dox-relay

This is a vibe-coded experiment, built entirely by an AI agent. It was created to demonstrate how trivially easy it is for a relay operator to track Nostr users — without any effort or sophistication.

Many Nostr clients automatically perform NIP-42 authentication the moment they connect to a relay, without asking the user or even informing them. This relay simply accepted those auth events and logged the pubkey alongside the connecting IP address. That's it. No tricks.

Every row below is a real user whose client silently authenticated to this relay and, in doing so, revealed their identity and their approximate location. A relay could go further — correlating REQ subscription patterns, timing, and follow graphs to build detailed profiles — but blind auto-authentication alone required zero effort to collect all of this.

If you are a client developer: please prompt users before authenticating to unknown relays. NIP-42 exists for legitimate access control, not silent surveillance.