Bulk AbuseIPDB reporting using command-line tools
A blogger shows how to bulk-report distributed botnet IPs scraping a self-hosted Gitea instance to AbuseIPDB using bash, awk, and jq.
The author's self-hosted Gitea instance was scraped by distributed bots using random IPs worldwide and randomized, often nonexistent User-Agent strings, generating heavy request load for days. The write-up demonstrates filtering Traefik access logs (CLF and JSON) with grep, awk, and jq to extract offending IPs, tagging them with AbuseIPDB category 19 (Bad Web Bot), deduplicating them, and building a CSV for the Bulk Reporter tool. Reports can then be submitted through the AbuseIPDB bulk-report API, respecting the 5,000-report daily limit.
- Distributed bots with random IPs and fake User-Agents scraped every URL and sort variant for days.
- Bash, grep, awk, and jq pipeline filters Traefik logs for HTTP 302 responses with sort= parameters.
- AbuseIPDB category 19 (Bad Web Bot) is applied before deduplicated bulk submission via API.
- A JSON log variant uses jq to select entries and cap reports at the daily 5,000 limit.
From the original article
2 min read at blog.mbirth.ukSome botnet is scraping my local Gitea instance by requesting every single URL possible. Even the same table is queried in every variation possible: sorted ascending, sorted descending, sorted by second column ascending, sorted by second column descending, and so on. This creates unnecessary load on the server and traffic on the line.
By blog.mbirth.uk via edent · blog.mbirth.uk
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.