Get informations about IP banned by fail2ban.

whoisbanned.py

#! /usr/bin/env python
# -*- coding: utf-8 -*-

import json
import requests

# https://github.com/CIRCL/bgpranking-redis-api/tree/master/example/api_web/client
from bgpranking_web import api

with open("/var/log/fail2ban.log", "r") as f:
    log = f.read()
ip_candidates = re.findall(r"Ban (\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b)", log)
#ip_candidates = ["221.8.18.15"]

for ip in ip_candidates:
    result = requests.get("http://ipinfo.io/" + ip + "/json/")
    json_result = json.loads(result.text)
    asn_number =  json_result["org"].split(" ")[0].replace("AS", "")
    asn = api.asn_description(asn_number)
    print("IP: " + ip)
    print("Loc: %s / %s / %s" % (json_result["city"], json_result["region"], json_result["loc"]))
    print("ASN: " + asn_number)
    if None != asn:
        print(asn["asn_description"])
        print(asn["sources"])
    print("")