feat: Add Tor exit node extraction with separate TorExitNode model (#… by Sumit-ai-dev · Pull Request #728 · intelowlproject/GreedyBear

Sumit-ai-dev · 2026-01-22T17:29:42Z

Description

This PR adds automatic extraction and filtering of Tor exit node IPs to reduce false positives in threat feeds. Tor exit nodes are privacy servers for anonymous browsing, not attackers - but they show up in honeypot logs and get incorrectly flagged as malicious.

Following the same approach as IntelOwl, this fetches the official Tor exit node list from torproject.org and filters them out, just like we do with mass scanners.

What I Built

Created TorExitNode model

Fields: ip_address (unique), added, reason
Separate model for semantic clarity

Added cron job (greedybear/cronjobs/tor_exit_nodes.py)

Downloads the Tor exit node list from https://check.torproject.org/exit-addresses
Validates IP addresses using existing is_valid_ipv4 utility
Stores valid IPs in the database
Updates ip_reputation field for existing IOCs

Built repository layer (greedybear/cronjobs/repositories/tor.py)

get_or_create() method for data access
Follows same pattern as MassScannerRepository and FireHolRepository

Hooked into Celery (get_tor_exit_nodes task in tasks.py)

Scheduled execution via Celery Beat

Wrote comprehensive tests (tests/test_tor.py)

Repository operations (creation, retrieval, no duplicates)
Cron job execution (fetch, validation, error handling)
IOC reputation updates

Notes

Currently handles IPv4 addresses only (what Tor Project publishes). Uses regex-based extraction for consistency with IntelOwl.

Files Changed

New:

greedybear/cronjobs/repositories/tor.py
greedybear/cronjobs/tor_exit_nodes.py
tests/test_tor.py

Modified:

greedybear/models.py - Added TorExitNode model
greedybear/tasks.py - Added get_tor_exit_nodes task
greedybear/cronjobs/repositories/__init__.py - Export TorRepository

Related issues

Closes #547

Type of change

Bug fix (non-breaking change which fixes an issue).
New feature (non-breaking change which adds functionality).
Breaking change (fix or feature that would cause existing functionality to not work as expected).

Checklist

I have read and understood the rules about how to Contribute to this project.
The pull request is for the branch develop.
I have added documentation of the new features.
Linter (Ruff) gave 0 errors. If you have correctly installed pre-commit, it does these checks and adjustments on your behalf.
I have added tests for the feature/bug I solved. All the tests (new and old ones) gave 0 errors.
If changes were made to an existing model/serializer/view, the docs were updated and regenerated (check CONTRIBUTE.md).
If the GUI has been modified:
- I have a provided a screenshot of the result in the PR.
- I have created new frontend tests for the new component or updated existing ones.

…ntelowlproject#547)

regulartim

Nice!

regulartim · 2026-01-23T10:39:43Z

greedybear/tasks.py

+@shared_task()
+def get_tor_exit_nodes():
+    from greedybear.cronjobs.tor_exit_nodes import TorExitNodesCron
+
+    TorExitNodesCron().execute()


I think you forgot to schedule this task in celery.py.

regulartim · 2026-01-23T10:41:38Z

tests/test_tor.py

+from greedybear.cronjobs.tor_exit_nodes import TorExitNodesCron
+
+
+class TestTorRepository(unittest.TestCase):


Please use CustomTestCase as a base class for consistency with other tests.

regulartim · 2026-01-23T10:41:52Z

tests/test_tor.py

+        self.assertFalse(created)
+
+
+class TestTorExitNodesCron(unittest.TestCase):


@regulartim

Thanks for the review! Made both changes: - Switched to CustomTestCase for test consistency - Added weekly Celery Beat schedule (Sundays at 4:30 AM) Addresses feedback from @regulartim

Sumit-ai-dev · 2026-01-23T11:38:11Z

Hey @regulartim!

