1

ADD: ^^^ mmm I don't think it's the same. In that question they talk about a false negative, but judging from the results of my port-scan, and considering that more than 2 weeks passed, it looks like there's no Tor-like service running on them. Therefore this seems to be a legitimate negative, not a false one imho.


A strange issue started happening to me since about 2 weeks ago: I started noticing TBB home screens like this one:


Sorry. You are not using Tor.

The first time I thought it was some sort of synchronization problem between the beginning of activity of a new exit node in the network and its official adding to the Tor directory. So I just reloaded Tor and let it go. But then a few days later it happened another time, with a very-similar-but-different IP that came from the same network I guess (the first was 72.52.91.18, while the other 72.52.91.19). After that, another couple of times it showed up with the same initial IP. So I started being dubious, and I decided to find out what could it be when I had a free moment. So just a few minutes ago I took some info:

  • Their ISP seems to be Hurricane Electric. Its servers are from the same network, located near Livermore (California). Here's my whois: http://paste.ubuntu.com/6254724/
  • I also did a nmap, to verify whether they really had some kind of Tor service running, and it doesn't seem so.

Nmap scan report for 72.52.91.18
Host is up (0.26s latency). Not shown: 994 filtered ports    

PORT    STATE  SERVICE
22/tcp  open   ssh
25/tcp  closed smtp
53/tcp  closed domain
80/tcp  closed http
179/tcp closed bgp
443/tcp closed https

Nmap done: 1 IP address (1 host up) scanned in 387.11 seconds

Nmap scan report for 72.52.91.19
Host is up (0.26s latency). Not shown: 807 closed ports, 191 filtered ports

PORT     STATE SERVICE
22/tcp   open  ssh
8888/tcp open  sun-answerbook

Nmap done: 1 IP address (1 host up) scanned in 117.63 seconds

Hilariously, just after my nmapping, I ran TBB and... there was it again, same IP!
So I made a screenshot and decided to share it with you.

What do you think?

2

1 Answer 1

3

You can use ExoneraTor to find out if a particular IP was running a Tor relay at a particular time. For example, according to ExoneraTor 72.52.91.19 was running an exit node on 2013-10-13. This lends support to the theory that the check error you saw may have been a false negative.

1
  • Sorry but I have 2 concerns. 1) The last time it happened was exactly after my port-scan, that's about 18hours ago - that's where the screenshot comes from - and ExoneraTor tells it wasn't running at that time. 2) Why an added exit-node that's pretty unstable (alternatively up and down within very short intervals) gains so quickly the "quality score" needed to become part of a circuit?
    – MrX
    Commented Oct 18, 2013 at 22:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .