Hi,
My Firewall is logging SSH attempts to a Tor’s exit node IP, according to https://whatismyipaddress.com/ip/66.183.173.29
Anyone have an idea on why is this happening? What can it mean?
are you sure thats not a false positive.
Maybe its detecting bitcoin going through Tor which is expected behavior.
The starting port 56572 and going through the localhost though the tor network and out the exit node and on to port 8333 on the remote bitcoin node.
This is how clearnet connection are sent through Tor.
Try turning that option off in the bitcoin advanced settings and see if it clears.
I suspect its a false flag on snort
Hi,
Can you elaborate a little bit more on why my node would be having a connection to a Tor exit node on port 22?
I am not so acquainted on how that communication goes.