Re: redirect to meagpass.net while using Tor

To: or-talk@xxxxxxxxxxxxx

Subject: Re: redirect to meagpass.net while using Tor

From: John Brooks <special@xxxxxxxxxxxxxxxx>

Date: Tue, 13 Jan 2009 13:32:53 -0700

Delivered-to: archiver@xxxxxxxx

Delivered-to: or-talk-outgoing@xxxxxxxx

Delivered-to: or-talk@xxxxxxxx

Delivery-date: Tue, 13 Jan 2009 15:33:02 -0500

Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:sender:received:in-reply-to :references:date:x-google-sender-auth:message-id:subject:from:to :content-type; bh=43Cur4VhLbbsjSsW7kNKBDJhdGkceBqOUbsiVlUx9XA=; b=SV/4yTGTNJ5ygAiJ+4plW/T9AgBxPsV2Ww46QRGTbNKq430jTIhVUrdyf5sz120sEM DDxIjmOFBK8Kh+AlFpJ1k1waf9z7XBNAzDvZSn6IMXN/cVawR3gCUhGMcuzRsCY2J0Fc uQf+OWkhuXDgoSRxkbyHYra/euMxp+ZcezTD0=

Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:sender:in-reply-to:references:date :x-google-sender-auth:message-id:subject:from:to:content-type; b=oIEmBQ0U8+JOWtKTZZKiFndqmU1WCkgm87+SgxZkn/ZHx1sR4n1oJaDLxlnHMIotgl NOURFQzPBhtjuXLv9RIw4FMiFdxXLV9xwuvFhrjd6C61a65NJNPudnMamDKKdmy764zn eTZj5JLqAJ9ukFZKJR320KedIdD1vcE6rsb6Q=

In-reply-to: <Pine.BSO.4.21.0901131511060.30782-100000@xxxxxxxxxxxxx>

References: <200901131510.12860.praedor@xxxxxxxxx> <Pine.BSO.4.21.0901131511060.30782-100000@xxxxxxxxxxxxx>

Reply-to: or-talk@xxxxxxxxxxxxx

Sender: owner-or-talk@xxxxxxxxxxxxx

We haven't heard any reports of this problem prior to this thread (indicating that it's a fairly new node), and quite a few people so far have reported it - which makes me think it might be a pretty high bandwidth node (and subsequently more likely to get lots of traffic); so, my theory is that there is a low-uptime high bandwidth node involved here.

So, I started testing google.com exiting with various high-bandwidth exit nodes that have very little uptime, and found a hit: 'apple' (2329 86CD 9605 56CD 8053 CBEC 47C1 8908 2B34 EF09) and seen at http://trunk.torstatus.kgprog.com/router_detail.php?FP=232986cd960556cd8053cbec47c189082b34ef09 is redirecting my traffic to the same megapass.net location. There may be others, but this is probably the one you've all seen. Can we get the authorities to flag that?

For the record, I exited successfully with desync, kyirong, whistlersmother, digineol, kallio, and dumboo; these are probably okay.

- John Brooks

On Tue, Jan 13, 2009 at 1:11 PM, Michael G. Reed <reed@xxxxxxxx> wrote:

On Tue, 13 Jan 2009, Praedor Atrebates wrote:
|> On Tuesday 13 January 2009 14:58:19 Adlesshaven wrote:
|> > I was redirected on several slashdot pages I was trying to view.
|> >
|>
|> Wait...you anonymously browse slashdot?
|>
|> Why?

His tinfoil hat is obviously not good enough :)

-Michael