Blocks Shodan, Zoomeye, Censys IPs From Scanning Your Servers.

banned.sh

#!/bin/bash

if [ ! -x "/usr/bin/whois" ]; then
        echo "whois must be installed at /usr/bin/whois"
        exit 2
elif [ $# -ne 1 ]; then
        echo "Usage $0 [ASN #]"
        exit 1
elif ! [ $1 -eq $1 ] 2> /dev/null; then
        echo "ASN must be a number"
        exit 1
fi

setname="as$1"

echo "create $setname hash:net family inet hashsize 1024 maxelem 2048" > "$setname.ipset"
/usr/bin/whois -h whois.radb.net -i origin AS$1 | /bin/grep -Eo '([0-9.]+){4}/[0-9]+' >> "$setname.ipset"
lines=`wc -l < $setname.ipset`

if (($lines < 2)); then
        echo "ASN $1 not found or no routes found"
        rm -f "$setname.ipset"
        exit
elif (($lines > 2049)); then
        echo "More than 2048 records found, adjust maxelem for set"
fi

iptables -I INPUT -m set --match-set "$setname" src -j DROP