Suricata detects an unkown TOR activity

i’m using suricata as an IPS
i found this strange connection, i don’t use tor and i didn’t install any tor client or browser, what does this message mean plz:
“ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 698 [**] [Classification: Misc Attack] [Priority: 2]”

Could be your smart phone trying to connect via Zorin Connect.
Have you cross-checked the IP's?

1 Like

i don't have a smartphone

I f you are certain that you do not know the IP address reported above, you can block it:


This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.