image

.github/workflows/dedupe.yaml

@@ -0,0 +1,30 @@
+name: Malicious IP Aggregator
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: '5 4 * * *'
+
+jobs:
+  Job:
+    runs-on: self-hosted
+    timeout-minutes: 5
+    permissions:
+      contents: write
+
+    steps:
+
+    - uses: actions/checkout@v4
+      with:
+        ref: ${{ github.head_ref }}
+
+    - name: Remove dupes
+      run: |
+        sort ~/agg-ips.txt | uniq -d > ~/deduped-ips.txt
+        sed '/^### Aggregating top 500 source IPs in ES$/,/^### Elasticsearch is available, now continuing./d' ~/deduped-ips.txt >> /home/runner/runner/_work/honeypot/honeypot/malicious-ips.txt
+        cat /home/runner/runner/_work/honeypot/honeypot/malicious-ips.txt | wc -l
+
+    - name: Commit changes
+      uses: stefanzweifel/git-auto-commit-action@v5
+      with:
+        commit_message: Auto update malicious IP file

README.md

@@ -4,6 +4,8 @@
 
 A honeypot is a computer system or network that is intentionally left vulnerable to hackers in order to detect, analyse, and respond to potential security threats. The goal of a honeypot is to gather information about the tactics, techniques, and procedures used by bad actors, which can help improve overall network security.
 
+![alt text](/misc/honeypot.png)
+
 ## Benefits
 
 - Improved threat intelligence: Honeypots provide valuable insights into attacker tactics, techniques, and procedures (TTPs), helping security teams improve their defenses.
@@ -39,7 +41,7 @@ Once the system is back online the admin panel will be accessible on port 64297
 
 # Logs
 
-The logs can be fetched from the tpotce/data folder, 
+The logs can be fetched from the tpotce/data folder.
 
 # Malicious IPs Aggregator