Count countries bruteforcing some port(s).

fail2ban-country.pl

#!/usr/bin/perl
use strict;
use warnings;
use Geo::IP;

my %country;
while (<>) {
    my $ip = $1 if /an ([\d\.]+)$/;
    $country{$ip} = 1 if $ip;
}

my %freq;

for my $ip ( keys %country ) {
    my $gi = Geo::IP->new(GEOIP_MEMORY_CACHE);

    # returns undef if country is unallocated, or not defined in our database
    my $country = $gi->country_code_by_addr($ip);
    $freq{$country}++;
}

my $total = keys %country;

for my $country ( sort { $freq{$b} <=> $freq{$a} } keys %freq ) {
    my $num = $freq{$country};
    my $perc = sprintf "%d", $num / $total * 100;
    print "$country -- $num ($perc %)\n";
}