E.g. talagram, hotgram, mobogram)

In the past few weeks in Iran, the speed of blocking MTProxy servers has increased. So the only remaining option for the unofficial telegram application was to integrate with Tor.

This is my guess. (Also reports from unofficial telegram builders, and reverse engineering of published files in the telegram)

Trac:
Username: xhdix