------------------ main.sh ---------------
#!/bin/bash
# 09/10/2025
# run iptables scammer scripts from the main script
SCM=/var/tmp/scammer_report_$(date +"%d-%m-%Y")
echo "SCAMMER CHECK REPORT" > $SCM
/etc/iptables/scripts/1_visitor.pl
/etc/iptables/scripts/2_bulkcheck.sh
/etc/iptables/scripts/3_update_scammer.pl
/etc/iptables/scripts/4_block_chains.sh

# Define mail variables
RECIPIENT="maren"
SUBJECT="Scammer report PI Delta"

# send report
cat $SCM | mail -s "$SUBJECT" "$RECIPIENT"

------------------ 1_visitor.pl --------------
#!/usr/bin/perl
#  reads iptables.log and extracts IP-VISITOR: SRC ip-address
#  foreign connections to the local website

use strict;
my ($date, $res, $ip, $pos1, $pos2, $fh, $ipf, $line, $opf);

$date=`date +%d-%m-%Y`;
chomp($date);

my $oldip="0.0.0.0";
my $log="/var/log/iptables.log";
my $ipfile="/var/tmp/IP-VISITOR.txt_$date";
my $tmpsort="/var/tmp/sort_tmp.txt";

  open($fh, "<$log") or die $!;
  open($ipf, ">$ipfile") or die $!;

  while($line=<$fh>) {
     chomp($line);
     if (($line =~ /IP-VISITOR:/) && ($line =~ /DST=192.168.1.11/) && ($line !~ /SRC=192.168.1.7/)) {
        $pos1 = index($line, "SRC=");
        $pos2 = index($line, " ", $pos1);
        $ip = substr($line, $pos1+4, $pos2-$pos1-4);
        if ($ip ne $oldip) {
          print $ipf "$ip\n";
          $oldip=$ip;
        }
     }
  }

  close($fh);
  close($ipf);
$res=`sort -u  $ipfile > $tmpsort`;
$res=`cp $tmpsort $ipfile`;

$res=`cp $log $log"_"$date`;
$res=`cp /dev/null $log`;
$res=`/usr/bin/echo "------1_visitor.pl-------" >> /var/tmp/scammer_report"_"$date`;
$res=`/usr/bin/echo -n "IPfile count: " >> /var/tmp/scammer_report"_"$date`;
$res=`/usr/bin/cat $ipfile | /usr/bin/wc -l  >> /var/tmp/scammer_report"_"$date`;

------------------ 2_bulkcheck.sh --------------
#!/bin/bash
# runs the ip-addresses through the abuseip database
# and creates an output file with abusive IPs

apiUserInput=adxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
outputPath=/var/tmp/bulkip_abuse_check.txt_$(date +"%d-%m-%Y")
ipVisitor=/var/tmp/IP-VISITOR.txt_$(date +"%d-%m-%Y")
ipFile=/var/tmp/IP-VISITOR-2900.txt_$(date +"%d-%m-%Y")
/usr/bin/head -n 2900 $ipVisitor > $ipFile
maxAge=30

actualsize=$(wc -c <"$ipFile")
if [ $actualsize -lt 50 ]; then
    /usr/bin/cp $ipVisitor $ipFile
fi
if [[ -f "$outputPath" ]]; then
/usr/bin/rm $outputPath
fi
CURRJSON=/var/tmp/currentip.json
if [[ -f "$CURRJSON" ]]; then
/usr/bin/rm $CURRJSON  #removes temporary file
fi
IFS=$'\n'
        /usr/bin/cat $ipFile | while read line #Read file specified in ipFile variable and runs through while loop for every line of file
        do
# debug echo "IP #" $i "of" $numIps"," $line
        /usr/bin/curl -s -G https://api.abuseipdb.com/api/v2/check \
                 --data-urlencode "ipAddress=$line" \
                  -d maxAgeInDays=$maxAge \
                  -H "Key: $apiUserInput" \
                  -H "Accept: application/json" \
                -o "/var/tmp/currentip.json" > /dev/null 2>&1
        /usr/bin/cat /var/tmp/currentip.json | /usr/bin/jq -r '.[] | "\(.ipAddress), \(.abuseConfidenceScore), \(.totalReports), \(.isp), \(.countryCode), \(.domain), \(.numDistinctUsers), \(.lastReportedAt)"' >> $outputPath #Selects fields to write to output file
        i=$[$i+1] #Increments line to be read
        done

