bzhn / ufw2tgchan Goto Github PK

Report most active IPs in the list to abuseipdb.com.

Add a list with IPs subnets.
Use indentation for ip, ports and subnets addresses, so the statistics will look more pretty.
Write how many ports and IPs are not in the list of pingers

Use redis to store info about every port that has been accessed and info about how many times it happened.
Send the message like below every day:

This day there were 1845 tries to ping the server. Was accessed 548 uniq ports.
The leaderboard of the ports by time of accesses is following:
22 - 358 times
80 - 62 times
3697 - 20 times

Recorded 437 uniq ip addresses.
Leaderboard by number of pings is the following:
89.228.165.249 - 1103 times
61.137.173.36 - 359 times
123.214.175.178 - 43 times

Allow user to add tags in the config file.
The format can be following:

tags:
  6379: redis
  22: ssh
  80: http
  443: https

Then the bot will check if the pinged port is in the list and will add a tag, #ssh e. g. if the port is 22.

This can help search through logs.

Also you can send a tag #vital instead of alert with exclamations marks at the start of the message.