Repository files navigation

An integration tool designed to analyze UFW logs and report IP addresses blocked by the firewall to theAbuseIPDB database.
To prevent excessive reporting of the same IP address within a short time period, the tool uses a temporary cache file to track previously reported IP addresses.

⭐ If you like this repository or find it useful, I'd greatly appreciate it if you could give it a star. Many thanks!
Also, check this out:sefinek/Cloudflare-WAF-To-AbuseIPDB

• Node.js + npm
• PM2 (npm i -g pm2)
• Git
• Linux (Ubuntu or Debian)

1. Easy Configuration – Theconfig.js file allows for quick and simple configuration.
2. Simple Installer – Enables fast and seamless integration deployment.
3. Bulk Reporting Support – If the script encounters a rate limit, it will start buffering collected IPs and send a bulk report.
4. Self-IP Protection (IPv4 & IPv6) – The script will never report IP addresses belonging to you or your server, even if you're using a dynamic IP address.
5. Local IP Filtering – Local IP addresses will never be reported.
6. Discord Webhooks Integration:
   • Critical notifications
   • Script error alerts
   • Daily summaries of reported IPs
7. Automatic Updates – The script regularly fetches and applies the latest updates. You can disable this feature if you'd prefer.

bash<(curl -fsS https://raw.githubusercontent.com/sefinek/UFW-AbuseIPDB-Reporter/main/install.sh)

bash<(wget -qO- https://raw.githubusercontent.com/sefinek/UFW-AbuseIPDB-Reporter/main/install.sh)

sudo apt install -y curl&& \curl -fsSL https://deb.nodesource.com/setup_22.x| sudo -E bash -&& \sudo apt install -y nodejs

sudo add-apt-repository -y ppa:git-core/ppa&& \sudo apt update&& sudo apt install -y git

sudo apt update&& sudo apt upgradecd~git clone --recurse-submodules https://github.com/sefinek/UFW-AbuseIPDB-Reporter.gitcd UFW-AbuseIPDB-Reporternpm installcp config.default.js config.jssudo chmod 644 /var/log/ufw.lognpm install -g pm2sudo mkdir -p /var/log/ufw-abuseipdbsudo chown -R"$USER":"$USER" /var/log/ufw-abuseipdbpm2 start.eval"$(pm2 startup| grep sudo)"pm2 save

After a successful installation, the script will run continuously in the background, monitoring UFW logs and automatically reporting IP addresses.

Servers are constantly scanned by bots, usually looking for security vulnerabilities and similar weaknesses.So don't be surprised if the number of reports sent to AbuseIPDB exceeds a thousand the next day.

pm2 logs ufw-abuseipdb

Blocked by UFW on homeserver1 [80/tcp]Source port: 23639TTL: 247Packet length: 40TOS: 0x00This report was generated by:https://github.com/sefinek/UFW-AbuseIPDB-Reporter

Blocked by UFW on homeserver1 [30049/tcp]. Generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter

If you want to contribute to the development of this project, feel free to create a newPull request. I will definitely appreciate it!

Copyright 2024-2025 © bySefinek. All rights reserved.