1

ADD: ^^^ mmm I don't think it's the same. In that question they talk about a false negative, but judging from the results of my port-scan, and considering that more than 2 weeks passed, it looks like there's no Tor-like service running on them. Therefore this seems to be a legitimate negative, not a false one imho.


A strange issue started happening to me since about 2 weeks ago: I started noticing TBB home screens like this one:


Sorry. You are not using Tor.

The first time I thought it was some sort of synchronization problem between the beginning of activity of a new exit node in the network and its official adding to the Tor directory. So I just reloaded Tor and let it go. But then a few days later it happened another time, with a very-similar-but-different IP that came from the same network I guess (the first was 72.52.91.18, while the other 72.52.91.19). After that, another couple of times it showed up with the same initial IP. So I started being dubious, and I decided to find out what could it be when I had a free moment. So just a few minutes ago I took some info:

  • Their ISP seems to be Hurricane Electric. Its servers are from the same network, located near Livermore (California). Here's my whois: http://paste.ubuntu.com/6254724/
  • I also did a nmap, to verify whether they really had some kind of Tor service running, and it doesn't seem so.

Nmap scan report for 72.52.91.18
Host is up (0.26s latency). Not shown: 994 filtered ports    

PORT    STATE  SERVICE
22/tcp  open   ssh
25/tcp  closed smtp
53/tcp  closed domain
80/tcp  closed http
179/tcp closed bgp
443/tcp closed https

Nmap done: 1 IP address (1 host up) scanned in 387.11 seconds

Nmap scan report for 72.52.91.19
Host is up (0.26s latency). Not shown: 807 closed ports, 191 filtered ports

PORT     STATE SERVICE
22/tcp   open  ssh
8888/tcp open  sun-answerbook

Nmap done: 1 IP address (1 host up) scanned in 117.63 seconds

Hilariously, just after my nmapping, I ran TBB and... there was it again, same IP!
So I made a screenshot and decided to share it with you.

What do you think?

2

1 Answer 1

3

You can use ExoneraTor to find out if a particular IP was running a Tor relay at a particular time. For example, according to ExoneraTor 72.52.91.19 was running an exit node on 2013-10-13. This lends support to the theory that the check error you saw may have been a false negative.

1
  • Sorry but I have 2 concerns. 1) The last time it happened was exactly after my port-scan, that's about 18hours ago - that's where the screenshot comes from - and ExoneraTor tells it wasn't running at that time. 2) Why an added exit-node that's pretty unstable (alternatively up and down within very short intervals) gains so quickly the "quality score" needed to become part of a circuit?
    – MrX
    Oct 18, 2013 at 22:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.