1

One of my websites has been plagued by posts advertising fake dating sites through Tor exit nodes. The Tor project publishes a list of exit nodes but they contain only IPv4 addresses. Is there any way to fetch IPv6 addresses?

Improve this question
8
  • 1
    IPv6 is going to make blacklisting kinda impractical. Imagine I run some exit and my provider gives me an v6 /64. I could exit from anywhere in that whole /64 range. Trying to enumerate them remotely is difficult (imperfect) for v4, for v6 in would be practically impossible, never mind having to store them in some distributed list, which is kept up to date. I don't think it's going to be feasible, you'd be better approaching the problem with some other mechanism, e.g. a captcha.
    – cacahuatl
    Feb 27, 2017 at 3:19
  • I could block your /64, for that matter. There's no difference.
    – mikhailian
    Feb 27, 2017 at 7:27
  • How do you know and decide what /64's may or may not be exited from? What about the potential collateral damage?
    – cacahuatl
    Feb 27, 2017 at 10:38
  • Anyway, you'd likely need to update TorDNSEL, see also #16947.
    – cacahuatl
    Feb 27, 2017 at 10:44
  • @canonizingironize, thanks for the hint to TorDNSEL.
    – mikhailian
    Feb 27, 2017 at 12:36

1 Answer 1

Reset to default
2

Blacklisting is a shot-in-a-leg practice: if you truly think that spammers are using just Tor or Darknets - you're wrong. You need to protect your website better with captchas and social network checked logins, not fighting a TCP windmills

Improve this answer
4
  • 1
    I have captcha, honeypot and a couple of tricks under the sleeve. The positioning of the website makes social login unacceptable. And I will mercilessly ban all Tor exit nodes as all Tor users I see as a service provider are malicious ones. Iranian dissidents are not my target audience, though.
    – mikhailian
    Feb 27, 2017 at 20:22
  • Well, then you parse the consensus data and block around 7k+ IP addresses at the same time...
    – Alexey Vesnin ♦
    Feb 27, 2017 at 20:24
  • That sounds interesting. I have no clue what consensus data is, but blocking 7K+ addresses is totally feasible even with ipset`.
    – mikhailian
    Feb 27, 2017 at 20:26
  • 1
    it's a Tor status monitoring scripts you're after - like this one
    – Alexey Vesnin ♦
    Feb 27, 2017 at 20:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .