When I start sys-whonix and open nyx, it immediately displays circuits with more than one middle node. As far as I know this indicates connections to hidden services, as connections to clearnet always go over three nodes with one middle one.
Starting the Tor service in other AppVMs only opens circuits with one middle node initially and I also used to have this behavior when I ran Qubes 4.0.1. This changed with 4.0.3 where I enabled template updates to always go over Tor. So I suspect sys-whonix to connect to some hidden service for updates. Is this correct?
If this really comes from the update mechanism, why do these circuits still get opened, when I have disabled all automatic updates in my global settings?
If it is unrelated to updates, what’s the reason for these circuits being opened now?
Thank you for all your efforts btw.