Banners injected in web pages at exit nodes TRHCourtney*

Alexander Cherepanov cherepan at
Tue Jun 2 10:52:18 UTC 2009


Just stumbled upon a banner injected in html at tor exit node.
Nodes in question:

  router TRHCourtney01 443 0 9030
  router TRHCourtney02 443 0 9030
  router TRHCourtney03 443 0 9030
  router TRHCourtney04 443 0 9030
  router TRHCourtney05 443 0 9030
  router TRHCourtney06 443 0 9030
  router TRHCourtney07 443 0 9030
  router TRHCourtney08 443 0 9030
  router TRHCourtney09 443 0 9030
  router TRHCourtney10 443 0 9030
  contact Courtney TRH <courtney at>

All of them inject a piece of html at end of web pages. Text under 
banner reads:

  Courtney TOR/VPN & Wifi Exit Node :: Usage subject to Terms and 
  Conditions/Acceptable Use Policy :: Want to advertise here? Contact 

Check for yourself: .

Some more concerns. Page contains:

  WARNING: The TOR Exit Node must *not* be used for illegal means. 
  Connection and session logs are kept and *will* be forwarded onto 
  the police in the event of an abuse report

There is no family set for these nodes in descriptors.

Port 110 (POP3) accepted in exit policy but not port 995 (POP3/SSL).

Just to let you know.

Alexander Cherepanov

More information about the tor-talk mailing list