Scan Blocking MT

root@arr:~/block-shodan-stretchoid# ./linux-script.sh
+ set -v

# Create ssh key pair for your router and use
# those credentials for logging in
router_ssh="ssh [email protected] -p 38022"
+ router_ssh='ssh [email protected] -p 38022'

# Logging facility parameters
log_dir="/home/$(id -un)/scripts/fw_log"
++ id -un
+ log_dir=/home/root/scripts/fw_log
log_file="$log_dir/$(date +%Y-%m)_bad_hosts.log"
++ date +%Y-%m
+ log_file=/home/root/scripts/fw_log/2024-01_bad_hosts.log
log_file_alert="$log_dir/$(date +%Y-%m)_other_hosts.log"
++ date +%Y-%m
+ log_file_alert=/home/root/scripts/fw_log/2024-01_other_hosts.log

# Stage 1 dynamic address list on the remote MikroTik
router_stage1="fw_stage1"
+ router_stage1=fw_stage1

# Blacklist address list on the remote MikroTik
router_blacklist="fw_blacklist"
+ router_blacklist=fw_blacklist

# Temporary file we are using to store stage 1 access list
file="stage1"
+ file=stage1

> "$file"

if [[ ! -d $log_dir ]]; then
  mkdir -p $log_dir
fi
+ [[ ! -d /home/root/scripts/fw_log ]]
if [[ ! -f $log_file  ]]; then
  touch $log_file
fi
+ [[ ! -f /home/root/scripts/fw_log/2024-01_bad_hosts.log ]]
if [[ ! -f $log_file_alert  ]]; then
  touch $log_file_alert
fi
+ [[ ! -f /home/root/scripts/fw_log/2024-01_other_hosts.log ]]

$router_ssh "/ip firewall address-list print where list=$router_stage1" | awk 'NR > 2 {print $4}' >> "$file"
+ ssh [email protected] -p 38022 '/ip firewall address-list print where list=fw_stage1'
+ awk 'NR > 2 {print $4}'

while read -r line || [[ "$line" ]]
do

  ip=$(echo $line | tr -d '\r')
  domain=$(dig -x "$ip" +short 2>&- | sed 's/.$//')

