Suricata detects an unkown TOR activity

i’m using suricata as an IPS
i found this strange connection, i don’t use tor and i didn’t install any tor client or browser, what does this message mean plz:
“ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 698 [**] [Classification: Misc Attack] [Priority: 2]”

Could be your smart phone trying to connect via Zorin Connect.
Have you cross-checked the IP's?

1 Like

i don't have a smartphone

I f you are certain that you do not know the IP address reported above, you can block it:
https://www.cyberciti.biz/faq/how-to-block-an-ip-address-with-ufw-on-ubuntu-linux-server/

2 Likes