1

One of my websites has been plagued by posts advertising fake dating sites through Tor exit nodes. The Tor project publishes a list of exit nodes but they contain only IPv4 addresses. Is there any way to fetch IPv6 addresses?

migrated from serverfault.com Feb 25 '17 at 23:23

This question came from our site for system and network administrators.

  • 1
    IPv6 is going to make blacklisting kinda impractical. Imagine I run some exit and my provider gives me an v6 /64. I could exit from anywhere in that whole /64 range. Trying to enumerate them remotely is difficult (imperfect) for v4, for v6 in would be practically impossible, never mind having to store them in some distributed list, which is kept up to date. I don't think it's going to be feasible, you'd be better approaching the problem with some other mechanism, e.g. a captcha. – cacahuatl Feb 27 '17 at 3:19
  • I could block your /64, for that matter. There's no difference. – mikhailian Feb 27 '17 at 7:27
  • How do you know and decide what /64's may or may not be exited from? What about the potential collateral damage? – cacahuatl Feb 27 '17 at 10:38
  • Anyway, you'd likely need to update TorDNSEL, see also #16947. – cacahuatl Feb 27 '17 at 10:44
  • @canonizingironize, thanks for the hint to TorDNSEL. – mikhailian Feb 27 '17 at 12:36
2

Blacklisting is a shot-in-a-leg practice: if you truly think that spammers are using just Tor or Darknets - you're wrong. You need to protect your website better with captchas and social network checked logins, not fighting a TCP windmills

  • 1
    I have captcha, honeypot and a couple of tricks under the sleeve. The positioning of the website makes social login unacceptable. And I will mercilessly ban all Tor exit nodes as all Tor users I see as a service provider are malicious ones. Iranian dissidents are not my target audience, though. – mikhailian Feb 27 '17 at 20:22
  • Well, then you parse the consensus data and block around 7k+ IP addresses at the same time... – Alexey Vesnin Feb 27 '17 at 20:24
  • That sounds interesting. I have no clue what consensus data is, but blocking 7K+ addresses is totally feasible even with ipset`. – mikhailian Feb 27 '17 at 20:26
  • 1
    it's a Tor status monitoring scripts you're after - like this one – Alexey Vesnin Feb 27 '17 at 20:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.