Running a Tor Bridge recommends using port 443 and even when running a bridge using a pluggable transport an open (non-transport) bridge port seems to be required.
Assuming someone runs obfs4 and a censored user connects to it. A system like the Great Firewall would probably not be able to find that the user connects to the Tor network by just looking at the traffic, but it could easily scan for the non-pluggable transport on port 443 or a predefined range. These days there are really efficient tools to do such scans on a very large scale. An attacker using a certain rule set to determine whether such an attack is feasible/the use of Tor is likely could reduce the resources required for such an attack.
My question here is whether this is correct and if so whether there are plans to mitigate such an attack.
