Skip to content

Latest commit

 

History

History
68 lines (43 loc) · 1.41 KB

README.md

File metadata and controls

68 lines (43 loc) · 1.41 KB

whoisabusetool

Processes list of IPs and tries to figure out abuse email(s) for them.

Done as part of a research project for the Department of Information Technology of University of Turku

Work In Progress, but has been tested with 10000+ IPs and 3 proxies.

Usage

  • Install dependencies below
  • Set up proxy servers and add them to config.py
  • See below
$ python3 whoisabuse.py
Usage:
        add             Add IPs from stdin
        process         Start processing IPs
        process-failed  Mark failed IPs to be reprocessed
        dump            Dump IPs with any results
        dump-processed  Dump IPs that have email results

Example

$ echo 192.30.253.113 | python whoisabuse.py add
IPs added (1, 1) Bad IPs: 0

$ python whoisabuse.py process
Processing 192.30.253.113
Exhausted queryable IPs
Processing finished. Requests: 1 Replies: 0 instant, 1 by whoiser

$ python whoisabuse.py dump
192.30.253.113 hostmaster@github.com

Dependencies

pip install --upgrade ipwhois
pip install netaddr

You also need 3+ proxies to efficiently query the databases.

TODO

  • Add timestamps!
  • Optimize CPU usage and database queries
  • Normalize email database
  • Allow choosing maximum network size
  • Improve error logging
  • Improve proxying system

Bugs

  • Possibly many, work in progress