  if [ ! -z "$domain" ]
  then
    if echo "$domain" | egrep -i "(^|[^a-zA-Z])(shodan|stretchoid|shadowserver|ezotech|alphastrike|censys|onyphe|binaryedge|caacbook|onlineprism|internet-census|netsystemsresearch|scan.*)($|[^a-zA-Z])" > /dev/null
    then
        $router_ssh -n "do { /ip firewall address-list add list=$router_blacklist comment=$domain address=$ip } on-error={}"
        echo -e $(date +%Y-%m-%d) $ip"\t\t"$ptr >> $log_file
    else
        echo -e $(date +%Y-%m-%d) $ip "\t\t"$ptr >> $log_file_alert
     fi
  fi
done < "$file"
+ read -r line
++ echo CREATION-TIME
++ tr -d '\r'
+ ip=CREATION-TIME
++ dig -x CREATION-TIME +short
++ sed 's/.$//'
+ domain=
+ '[' '!' -z '' ']'
+ read -r line
++ echo 185.200.118.35
++ tr -d '\r'
+ ip=185.200.118.35
++ dig -x 185.200.118.35 +short
++ sed 's/.$//'
+ domain=adscore.com
+ '[' '!' -z adscore.com ']'
+ echo adscore.com
+ egrep -i '(^|[^a-zA-Z])(shodan|stretchoid|shadowserver|ezotech|alphastrike|censys|onyphe|binaryedge|caacbook|onlineprism|internet-census|netsystemsresearch|scan.*)($|[^a-zA-Z])'
++ date +%Y-%m-%d
+ echo -e 2024-01-27 185.200.118.35 '\t\t'
+ read -r line
++ echo 213.52.129.114
++ tr -d '\r'
+ ip=213.52.129.114
++ dig -x 213.52.129.114 +short
++ sed 's/.$//'
+ domain=scanx18.pentest-tools.com
+ '[' '!' -z scanx18.pentest-tools.com ']'
+ echo scanx18.pentest-tools.com
+ egrep -i '(^|[^a-zA-Z])(shodan|stretchoid|shadowserver|ezotech|alphastrike|censys|onyphe|binaryedge|caacbook|onlineprism|internet-census|netsystemsresearch|scan.*)($|[^a-zA-Z])'
+ ssh [email protected] -p 38022 -n 'do { /ip firewall address-list add list=fw_blacklist comment=scanx18.pentest-tools.com address=213.52.129.114 } on-error={}'
++ date +%Y-%m-%d
+ echo -e 2024-01-27 '213.52.129.114\t\t'
+ read -r line
++ echo 178.79.168.123
++ tr -d '\r'
+ ip=178.79.168.123
++ dig -x 178.79.168.123 +short
++ sed 's/.$//'
+ domain=scanx16.pentest-tools.com
+ '[' '!' -z scanx16.pentest-tools.com ']'
+ echo scanx16.pentest-tools.com
+ egrep -i '(^|[^a-zA-Z])(shodan|stretchoid|shadowserver|ezotech|alphastrike|censys|onyphe|binaryedge|caacbook|onlineprism|internet-census|netsystemsresearch|scan.*)($|[^a-zA-Z])'
+ ssh [email protected] -p 38022 -n 'do { /ip firewall address-list add list=fw_blacklist comment=scanx16.pentest-tools.com address=178.79.168.123 } on-error={}'
++ date +%Y-%m-%d
+ echo -e 2024-01-27 '178.79.168.123\t\t'
+ read -r line
++ echo 139.162.202.208
++ tr -d '\r'
+ ip=139.162.202.208
++ dig -x 139.162.202.208 +short
++ sed 's/.$//'
+ domain=scanx2.pentest-tools.com
+ '[' '!' -z scanx2.pentest-tools.com ']'
+ echo scanx2.pentest-tools.com
+ egrep -i '(^|[^a-zA-Z])(shodan|stretchoid|shadowserver|ezotech|alphastrike|censys|onyphe|binaryedge|caacbook|onlineprism|internet-census|netsystemsresearch|scan.*)($|[^a-zA-Z])'
+ ssh [email protected] -p 38022 -n 'do { /ip firewall address-list add list=fw_blacklist comment=scanx2.pentest-tools.com address=139.162.202.208 } on-error={}'
++ date +%Y-%m-%d
+ echo -e 2024-01-27 '139.162.202.208\t\t'
+ read -r line
++ echo 139.144.154.251
++ tr -d '\r'
+ ip=139.144.154.251
++ dig -x 139.144.154.251 +short
++ sed 's/.$//'
+ domain=scanx32.pentest-tools.com
+ '[' '!' -z scanx32.pentest-tools.com ']'
+ echo scanx32.pentest-tools.com
+ egrep -i '(^|[^a-zA-Z])(shodan|stretchoid|shadowserver|ezotech|alphastrike|censys|onyphe|binaryedge|caacbook|onlineprism|internet-census|netsystemsresearch|scan.*)($|[^a-zA-Z])'
+ ssh [email protected] -p 38022 -n 'do { /ip firewall address-list add list=fw_blacklist comment=scanx32.pentest-tools.com address=139.144.154.251 } on-error={}'
++ date +%Y-%m-%d
+ echo -e 2024-01-27 '139.144.154.251\t\t'
+ read -r line
++ echo 207.231.109.106
++ tr -d '\r'
+ ip=207.231.109.106
++ dig -x 207.231.109.106 +short
++ sed 's/.$//'
+ domain=
+ '[' '!' -z '' ']'
+ read -r line
++ echo 109.248.200.183
++ tr -d '\r'
+ ip=109.248.200.183
++ dig -x 109.248.200.183 +short
++ sed 's/.$//'
+ domain=msk.z1
+ '[' '!' -z msk.z1 ']'
+ echo msk.z1
+ egrep -i '(^|[^a-zA-Z])(shodan|stretchoid|shadowserver|ezotech|alphastrike|censys|onyphe|binaryedge|caacbook|onlineprism|internet-census|netsystemsresearch|scan.*)($|[^a-zA-Z])'
++ date +%Y-%m-%d
+ echo -e 2024-01-27 109.248.200.183 '\t\t'
+ read -r line
++ echo 74.82.47.61
++ tr -d '\r'
+ ip=74.82.47.61
++ dig -x 74.82.47.61 +short
++ sed 's/.$//'
+ domain=scan-12m.shadowserver.org
+ '[' '!' -z scan-12m.shadowserver.org ']'
+ echo scan-12m.shadowserver.org
+ egrep -i '(^|[^a-zA-Z])(shodan|stretchoid|shadowserver|ezotech|alphastrike|censys|onyphe|binaryedge|caacbook|onlineprism|internet-census|netsystemsresearch|scan.*)($|[^a-zA-Z])'
+ ssh [email protected] -p 38022 -n 'do { /ip firewall address-list add list=fw_blacklist comment=scan-12m.shadowserver.org address=74.82.47.61 } on-error={}'
++ date +%Y-%m-%d
+ echo -e 2024-01-27 '74.82.47.61\t\t'
+ read -r line
++ echo 151.106.42.185
++ tr -d '\r'
+ ip=151.106.42.185
++ dig -x 151.106.42.185 +short
++ sed 's/.$//'
+ domain=ns31465342.ip-151-106-42.eu
+ '[' '!' -z ns31465342.ip-151-106-42.eu ']'
+ egrep -i '(^|[^a-zA-Z])(shodan|stretchoid|shadowserver|ezotech|alphastrike|censys|onyphe|binaryedge|caacbook|onlineprism|internet-census|netsystemsresearch|scan.*)($|[^a-zA-Z])'
+ echo ns31465342.ip-151-106-42.eu
++ date +%Y-%m-%d
+ echo -e 2024-01-27 151.106.42.185 '\t\t'
+ read -r line
++ echo 195.230.103.245
++ tr -d '\r'
+ ip=195.230.103.245
++ dig -x 195.230.103.245 +short
++ sed 's/.$//'
+ domain=
+ '[' '!' -z '' ']'
+ read -r line
++ echo
++ tr -d '\r'
+ ip=
++ dig -x '' +short
++ sed 's/.$//'
+ domain=
+ '[' '!' -z '' ']'
+ read -r line
+ [[ -n '' ]]