Geoloc Tor nodes

tor2geoipcsv.py

#!/usr/bin/python

import os
import re
import GeoIP
import csv
import urllib2

# Update maxmind databases:
os.system('wget -N http://geolite.maxmind.com/download/geoip/database/GeoLiteCountry/GeoIP.dat.gz')
os.system('gunzip -c GeoIP.dat.gz > GeoIP.dat')
os.system('wget -N http://geolite.maxmind.com/download/geoip/database/GeoLiteCity.dat.gz')
os.system('gunzip -c GeoLiteCity.dat.gz > GeoLiteCity.dat')
os.system('wget -N http://download.maxmind.com/download/geoip/database/asnum/GeoIPASNum.dat.gz')
os.system('gunzip -c GeoIPASNum.dat.gz > GeoIPASNum.dat')
# otherwise change the path
gi = GeoIP.open("GeoIP.dat",GeoIP.GEOIP_STANDARD)
giCity = GeoIP.open("GeoLiteCity.dat",GeoIP.GEOIP_STANDARD)
giASN = GeoIP.open('GeoIPASNum.dat',GeoIP.GEOIP_STANDARD)
# use UNICODE
gi.set_charset(GeoIP.GEOIP_CHARSET_UTF8);
giCity.set_charset(GeoIP.GEOIP_CHARSET_UTF8);
giASN.set_charset(GeoIP.GEOIP_CHARSET_UTF8);
# Get the data from the URL
#d = feedparser.parse('http://malwared.malwaremustdie.org/rss_ssh.php')
url = "https://torstatus.blutmagie.de/ip_list_all.php/Tor_ip_list_ALL.csv"
f = urllib2.urlopen(url)
# Write down to a csv so we can load with R
with open('iplist.csv', 'wb') as csvfile:
    writer = csv.writer(csvfile,quotechar='\'')

    for ip in f:

        ip  = str(ip).rstrip()
        org = giASN.org_by_addr(ip)
        if org is not None:
            match = re.search("AS(\d+)",org)
            if match:
                asn = match.group(1)

        gir = giCity.record_by_addr(ip)
        if gir is not None:
            city = gir['city']
            longitude = gir['longitude']
            latitude = gir['latitude']
            country = gir['country_name']
            ccode = gir['country_code']

        row = [ip,ccode,country,asn,org,city,longitude,latitude]
        writer.writerow(row)

csvfile.close()