1

I was asleep while Orbot was up and the following lines came up. I'm worried because I've never encountered words like totallyninja, spying, etc. from Orbot before so I'm wondering what they mean: 

Circuit (1959) BUILT: TotallyNinja > gelbgrau > PrivacyRepublic0001
178.32.181.96 France (OVH SAS)
Circuit (1956) CLOSED: spying
Circuit (1958) CLOSED: TotallyNinja
No network connectivity. Putting Tor to sleep…
NOTICE: Closing no-longer-configured Transparent pf/netfilter listener on 127.0.0.1:9040 
NOTICE: Closing no-longer-configured Socks listener on 127.0.0.1:9050 
NOTICE: Closing no-longer-configured DNS listener on 127.0.0.1:5400 
NOTICE: DisableNetwork is set. Tor will not make or accept non-control network connections. Shutting down all existing connections. 
NOTICE: Closing old Transparent pf/netfilter listener on 127.0.0.1:9040 
NOTICE: Closing old Socks listener on 127.0.0.1:9050 
NOTICE: Closing old DNS listener on 127.0.0.1:5400 
Circuit (1955) CLOSED: TotallyNinja > pyrignis > Unnamed
Circuit (1959) CLOSED: TotallyNinja > gelbgrau > PrivacyRepublic0001
Circuit (1954) CLOSED: TotallyNinja > algorithm > marylou2
Circuit (1934) CLOSED: DipulseFR8 > interrupted > AquaRayTerminus
NOTICE: Delaying directory fetches: DisableNetwork is set. 
Network connectivity is good. Waking Tor up…
NOTICE: Opening Socks listener on 127.0.0.1:9050 
NOTICE: Opening DNS listener on 127.0.0.1:5400 
NOTICE: Opening Transparent pf/netfilter listener on 127.0.0.1:9040 
Circuit (1962) BUILT: spying > Unnamed > Cloud
NOTICE: Tor has successfully opened a circuit. Looks like client functionality is working. 
NOTICE: Tor has successfully opened a circuit. Looks like client functionality is working. 
Circuit (1963) BUILT: spying > randomcitizen > Unnamed
5.135.158.101 France (OVH SAS)
46.105.100.149 France (OVH SAS)
Circuit (1962) CLOSED: spying > Unnamed > Cloud
Circuit (1963) CLOSED: spying > randomcitizen > Unnamed
No network connectivity. Putting Tor to sleep…
NOTICE: Closing no-longer-configured Transparent pf/netfilter listener on 127.0.0.1:9040 
NOTICE: Closing no-longer-configured Socks listener on 127.0.0.1:9050 
NOTICE: Closing no-longer-configured DNS listener on 127.0.0.1:5400 
NOTICE: DisableNetwork is set. Tor will not make or accept non-control network connections. Shutting down all existing connections. 
NOTICE: Closing old Transparent pf/netfilter listener on 127.0.0.1:9040 
NOTICE: Closing old Socks listener on 127.0.0.1:9050 
NOTICE: Closing old DNS listener on 127.0.0.1:5400 
NOTICE: Delaying directory fetches: DisableNetwork is set. 
Network connectivity is good. Waking Tor up…
NOTICE: Opening Socks listener on 127.0.0.1:9050 
NOTICE: Opening DNS listener on 127.0.0.1:5400 
NOTICE: Opening Transparent pf/netfilter listener on 127.0.0.1:9040 
Circuit (1968) BUILT: CatRelay > esgibteinenweg > wommelator
NOTICE: Tor has successfully opened a circuit. Looks like client functionality is working. 
NOTICE: Tor has successfully opened a circuit. Looks like client functionality is working. 
Circuit (1967) BUILT: CatRelay > Ramsgate > PrivacyRepublic0001

Can someone explain to me what transpired at the time?

Thanks in advance!

Improve this question
3
  • 1
    No network connectivity. Putting Tor to sleep… this is an option you can disable in the settings, no network usage means tor sleeps, saves battery. – cacahuatl Oct 19 '16 at 10:35
  • 2
    Also those words are the names of relays: TotallyNinja, spying, etc. – cacahuatl Oct 19 '16 at 11:26
  • I'm not sure exactly how this works. Do you let this run so you're harder to spy on or hacked? – Amanda S Owens Mar 9 '18 at 23:50
2

Those are the nicknames of the relays that were in your circuit; you can go look them up on Atlas and see information on them, which is kinda cool.

Since Orbot is running on a phone, it will shut down during periods of inactivity and reconnect later. This is pretty common, and not anything you should be worried about.

Improve this answer
-2

Dude your being hacked! What kind of shit do you look at? Look for torrc.custom in the command line along with app_data/bin after trouble bootstrapping. The transperent pf/netfilter listening on your ports means a government entity is redirecting your Internet traffic and http tunnels do the same. Look for the torrc.custom along with the file address and search it in your files and you'll see someone edited your files to redirect traffic to government controlled nodes and netfilter content. If it is a hacker we'll both are bad it's bad. You have a lot of personal info on your phone.

Improve this answer
1

Not the answer you're looking for? Browse other questions tagged or ask your own question.