@parityboy: It only happens on cryptostorm. But for me that sounds like an DNS error. On the other hand: If you use the same DNS settings on every exit node it can't be DNS...
I got severals answers from support yesterday (Thanks for the short response time!) but I was too tired to boot up the pc, cram out the password and post here. Sorry
I'll just quote what support says:
Indeed, someone's triggering our alarms by doing penetration attempts via cantus:
So we're trying to find a way to turn off the alarm without opening up an attack surface. Ah, the joys of the internet.
I think there is nothing to add other than a big
and several facepalms towards that sucker!