title: Possible infection through the tor network
body: <p>After initializing the tor network service I have seen that there was a connection established to the IP 131.188.40.188 to port 11180.
  I did a scan with nmap and the result was as follows:</p>
  <p>There was an openssh service on that port, and I was connected to it.</p>
  <p>After seeing that I proceeded to format the computer</p>
  <p>After formatting the computer and reinstalling the tor services, I had the following connections open:</p>
  <p><a href="https://i.stack.imgur.com/EJ25F.png" rel="nofollow noreferrer">open tor ports after formatting computer</a></p>
  <p>If I stop the tor service, all connections are closed.</p>
  <p>The question is:
  Is ssh connection to IP 131.188.40.188 normal in tor or should I be worried about possible infection?</p>
  <p>Thank you very much to all !</p>
  <p>EDIT:
  I just checked that nmap currently shows that the current port status is unknown. The state at the time I had an established connection was an Ubuntu openssh. I can't upload a screenshot of that since, after suspecting a possible infection, I formatted the computer.</p>