Scrape FastFlux Domain IP's

fastflux_scraper.sh

#!/bin/bash

cd "$(dirname "$0")"
	
while test $# -gt 0; do
        case "$1" in
                -h|--help)
						echo " "
                        echo "domain watcher"
                        echo " "
                        echo "options:"
                        echo "-h, --help                show brief help"
                        echo "-d, --domain=DOMAIN"
                        echo "-c, --to=To Email"
                        exit 0
                        ;;
                -d)
                        shift
                        if test $# -gt 0; then
                                export domain=$1
                        else
                                echo "no domain specified"
                                exit 1
                        fi
                        shift
                        ;;
                --domain*)
                        export domain=`echo $1 | sed -e 's/^[^=]*=//g'`
                        shift
                        ;;
                -t)
                        shift
                        if test $# -gt 0; then
                                export to=$1
                        else
                                echo "no email address"
                                exit 1
                        fi
                        shift
                        ;;
                --to-address*)
                        export to=`echo $1 | sed -e 's/^[^=]*=//g'`
                        shift
                        ;;
                *)
                        break
                        ;;
        esac
done

if ! [ $domain ]; then
	echo "domain not defined; please sepecify"
	exit 1
elif  ! [ $to ]; then
	echo "to address not defined; please sepecify"
	exit 1
fi

if [ ! -f "$domain"_watch_ip.lst ]; then
    touch "$domain"_watch_ip.lst
fi

export mydate=`date`

count=0
while [ $count -lt 10 ]; do 
	dig +time=2 $domain +nocomments +noquestion +noauthority +noadditional +nostats | \
	grep -Po '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | sort -u | \
	while read ip
	do
		if grep --quiet "$ip" "$domain"_watch_ip.lst; then
			echo "listed"
		else
            echo $ip >> "$domain"_watch_ip.tmp
		fi 
	done
	count=$(($count + 1))
done

if [ -f "$domain"_watch_ip.tmp ]; then
	echo "new ips:"
	cat "$domain"_watch_ip.tmp | sort -u | tee -a "$domain"_watch_ip.lst
	#do something with new IPS email/added to IDS...etc
	rm "$domain"_watch_ip.tmp
else
	echo "nothing new"
fi