abuseipdb report scripts

crontab -e

# make sure to put ABUSE_API_KEY into ~/.profile
0 1 * * * . ~/.profile; ~/abuse/ssh_report_all.sh

ssh_failed_ips.sh

#!/bin/bash
sudo cat /var/log/auth.log | grep "`LC_ALL=en_US.utf8 date -d 'yesterday' '+%b %e'`" | grep "Failed password for invalid" | sed -r 's/.*Failed password for invalid user (|[A-Za-z0-9_-]+) from ([0-9\.]+).*/\2/m' | sort | uniq

ssh_ip_comment.sh

#!/bin/bash
sudo cat /var/log/auth.log | grep $1 | grep "Failed password for invalid" | sed -e "s/ih953426/***/"

ssh_report_all.sh

#!/bin/bash
for ip in `~/abuse/ssh_failed_ips.sh`
do
  ~/abuse/ssh_report_one.sh $ip
  echo
done

ssh_report_one.sh

#!/bin/bash
~/abuse/ssh_ip_comment.sh $1 | curl "https://www.abuseipdb.com/report/json?key=$ABUSE_API_KEY&category=18,22&ip=$1" --data-urlencode comment@-

Thanks for sharing. This works like a charm. Just need a tweak to mask the server name but I’ll work to tweak that.