[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
Re: Analyzing TOR-exitnodes for anomalies
Hello,
I don't have Vidalia, so I wasn't able to find out which exit-node I
used, but I found something really interesting. "wiki.noreply.org"
and "wiki.ubuntuusers.de" got replaced by
"http://wiki.noreply.org/frame.aspx?u=http%3a%2f%2flanding.domainsponsor.com%3fa_id%3d1637%26domainname%3dnoreply.org%26adultfilter%3doff%26popunder%3doff&r=SUSPECTED+UNDESIRABLE+BOT";
and
"http://wiki.ubuntuusers.de/frame.aspx?u=http%3a%2f%2flanding.domainsponsor.com%3fa_id%3d1637%26domainname%3dubuntuusers.de%26adultfilter%3doff%26popunder%3doff&r=SUSPECTED+UNDESIRABLE+BOT";.
I just saw a empty page, but the sourcecode was:
---------------------------
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Frameset//EN">
<html xmlns="http://www.w3.org/1999/xhtml"; >
<head><script>function
PrivoxyWindowOpen(){return(null);}</script><title>
ubuntuusers.de
</title></head>
<frameset id="FrameSet">
<frame name='main'
src='http://landing.domainsponsor.com?a_id=1637&domainname=ubuntuusers.de&adultfilter=off&popunder=off'
scrolling='no' frameborder='0' marginwidth='0' marginheight='0'
noresize='noresize' />
<noframes>
This page requires frames.
</noframes>
</frameset>
<script>function PrivoxyWindowOpen(a, b, c){return(window.open(a, b,
c));}</script></html>
---------------------
Because I use NoScript with Firefox it was an empty page for me. But
the page "forum.ubuntuusers.de", "www.ubuntuusers.de" and
"www.noreply.org" weren't modified in any (visible) way. Some more
tests: https to the corrupted pages resulted in the 404 error. Going
to "www." instead of "wiki." resulted in the normal pages. And after
a while, I got advertising instead of empty pages. The URL was no
longer changed but exactly what I typed in("http://wiki.noreply.org";
and "http://wiki.noreply.org";). The site for noreply.org had
advertising fo the keywords "homes, for, sale, apartments, dating,
services, chat, rooms, airline, tickets" and the one for ubuntuusers
with the keywords "ubuntu, dedicated, linux, server, training,
operating, system, fedora, web, hosting". My Firefox made all
DNS-Requests through TOR. After a while, "wiki.noreply.org" appeared
normal but "wiki.ubuntuusers.de" was still advertising for a while.
What information are important for you to figure out what's going
on? (If it happens again)
Jan Stolzenburg