Detect Proxy and Tor exit nodes from an IP in python

Question

I have a database (hadoop) of the users who access my website (their IPs) and i want to check if those users either use proxy networks or the TOR network and block them.

I also want to differentiate between an legitimate proxy and fake proxy. In case of tor i want to block all tor traffic.

I also have request_headers in the database and i can see X-Forwarded-For for some of the records. So that i can extract the forwarded ip and the original one but how to detect this proxy is a legitimate or its a tor ip?

Answer 1

This script can be used to get the list of a list of possible Tor nodes that might contact one of your servers. This is basically a list of tor exit nodes which contacted that ip address : But for your use case this is there : https://check.torproject.org/cgi-bin/TorBulkExitList.py?ip=YOUR_SERVER_IP&port=YOUR_PORT

This is a very raw python snippet that should work for you:

import requests
YOUR_SERVER_IP = '1.1.1.1'
YOUR_SERVER_PORT = '80'
USER_IP = '2.2.2.2'
data = requests.get('https://check.torproject.org/cgi-bin/TorBulkExitList.py?ip=' + YOUR_SERVER_IP + '&port='+ YOUR_SERVER_PORT)
if(data.status_code == 200):
    responsedata = str(data.text)
    ip_lists = responsedata.split('\n')[3:]#1st three lines are comments
    if(USER_IP in ip_lists):
        print("Tor usage detected")
    else:
        print("Not Tor")
else:
    print("Unable to connect . Error code :" + str(r.status_code))

Ideally you should save the data on disk and then query it because:

• This list is updated only after 16hr.
• You cannot query more than 4-5 times in 1hr. (Not really sure about the exact number of times and duration)