ReputationIP

KO | EN

gitlite — search

#javascript #hacktoberfest #react #llm #golang #go #android #rust #deep-learning #macos #windows #awesome-list #mcp #open-source

(★ 11)

set of bash scripts to get a list of bad reputation IP addresses

ReputationIP 최신버젼 다운로드

최종 버전 다운로드 (.zip)

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# Reputation IP
set of bash scripts that download list of IP address with a bad reputation, from public database/website like: 
- MaxMind GeoIP Anonymous Proxies
- Tor Exit Nodes
- Project Honey Pot Directory of Dictionary Attacker IPs
- WAF.Red API [https://waf.red](https://waf.red)
- more repo coming soon...

very useful for integrate into regular expression or blacklist. It can escape dot (`\.`) and you can sepcify the field separator between each ip (`-s "|"`). The output can be a **list** (one ip per line) or **csv** (with a comma as default separator).

## Scripts and descriptions

Script | Description
------ | ------------
anonymous_proxy.sh | MaxMind GeoIP Anonymous Proxies
TOR_bulk_exit.sh | Tor Exit Nodes
project_honeypot.sh | Project Honey Pot Directory of Dictionary Attacker IPs
waf_red.sh | WAF.Red API User Black-list

## Real Life usage example

#### Drop all Dictionary Attacker IPs from Project Honey Pot Directory:
```sh
./project_honeypot.sh -o list | egrep '[0-9\.]+' | awk '{ print "iptables -A INPUT -s " $1 " -j DROP" }'
```
```sh
iptables -A INPUT -s 85.16.128.242 -j DROP
iptables -A INPUT -s 95.130.11.147 -j DROP
iptables -A INPUT -s 162.248.9.218 -j DROP
iptables -A INPUT -s 95.130.11.178 -j DROP
iptables -A INPUT -s 159.253.1.177 -j DROP
# etc ...
```

#### Find Dictionary Attacker IPs in Nginx access logs
```sh
cat /usr/local/nginx/logs/access.log | egrep '(`./project_honeypot.sh -o csv -e -s "|"`)'
```
```sh
85.16.128.242 - - [26/Nov/2015:12:59:14 +0100] "GET / HTTP/1.0" 200 2461 "-"
95.130.11.147 - - [30/Nov/2015:18:32:09 +0100] "GET / HTTP/1.0" 200 2461 "-"
159.253.1.177 - - [01/Dec/2015:01:14:41 +0100] "GET / HTTP/1.0" 200 2461 "-"
# etc ...
```

#### List all blocked IP Address from your WAF.Red account
Get your WAF.Red black-list using WAF.Red API, more info at [https://waf.red](https://waf.red) 
```sh
./waf_red.sh -o list -u demo@waf.red -p demo
1.2.3.4
1.2.3.5
1.2.3.6
```
CSV output regex
```sh
./waf_red.sh -o csv -e -u demo@waf.red -p demo
1\.2\.3\.4,1\.2\.3\.5,1\.2\.3\.6
```

## Syntax

### anonymous_proxy.sh
Download from maxmind.com a list of 250 Open Proxy. From https://www.maxmind.com/en/proxy-detection-sample-list 
"most used IP addresses in the minFraud network that have been identified by the Proxy Detection service as higher risk."
```
# ./anonymous_proxy.sh -h
+
 Usage ./anonymous_proxy.sh [options]
+
-h	this help
-s	Separator char between each IP
-e	Escape dot for use in regex (ex: 127\.0\.0\.1)
-o	Output format (list or csv).
  	for 'csv' you can specify a separator with -s
  	default: csv
+
```
#### Example anonymous_proxy.sh
```sh
# ./anonymous_proxy.sh -o list -e | more
5\.9\.36\.66
5\.9\.158\.75
5\.28\.62\.85
5\.39\.79\.8
5\.79\.68\.161
5\.79\.74\.233
5\.135\.66\.213
5\.135\.143\.104
5\.135\.158\.101
# etc...
```

```
# ./anonymous_proxy.sh -o csv -s "|"
5.9.36.66|5.9.158.75|5.28.62.85|5.39.79.8|5.79.68.161|5.79.74.233|5.135.66.213|5.135.143.104....
```

### Others scripts
all scripts have the same syntax.

# Contact
```
Andrea (aka theMiddle) Menin
themiddle@waf.red
https://waf.red
```

ReputationIP

ReputationIP 최신버젼 다운로드

오늘의 추천 프로젝트

Was this content helpful?

Recent Feedback

ReputationIP

ReputationIP 최신버젼 다운로드

오늘의 추천 프로젝트

Was this content helpful?

Recent Feedback

Download README