Thanks for catching those! Both fixed now:

Switched test classes to use CustomTestCase instead of unittest.TestCase
Added the Celery Beat schedule in celery.py

CI is all green ✅. Let me know if you spot anything else!

regulartim

Looks good so far, aside from the lower-case bug. However, there are still things missing for this to work:

a migration file
a registration of the new model in admin.py

regulartim · 2026-01-26T09:38:03Z

greedybear/cronjobs/tor_exit_nodes.py

+
+    def _update_old_ioc(self, ip_address: str):
+        """Update the IP reputation of an existing IOC to mark it as a Tor exit node."""
+        updated = self.ioc_repo.update_ioc_reputation(ip_address, "Tor Exit Node")


Here, "Tor Exit Node" has to be lower case, otherwise the filtering at the API-level won't work, right?

- Added migration file for TorExitNode model (0032) - Fixed case sensitivity issue - changed 'Tor Exit Node' to lowercase for API filtering - Registered TorExitNode in admin panel for easy management

Sumit-ai-dev · 2026-01-26T11:17:34Z

Hey! Thanks for the review - really appreciate the feedback.

I've gone through and addressed all three points:

Migration file - Added 0032_torexitnode.py with proper dependencies.

Case sensitivity - Changed all the "Tor Exit Node" strings to lowercase "tor exit node" across the codebase (models, repository, cron job, tests, migration). This should fix the API filtering issue you mentioned.

Admin registration - TorExitNode is now registered in the admin panel with search by IP address.

All the checks are passing now! Let me know if anything needs tweaking or if you have other suggestions.

regulartim

Nice, thank you!

feat: Add Tor exit node extraction with separate TorExitNode model (i…

aee66b9

…ntelowlproject#547)

regulartim requested changes Jan 23, 2026

View reviewed changes

fix: use CustomTestCase and add task scheduling

3388f48

Thanks for the review! Made both changes: - Switched to CustomTestCase for test consistency - Added weekly Celery Beat schedule (Sundays at 4:30 AM) Addresses feedback from @regulartim

regulartim requested changes Jan 26, 2026

View reviewed changes

fix: address review feedback for tor exit node feature

d8ac8f5

- Added migration file for TorExitNode model (0032) - Fixed case sensitivity issue - changed 'Tor Exit Node' to lowercase for API filtering - Registered TorExitNode in admin panel for easy management

Sumit-ai-dev force-pushed the add-tor-exit-nodes branch from 9f58dc6 to d8ac8f5 Compare January 26, 2026 11:10

regulartim approved these changes Jan 26, 2026

View reviewed changes

regulartim merged commit 4b5ec02 into intelowlproject:develop Jan 26, 2026
4 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat: Add Tor exit node extraction with separate TorExitNode model (#…#728

feat: Add Tor exit node extraction with separate TorExitNode model (#…#728
regulartim merged 3 commits intointelowlproject:developfrom
Sumit-ai-dev:add-tor-exit-nodes

Sumit-ai-dev commented Jan 22, 2026 •

edited

Loading

Uh oh!

regulartim left a comment

Uh oh!

regulartim Jan 23, 2026

Uh oh!

regulartim Jan 23, 2026

Uh oh!

regulartim Jan 23, 2026

Uh oh!

Sumit-ai-dev commented Jan 23, 2026

Uh oh!

regulartim left a comment

Uh oh!

regulartim Jan 26, 2026

Uh oh!

Sumit-ai-dev commented Jan 26, 2026

Uh oh!

regulartim left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

		from greedybear.cronjobs.tor_exit_nodes import TorExitNodesCron


		class TestTorRepository(unittest.TestCase):

		self.assertFalse(created)


		class TestTorExitNodesCron(unittest.TestCase):

Uh oh!

Conversation

Sumit-ai-dev commented Jan 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

What I Built

Notes

Files Changed

Related issues

Type of change

Checklist

Uh oh!

regulartim left a comment

Choose a reason for hiding this comment

Uh oh!

regulartim Jan 23, 2026

Choose a reason for hiding this comment

Uh oh!

regulartim Jan 23, 2026

Choose a reason for hiding this comment

Uh oh!

regulartim Jan 23, 2026

Choose a reason for hiding this comment

Uh oh!

Sumit-ai-dev commented Jan 23, 2026

Uh oh!

regulartim left a comment

Choose a reason for hiding this comment

Uh oh!

regulartim Jan 26, 2026

Choose a reason for hiding this comment

Uh oh!

Sumit-ai-dev commented Jan 26, 2026

Uh oh!

regulartim left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Sumit-ai-dev commented Jan 22, 2026 •

edited

Loading