Opus 5.5 finds TV-box botnet that took over a third of Tor exits

Sauers@Sauers_

Discovered by Opus 5.5: "On Feb 4, 2026, a flood of relays named TV followed by four digits (TV####) appeared for about 10 hours. At the 13:00 UTC peak, 1 in 3 of all Tor relays was a TV#### relay, and almost all of them were exits, where traffic leaves Tor. They ran on home internet connections, mostly in Argentina and the US, and all had the same setup. That pattern fits hijacked TV boxes. In the same week a botnet of hijacked TV boxes and other home devices flooded I2P, another hidden network, and its operators were reported to be testing Tor as a backup. Tor's directory, the official list from which Tor software picks relays, assigned them almost no traffic and removed them that evening, so Tor users would almost never have gone through them. We found no public report that mentions these relays."