We Checked All 2,734 Tor Exits for the SSH Trap's Exit Policy. Three Match. Here Is Why That Is Probably Innocent, and the Test That Settles It.
Earlier today we wrote about the 333 Tor exits that were turned into SSH password traps between October 1 and 5. The attacker's change had a recognizable shape: port 22 opened, the encrypted mail ports 993 and 995 closed, plaintext mail on 110 or 143 left open. So we checked every exit in the current consensus for that shape. Three match. We are publishing them, and the reasons we think they are most likely innocent, because a quiet list helps nobody check it.
The three
- jivin, fingerprint C5A6FEE5BC3BE19F5B9EB086CA95DAD393D8A4F6, PT Cloud Hosting Indonesia. In our records since April 20; the same policy in all 179 hourly snapshots this week.
- ExitFromPL4Me, fingerprint D97F46EB006516493E9B88F93852DB1FFD27239F, VPSPay Networks, Poland. First seen October 10; the same policy in all 179 snapshots this week.
- MyTorStar, fingerprint 7BA5E54DA098FED08622B75151E4718B8ACBDC24, FlokiNET, Finland. First seen October 19; the same policy in all 91 snapshots since.
Why this is probably innocent
The shape is not the attack. What gave the October attack away was a switch: 377 relays from 59 operators moved to the same new policy within a few days, on hosts that had been broken into. An exit policy is the operator's own choice, and some operators deliberately pick one that allows SSH and plaintext mail but not the encrypted mail ports. Nothing about that is malicious on its face.
None of these three switched. Each has carried the same policy for every hour we hold, which is the full week our detailed snapshots cover. jivin has been in our records since April, long before the October break-ins. ExitFromPL4Me appeared on October 10 and MyTorStar on October 19, both after the hijacked relays had been removed, and neither has changed since.
Our new sensor would not flag them, by design. The hourly check we deployed today alarms when 20 or more relays move to the same new policy in a day. Three long-stable relays are not that.
The test that settles it
A policy shape cannot tell you whether an exit is intercepting SSH. A host key can. Connect through each exit, pinned to that fingerprint, to an SSH server whose real host key you already know, and compare what comes back. The October researcher found the trap exactly this way: the interceptors presented their own key. We have not run this test; doing it properly means operating a Tor client against specific exits, and the Tor Project's network health team already runs exit scanners built for it.
If you operate one of these relays and the policy is yours, there is nothing to do. If you did not set it, take the relay offline, check the host for Ebury (indicators are in our earlier post), and write to [email protected].
If this was useful, or if it wasn't, the rating widget below takes ten seconds and is the only way we know.
How do AI models see YOUR brand?
AIPM has audited 250+ domains. 15 seconds. Free while still in beta.
Audit your site now → aipmsec.com
Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. If the box below does not load, the same question lives at https://analytics.dugganusa.com/nps.html?post=we-checked-all-2-734-tor-exits-for-the-ssh-trap-s-exit-policy-three-match-here-is-why-that-is-prob