3 ms·
If anyone is looking to run IP metadata based reports on their honeypot, I can suggest IPinfo's CLI (https://github.com/ipinfo/cli https://github.com/ipinfo/cli
by reincoder 2y ago
If anyone is looking to run IP metadata based reports on their honeypot, I can suggest IPinfo's CLI (https://github.com/ipinfo/cli https://github.com/ipinfo/cli). Here is my summary report from Fail2Ban:
```
Summary
- Total 1490
- Unique 153
- Anycast 0
- Bogon 0
- Mobile 52
- VPN 91
- Proxy 12
- Hosting 1003
- Tor 0
- Relay 0
Top ASNs
- AS132203 Tencent Building, Kejizhongyi Avenue 409 (27.4%)
- AS14061 DigitalOcean, LLC 148 (9.9%)
- AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED 72 (4.8%)
- AS16276 OVH SAS 72 (4.8%)
- AS206264 Amarutu Technology Ltd 44 (3.0%)
Top Usage Types
- Hosting 955 (64.1%)
- ISP 418 (28.1%)
- Business 49 (3.3%)
Top Routes
- 43.134.64.0/18 (AS132203) 48 (3.2%)
- 183.81.169.0/24 (AS206264) 44 (3.0%)
- 43.156.192.0/18 (AS132203) 36 (2.4%)
- 43.130.0.0/18 (AS132203) 36 (2.4%)
- 43.134.0.0/18 (AS132203) 36 (2.4%)
Top Countries
- United States 276 (18.5%)
- Singapore 221 (14.8%)
- China 141 (9.5%)
- France 88 (5.9%)
- Japan 86 (5.8%)
Top Cities
- Singapore, Singapore, SG 221 (14.8%)
- Santa Clara, California, US 100 (6.7%)
- Hong Kong, Hong Kong, HK 80 (5.4%)
- Tokyo, Tokyo, JP 61 (4.1%)
- Amsterdam, North Holland, NL 50 (3.4%)
Top Regions
- Singapore, SG 221 (14.8%)
- California, US 134 (9.0%)
- Tokyo, JP 86 (5.8%)
- Hong Kong, HK 80 (5.4%)
- New Jersey, US 70 (4.7%)
Top Carriers
- Africell 12 (0.8%)
- Claro 12 (0.8%)
- Vivo 12 (0.8%)
- WINDTRE 12 (0.8%)
- Telekom 4 (0.3%)
Top Privacy Services
- TunnelBear 36 (2.4%)
- Best Proxy Switcher 12 (0.8%)
Top Domains
- ovh.net 60 (4.0%)
- googleusercontent.com 24 (1.6%)
- prod-infinitum.com.mx 16 (1.1%)
- poneytelecom.eu 12 (0.8%)
```
Here is the command I used:
```
cat /var/log/fail2ban.log | ipinfo grepip -o | ipinfo summarize
```
The CLI is free to use. You can also do `bulk` enrichment.
```
cat /var/log/fail2ban.log | ipinfo grepip -o | ipinfo bulk -c > fail2ban_ips.csv
```
Disclaimer: I work for IPinfo. However, the CLI is free to use, and the bulk feature will usually work within your free tier limits. Ping me if you have any questions