Transparency Report Q3 2025

The migration to our own autonomous system (AS) is now largely complete across both internet protocols. In the second quarter we activated our new autonomous system, AS215125:AS-CYBEROLOGY, and began routing the bulk of our IPv6 traffic through our own address blocks. We expanded this integration in the third quarter by adding our IPv4 address space. Consequently, the majority of our IPv4 traffic is now also routed through our own AS. We’re very pleased with the success of this major migration. While we are still actively working to address a few minor network performance issues (which we anticipate resolving in the near future) the overall transition has been smooth and marks a significant operational milestone.

Beyond network routing, we’ve actively pursued our goal of acquiring and deploying new server infrastructure. This strategic expansion will significantly broaden the scope and capacity of our privacy services throughout 2026 and 2027. We’re very enthusiastic about the possibilities this new hardware unlocks, and we will share much more detailed information on these developments in upcoming quarterly updates.

We’ve launched a dedicated donations website at donate.nothingtohide.nl. While this may seem redundant given our existing website, this move is a measure to maintain our core privacy standards. When it comes to our services and websites, we have our own quality and privacy standards. Our main website for example adheres to high standards: it’s fully static, built with only plain HTML/CSS and uses zero JavaScript, frameworks or third-party resources. This minimalist approach makes our website lightweight, which is ideal for users of the Tor Browser. But crucially, it also boosts your privacy and makes the site easier to audit. By avoiding technologies that could theoretically de-anonymize visitors, we ensure a clean, private experience.

For some time, supporters have asked for an easier way to contribute, specifically via credit card or recurring payments. Since we rely on your contributions, we wanted to make these options available. However, these features require dynamic content and a payment provider, which inevitably introduce privacy considerations. To keep our primary website as clean and minimalist as possible, we built a dedicated site just for donations. We chose Mollie as our payment provider because it is more privacy-friendly than alternatives like Stripe. The new donation site itself remains lean, with zero third-party resources/trackers and minimal JavaScript until you are redirected to Mollie’s secure payment page.

This dual-website approach allows us to strike a balance between upholding our strict technological and privacy principles while still making it easy for you to support us with the payment methods you prefer, at the cost of having to maintain two separate websites and possibly some confused visitors. For those interested, we have added information about the privacy impact of this new site in our privacy policy.

The metrics used in this report are rounded extrapolated snapshots of the final day of the quarter, to not give away too much specific information.

1 Requests & orders

As a provider of pass-through anonymity services, Nothing to hide receives messages about network traffic originating from or destined for our networks on a daily basis. While the vast majority of these messages are general notices send by automated systems, some of them contain legitimate complaints, requests and/or (court) orders/subpoenas directed at Nothing to hide.

Below we report on the quarterly amount of these messages we get from judicial authorities (courts, judges, juries), law enforcement agencies (LEA), business entities and natural persons.

2 Service report

2.1 Tor relays

Traffic on the Tor network can fluctuate quite a bit and the below metrics are merely snapshots of a day around the end of the quarter.

Note that for these statistics both incoming and outgoing advertised bandwidth are combined (just like Tor network’s metrics).

2.2 Tor DNS requests

DNS requests on the Tor network are resolved by the Tor exit relays. This means that high capacity Tor exit relays can generate a lot of DNS queries. These queries are being resolved by multiple high capacity DNS recursors.

Do note that we don’t log the contents of DNS queries.

2.3 Tor diversity

One of our major goals is to break the GNU/Linux monoculture currently present on the Tor network. Monocultures in nature are dangerous, as vulnerabilities are held in common across a broad spectrum. In a globally used anonymity network, monocultures can be disastrous.

We make the Tor network stronger and more resilient by running all our relays on FreeBSD. Here we report on our ongoing effort to increase operating system diversity on the Tor network. If any Tor operator reading this is interested in running Tor relays on BSD, please contact us and we will gladly help out.

We added these statistics to this report before our big migration to AS215125, but because of some performance issues on this new network we expect our average traffic in Q4 to be lower than usual. We’re working on it.

2.4 DDoS attacks

Aside from the occasional (big) DDoS attack, it’s relatively quiet in terms of DDoS attacks.