content: TOR vulnerability found? Today I decided to monitor my network traffic with Wireshark. I found out that my machine is communicating with a machine whose IP is 37.187.22.131. The protocol they are using is IMAP. I don't use email. The IP in question was the entry node my TorBrowser used. When I shut down my TorBrowser, the communication stopped. I downloaded and installed another copy of TorBrowser. That did not have the same issue. Then I wrote EntryNodes 37.187.22.131 into torrc. As a result, the second browser started to communicate in IMAP as well. Finally, I installed TorBrowser on another computer that is running Devuan. Again, when the entry point is something else, nothing weird seems to be going on. But when I use the EntryNodes trick, the IMAP communication begins again. Is this normal? 37.187.22.131 is the only entry node, that I know of, which has this issue. Can anyone else reproduce this? The only explanations that I can think of are: This is part of the protocol (unlikely, because other entry nodes do not exhibit this behaviour) There is a vulnerability in TorBrowser (or Tor) that the entry node in question is taking advantage of, and other people can confirm this. There is a vulberability in TorBrowser (or Tor) that the entry node in question is taking advantage of, but I am the only one who is affected by it, meaning that I am under a targeted surveillance attack. Please not, that this is not a case of the entry node just listening to me or sending me messages. My machine is sending messages back as well. They both use the IMAP protocol, according to Wireshark. I don't think this is possible unless there is a vulnerability in Tor/TorBrowser. Here's an example of part of Wireshark output: https://imgur.com/68A3hmf. If anyone can explain or reproduce this phenomenon, I would be very interested.