You don't have to be cloudflare for this kind of analysis you can do it yourself without even needing an ASN using RIPE RIS.

https://www.ripe.net/analyse/internet-measurements/routing-i...

I doubt it's that much but with the same logic you could also ban HN, SSH and basically any protocol thats not https "with no one noticing" because 99.9+% doesnt use it.

Sure but from your link

>The PBL detects end-user IP address ranges which should not be attempting to directly deliver unauthenticated SMTP email to any Internet mail server. All the email originated by an IP listed in PBL is expected to be submitted - using authentication - to a SMTP server which delivers it to destination

Means in practice port 25 (unauthenticated) and port 587 (authenticated)

Tor has a transport using exactly that.

https://blog.torproject.org/introducing-webtunnel-evading-ce...

SMTP isn't filtered it's port 25 that is. And from a short look at the readme it looks like it's using the transmission port 587 which shouldn't be filtered.

Any decent firewall these days is layer 7 aware. The port doesn't make a difference

Blending in with the crowd doesn't work. If you use Chrome on Windows you're part of a very large group and "don't stick out". But it's also very easy to fingerprint so you're also part of the "theturtletalks" group with the size of one.

More details here https://as32590.net/steamcache/

You mean like Matrix or XMPP? They just aren't as ubiquitous as email unfortunately.

At least you can bridge WhatsApp and then use whatever client you like.

how to?

I mean I know that I can google it up but I'm looking for a working example. I found some code in github that is obsolete. Also whatsapp requires phone code and qr scan so looks like it's designed to prevent a server-only bridge.

I got it running with NixOS https://github.com/benjajaja/nixos-rk3588/tree/main

WhatsApp does work, I use it on a daily basis. The bot/bridge makes it easy to log in with the QR code. You need to keep the phone app as you need to open it at least once a month or so.

HMU if you need more info.

thanks!

Yes it does but you can use Tor with other browsers too so it can make sense if you want to support them.

I wouldn't recommend using Tor with anything other than Tor browser because there are so many browser features that will expose you now. If you don't need the Tor browser protections, you probably don't need Tor either.

Fair point but using Tor even if you don't need it, just to put more legit traffic noise in the network is a valid use case.

Given the actual correlations attacks governments have done on Tor traffic, I don't think more traffic moves the needle in any appreciable way. Ultimately the Tor architecture is very vulnerable to timing and correlation attacks (never use something like IRC over Tor), and the kinds of changes that would be needed to mitigate those would probably slow it down past the point of usability.

One could argue, given the limited bandwidth of the Tor network, that by using it when you don't need it, you make the experience for those that do need it worse (looking at you everyone who tries to torrent over tor).

It's only 185.220.100 [0] and 185.220.101 [1] that contain all those relays. Some of the bigger German families work together as "Stiftung Erneuerbare Freiheit" that's why you see a big cluster there. But Tor never uses relays in the same /16 for a circuit so it's not really an issue.

[0] https://metrics.torproject.org/rs.html#search/185.220.100 [1] https://metrics.torproject.org/rs.html#search/185.220.101

Correct. "Stiftung Erneuerbare Freiheit" acts as LIR in charge of the address space, handing out chunks of that space to exit relay operating non-profits for free, but does not operate any Tor infrastructure themselves and has no visibility into the traffic. The cost for us are the RIPE membership fees (approx 2000€/yr).

Source: I'm its director and founder of torservers.net. Usually using a different nick here.