{"action":"opened","issue":{"url":"https://api.github.com/repos/ikoniaris/kippo-graph/issues/39","labels_url":"https://api.github.com/repos/ikoniaris/kippo-graph/issues/39/labels{/name}","comments_url":"https://api.github.com/repos/ikoniaris/kippo-graph/issues/39/comments","events_url":"https://api.github.com/repos/ikoniaris/kippo-graph/issues/39/events","html_url":"https://github.com/ikoniaris/kippo-graph/issues/39","id":94163440,"number":39,"title":"KIppo TOR check","user":{"login":"ikoniaris","id":952610,"avatar_url":"https://avatars.githubusercontent.com/u/952610?v=3","gravatar_id":"","url":"https://api.github.com/users/ikoniaris","html_url":"https://github.com/ikoniaris","followers_url":"https://api.github.com/users/ikoniaris/followers","following_url":"https://api.github.com/users/ikoniaris/following{/other_user}","gists_url":"https://api.github.com/users/ikoniaris/gists{/gist_id}","starred_url":"https://api.github.com/users/ikoniaris/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ikoniaris/subscriptions","organizations_url":"https://api.github.com/users/ikoniaris/orgs","repos_url":"https://api.github.com/users/ikoniaris/repos","events_url":"https://api.github.com/users/ikoniaris/events{/privacy}","received_events_url":"https://api.github.com/users/ikoniaris/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-07-09T22:07:02Z","updated_at":"2015-07-09T22:07:02Z","closed_at":null,"body":"@wirehack7 told me that:\r\n\r\nThe TOR check to only check for 8.8.8.8 is not a good idea. As TOR\r\nproject says not every exit node is able to access a individual IP. To\r\ncheck if an IP is really an exit node you need to check that certain IP\r\nvia the TOR check CGI. So for example 76.8.9.10 can not access every TOR\r\nexit node which can access 8.8.8.8. So you need to check if TOR exit\r\nnodes can access 76.8.9.10 on 22.\r\n\r\nSo it needs a script that maybe download every 24h the TOR.txt from the\r\nTOR cgi for the honeypot IP on 22 (or maybe other port if user runs it\r\non other port) to get a proper list.\r\n\r\nThe DNS check I mentioned is working in that way that TOR exit notes are\r\nalways 127.0.0.2 which can access the IP of the script. This is done via\r\nthe DNS name. Problem here is, we need to check if mass request works\r\nwithout bans.\r\n\r\nWhen I have time I will test, or maybe you test that way. Otherwise it\r\nhas to be downloaded via indivual IP to get a \"real\" list of IP's which\r\nare able to access the own IP."}}