Re: Analyzing TOR-exitnodes for anomalies

[Tim McCormack <basalganglia@xxxxxxxxxxxxxxx>]

bagelcat wrote:
> ok i have played now for more than an half hour with nonsense
> domainnames. every time the connection goes through an exit node located
> in texas, one time in the state new york and one time in denver i have
> got the advertising page.

I remember something about a major DNS server that was abusing its power
and redirecting requests for nonexistent domains to advertising pages.

Also, ISPs sometimes redirect bad requests:

http://blogs.earthlink.net/2006/08/handling_dead_domains_1.php

..and get lots of flak for it. (Not nearly enough, I say!)

I also came across a note that ISPs may be randomly redirecting requests
for existing sites to domainsponsor.com in a bid to up their profits:

http://www.infosyssec.com/forum/viewtopic.php?p=11395&sid=436f73bb85d55318bf53f7ff80fc64e9

 - Tim McCormack