mitigate linode DDOS

antiDDOS.sh

#!/bin/bash

function join { local IFS="$1"; shift; echo "$*"; }

IFS=$'\n'
LIMIT=20
STATS=$(netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n | grep -v Address | grep -v servers)
BLACKLISTED=""
BLACKLISTED_IPS=()
EMAIL="[email protected]"

for entry in $STATS; do
	IFS=' ' read -a entry <<< "${entry}"
	if [ ${entry[0]} -gt $LIMIT ]
		then
		#block the matherfucker and send an email too 
		iptables -t filter -I INPUT 1 -p tcp -s ${entry[1]} -j DROP	
		BLACKLISTED+="$(curl ipinfo.io/${entry[1]})"
		BLACKLISTED+=\\n
		BLACKLISTED_IPS+=(${entry[1]})
	fi
done

SIZE=${#BLACKLISTED_IPS[@]}
if [ $SIZE -gt 0 ]
	then
	echo "== ATTACKERS FOUND ==="
	SUMMARY=$(echo Blocklisted $SIZE motherfuckers)

	EMAIL_TEMPLATE="SUMMARY
===
$SUMMARY

BLACKLISTED
===
$BLACKLISTED

STATS
====
$STATS"

	BODY=$(echo "$EMAIL_TEMPLATE")
	echo "$BODY " | mail -t $EMAIL -s 'DDOS identified'
fi