ADD: ^^^ mmm I don't think it's the same. In that question they talk about a false negative, but judging from the results of my port-scan, and considering that more than 2 weeks passed, it looks like there's no Tor-like service running on them. Therefore this seems to be a legitimate negative, not a false one imho.
A strange issue started happening to me since about 2 weeks ago:
I started noticing TBB home screens like this one:
The first time I thought it was some sort of synchronization problem between the beginning of activity of a new exit node in the network and its official adding to the Tor directory. So I just reloaded Tor and let it go. But then a few days later it happened another time, with a very-similar-but-different IP that came from the same network I guess (the first was 72.52.91.18, while the other 72.52.91.19). After that, another couple of times it showed up with the same initial IP. So I started being dubious, and I decided to find out what could it be when I had a free moment. So just a few minutes ago I took some info:
- Their ISP seems to be Hurricane Electric. Its servers are from the same network, located near Livermore (California). Here's my whois: http://paste.ubuntu.com/6254724/
- I also did a nmap, to verify whether they really had some kind of Tor service running, and it doesn't seem so.
Nmap scan report for 72.52.91.18
Host is up (0.26s latency). Not shown: 994 filtered ports
PORT STATE SERVICE
22/tcp open ssh
25/tcp closed smtp
53/tcp closed domain
80/tcp closed http
179/tcp closed bgp
443/tcp closed https
Nmap done: 1 IP address (1 host up) scanned in 387.11 seconds
Nmap scan report for 72.52.91.19
Host is up (0.26s latency). Not shown: 807 closed ports, 191 filtered ports
PORT STATE SERVICE
22/tcp open ssh
8888/tcp open sun-answerbook
Nmap done: 1 IP address (1 host up) scanned in 117.63 seconds
Hilariously, just after my nmapping, I ran TBB and... there was it again, same IP!
So I made a screenshot and decided to share it with you.
What do you think?