SCM=/var/tmp/scammer_report_$(date +"%d-%m-%Y")
RST=`/usr/bin/echo "------2_bulkcheck.sh-----" >> $SCM`
RES=`/usr/bin/echo -n "Bulkip_check count: " >> $SCM`
CNT=`/usr/bin/cat $outputPath | /usr/bin/wc -l >> $SCM`

        /bin/sed -i 1i"IP Address, % Confidence of Abuse, Total Reports within "$maxAge" days, ISP, Country Code, Domain, Distinct Users Reporting, Last Reported At" $outputPath #Adds header to CSV file

------------------ 3_update_scammer.pl --------------
#!/usr/bin/perl
# split the bulkresult coming from api.abuseipdb.com and select abusive ip-addresses, ip's from
#certain countries and anything coming from Facebook. Create a file scammer.zone_date with the excisting
# ip-addresses plus the new ones.
use strict;

my ($date, $bulkresult, $bulk_ip, $scammer_zone, $scammer_list, $ip, $abuse, $report,$ISP,$country, @rest, $result);

$date=`date +%d-%m-%Y`;
chomp($date);

$bulkresult="/var/tmp/bulkip_abuse_check.txt_$date";
$bulk_ip="/var/tmp/bulk_ip_only_$date";
$scammer_zone="/var/tmp/final_scammer.zone_$date";
$scammer_list="/var/tmp/current_scammer_list_$date";

$result=`/sbin/ipset list scammer | tail -n +9 > $scammer_list`;
unless (-s $scammer_list) {
   my $IPsave=`/usr/bin/ls -1tr /home/maren/ipset | tail -1`;
   $IPsave="/home/maren/ipset/" . $IPsave;
   chomp($IPsave);
   $result=`/usr/bin/cp $IPsave $scammer_list`;
}

open (IF, "< $bulkresult") or die $!;
open (OF, "> $bulk_ip") or die $!;

while () {
        chomp;
        ($ip,$abuse,$report,$ISP,$country,@rest)=split(/,/);
        if ($abuse > 30) {
                print OF "$ip\n";
        } elsif ($_ =~ / HU, | CN, | IN, | HK, | BR, | VN, | JP, | SG, | PH, | IT, | RU, /) {
                print OF "$ip\n";
        }
}
close(IF);
close(OF);

$result=`/usr/bin/cat $scammer_list > $scammer_zone`;
$result=`/usr/bin/cat $bulk_ip >> $scammer_zone`;
$result=`/usr/bin/echo "---3_update_scammer.pl---" >> /var/tmp/scammer_report"_"$date`;
$result=`/usr/bin/echo -n "Current list count: " >> /var/tmp/scammer_report"_"$date`;
$result=`/usr/bin/cat $scammer_list | /usr/bin/wc -l  >> /var/tmp/scammer_report"_"$date`;
$result=`/usr/bin/echo -n "Bulkip count: " >> /var/tmp/scammer_report"_"$date`;
$result=`/usr/bin/cat $bulk_ip | /usr/bin/wc -l  >> /var/tmp/scammer_report"_"$date`;
$result=`/usr/bin/echo -n "Updated list count: " >> /var/tmp/scammer_report"_"$date`;
$result=`/usr/bin/cat $scammer_zone | /usr/bin/wc -l  >> /var/tmp/scammer_report"_"$date`;

------------------ 4_block_chains.sh --------------
#!/bin/sh
#create a new set and swap it with scammer, making the latter empty.
#add all ip-addresses to the scammer set using ipset A scammer “ip-addresses”

PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin; export PATH

# instead of flush - replace
/sbin/ipset create newset hash:net
/sbin/ipset swap newset scammer
/sbin/ipset destroy newset

# remove any old list that might exist from previous runs of this script
#/bin/rm /etc/iptables/cn.zone
#/bin/rm /etc/iptables/ru.zone

# Pull the latest IP set for China
#/usr/bin/wget -P /etc/iptables  http://www.ipdeny.com/ipblocks/data/countries/cn.zone
#/usr/bin/wget -P /etc/iptables  http://www.ipdeny.com/ipblocks/data/countries/ru.zone

# Add each IP address from the downloaded list into the ipset 'scammer'
for i in $(cat /var/tmp/final_scammer.zone_$(date +"%d-%m-%Y")); do ipset -A scammer $i; done
# Restore iptables
/sbin/iptables-restore < /etc/iptables/iptables.stable

SCM=/var/tmp/scammer_report_$(date +"%d-%m-%Y")
RES=`/usr/bin/echo "----4_block_chains.sh----"  >> $SCM`
CNT=`/usr/sbin/ipset list scammer -t | grep Number >> $SCM`