Analyzing TOR-exitnodes for anomalies

[Tim McCormack]

Jan Stolzenburg wrote:
> Hello,
> I don't have Vidalia, so I wasn't able to find out which exit-node I
> used, but I found something really interesting. "wiki.noreply.org"
> and "wiki.ubuntuusers.de" got replaced by
> "http://wiki.noreply.org/frame.aspx?u=http%3a%2f%2flanding.domainsponsor.com%3fa_id%3d1637%26domainname%3dnoreply.org%26adultfilter%3doff%26popunder%3doff&r=SUSPECTED+UNDESIRABLE+BOT"
> and
> "http://wiki.ubuntuusers.de/frame.aspx?u=http%3a%2f%2flanding.domainsponsor.com%3fa_id%3d1637%26domainname%3dubuntuusers.de%26adultfilter%3doff%26popunder%3doff&r=SUSPECTED+UNDESIRABLE+BOT".

I've observed the same thing on as2max.com and freegmailinvites.com.

 - Tim McCormack