Re: Analyzing TOR-exitnodes for anomalies

[Claude LaFrenière <climenole@xxxxxxxxx>]

Hi  *Stephen*   :

> Greetings!
> 
> Been experiencing this particular issue since Sunday & following the topic here.
> 
> From 05-Oct:
> 
> exiting from hotmail account
> 
> redirected link: http://g.msn.com/frame.aspx?u=http%3a%2f%2flanding.domainsponsor.com%3fa_id%3d1637%26domainname%3dmsn.com%26adultfilter%3doff%26popunder%3doff&r=SUSPECTED+UNDESIRABLE+BOT
> 
> tor exit node: whistlersmother
> 
> First notice this problem on sunday when the clusty homepage was transformed with porno-style images & also had the same catch phrase "what you need, when you need it". Unfortunately didn't note the re-directed url on that occassion. 
> 
> I'm quite happy to report further examples as & when they occur. Please, if there is any other technical data I can send with these reports let me know what to include (if that's useful).

Hmmm... I had this problem with Whistlemother exit node and this site: http://www.iamaphex.net 
with the same "frame.aspx?u=http%3a%2f%2flanding.domainsponsor.com "blah blah blah" filter ... =SUSPECTED+UNDESIRABLE+BOT"

My hypothesis was a "filter" used by Web sites hosting service.
But now you find the same "frame" with Hotmail...

*Therefore my hypothesis was wrong*  

Did this comes from this exit node?
From the DNS server (local or remote) of this exit node?
From some nodes between?
Or what ?

I have no idea for the moment.
May be Alexander W. Janssen have an idea?

Thank you Stephen to help us to fix this problem.

Best regards,
-- 
Claude LaFrenière