1

A TOR node http://85.93.218.204/ was used for an online scam and more than 20 falilies were involved.

How can we uncover identifiable information (such as IP addresses, devices and etc) of these abuser(s) who used the network so we could proceed with a lawsuit?

Thanks.

Improve this question
2
  • 4
    You can't, it's an anonymity network. Have a read of the overview and the abuse FAQ.
    – cacahuatl
    Commented Aug 8, 2016 at 16:58
  • 1
    As mentioned and implied, since it's a anonymity network, the Tor project and Tor relay operators (very probably) doesn't store identifiable information that you want. Unless the ISP behind that exit node was working with the police or a intelligence agency and has such information you want, just a guess. Does your website or service explicitly stores identifiable information regarding these abusers in your servers? If not, the only things you could do right now, that I could think of, is to set up defenses against future similar abuses and provide some reimbursement for the scam victims.
    – m894v5n74v539nm8
    Commented Sep 5, 2016 at 5:24

2 Answers 2

Reset to default
1

No. Tor is anonymous network. Everyone who use it is anonymous. But you can prevent this attack from happening in the future.

Quoting best answer from Is it possible to block Tor users?:

Tor is much easier to block than other open proxies since the list of exit IP addresses is known and published. Read the answer at https://www.torproject.org/docs/faq-abuse.html.en#Bans and if you still want to block users from accessing your site you could use https://www.torproject.org/projects/tordnsel.html.en or the Bulk Exit List exporting tool.

If you use the Bulk Exit List exporting tool be sure to get a fresh list often and expire the old blocks since the list of IP addresses change.

Best example of this is Wikipedia.
Wikipedia don't allow to edit or create any new page while you are using Tor and not being logged-in.

Improve this answer
0

It's a mass-fail situation you have here, actually. And here is "why" and "what to do":

  • The user identification Impossible. It's an anonymous network. And the Exit node operator is not responsible for this actions either: ther's no mechanism to control the users using it. And it's totally right! Read downstrings - why
  • The EPIC FAIL of your case You're lacking of an authentification mechanisms properly applied to your task. What you should do: if it's critical to you to personalize your user to his personal data enough to send a lawsuit to him, and it seems to be so if you're asking your question - use a 2-factor authentication. Or 2F+biometrics. If you're rocking the login+password stone-age auth schema in case of person-sensitive info/service - no wonder that you can not achieve your goal. Even more: using a clearnet bad things investigation you'll have to prove that it was actually the person you're suing, or you will be in trouble.
  • How to deal with Darknets A censorship-resistant anonymous transports like Tor and I2P are your best friends, and no, I'm not kidding! If you have an appropriately-applied authentication mechanism on your website/system - darknets are eliminating some network hijacking risks for you with no extra cost, actually.
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .