Tor detection

[untitlese5566]

It would be potentially useful if Anubis could detect Tor users and take actions based on that. The list of exit nodes is public; see https://support.torproject.org/abuse/i-want-to-ban-tor/. Since Tor is slow, AI scrapers are unlikely to use it; thus, Tor users could be given easier challenges or even be exempt (especially as many Tor Browser users disable JavaScript). Or, if a service is receiving bot abuse from Tor, they could be given harder challenges.

[guest20]

How do you get on the list of tor exit nodes, and what stops an AI crawler running an exit node just to get on the list?

[untitlese5566]

I hadn't considered that scrapers could just run exit nodes on their proxies and pretend their scraping is coming from Tor. However, I believe it is unlikely that scrapers would go to the effort of running exit nodes just to bypass Anubis when they could just pretend to be some RSS reader or another client without the string "Mozilla" in their user agent. Since Tor exit nodes frequently have low IP reputation scores (just try and search Google while connected to Tor - CAPTCHAs galore!), they would have to dedicate IPs to the few sites which both use Anubis and also unblock Tor, and not to mention that website owners could just block those few abusive exit nodes. Even still, this feature would still be useful for those who want to give Tor harder challenges instead. As for how they compile this list of exit nodes, I have no idea.