Find out who keeps attacking your server
git clone https://github.com/TotallyMonica/attacker_lookup
pip install -r requirements.txt
python3 identify.py
-
--log
/--log-file
: specify a log file to be used- Required
- So long as it has IP addresses within it it should work, tested with
journalctl
logs - Usage:
--log journalctl.log
-
--ipinfo-token
: Specify an access token with ipinfo.io- Optional
- If no token is provided, you're limited to the following details:
- IP
- City
- Region
- Country
- Location (Based off of GeoIP)
- Organization (ISP)
- Postal code
- Timezone
-
--no-isp-queries
: Disable looking up ISP information- Optional
-
--no-rdns
: Disable rDNS querying- Optional
- Have
--no-isp-queries
and--ipinfo-token
conflict with each other - Have an option for exporting to JSON files
- Break up the main function more
- Consider finding a replacement API for
ipinfo
that provides information without the need for a key
Thanks to Amy for being the recipient of a brute force SSH attack that prompted me to start writing this.