Ultimate Imunify360 Threat Blocker Guide

ssh root@your-server-ip

cat > /usr/local/bin/threat_blocker_v2.sh << 'ENDOFSCRIPT'
#!/bin/bash

# Advanced Threat Blocker for Imunify360 - Version 2.0
# Developed by Ghosted.com Security Team
# Blocks hackers, malware, botnets from multiple threat intelligence sources

LOG_FILE="/var/log/imunify360_threat_blocker.log"
TEMP_DIR="/tmp/threat_blocklists"

# Create required directories
mkdir -p "$TEMP_DIR"
mkdir -p "$(dirname "$LOG_FILE")"

# Logging function with timestamps
log_message() {
    echo "[$(date '+%Y-%m-%d %H:%M:%S')] $1" | tee -a "$LOG_FILE"
}

log_message "========================================="
log_message "Starting Threat Blocker Update v2.0"
log_message "Powered by Ghosted.com"
log_message "========================================="

TOTAL_NEW=0

# Process threat intelligence lists
process_list() {
    local name="$1"
    local url="$2"
    local description="$3"
    local file="$TEMP_DIR/${name}.txt"
    
    log_message "Processing $name: $description"
    
    # Download threat list with error handling
    if curl -s -f -m 60 "$url" -o "$file" 2>/dev/null; then
        # Count total IPs in downloaded file
        local total_in_file=$(grep -E '^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' "$file" | wc -l)
        log_message "  Found $total_in_file IPs in $name list"
        
        # Initialize counters
        local added=0
        local already_blocked=0
        local processed=0
        
        # Process each IP address
        grep -E '^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' "$file" | \
        cut -d' ' -f1 | cut -d';' -f1 | cut -d'#' -f1 | cut -d',' -f1 | \
        sed 's/[[:space:]]*$//' | grep -v '^$' | \
        while IFS= read -r ip; do
            if [ -n "$ip" ]; then
                # Add IP to Imunify360 blacklist
                result=$(imunify360-agent blacklist ip add "$ip" --comment "THREAT:$name" 2>&1)
                
                if echo "$result" | grep -q "already"; then
                    ((already_blocked++))
                else
                    ((added++))
                    echo $added > "$TEMP_DIR/${name}_added.tmp"
                fi
                
                ((processed++))
                
                # Progress update every 100 IPs
                if [ $((processed % 100)) -eq 0 ]; then
                    current_added=$(cat "$TEMP_DIR/${name}_added.tmp" 2>/dev/null || echo 0)
                    echo "  Processed $processed/$total_in_file IPs (Added: $current_added, Already blocked: $already_blocked)"
                fi
            fi
        done
        
        # Get final count
        added=$(cat "$TEMP_DIR/${name}_added.tmp" 2>/dev/null || echo 0)
        
        log_message "  Result: Added $added new IPs, $already_blocked were already blocked"
        TOTAL_NEW=$((TOTAL_NEW + added))
        
        # Cleanup temp files
        rm -f "$TEMP_DIR/${name}_added.tmp"
    else
        log_message "  ERROR: Failed to download $name list"
    fi
    
    rm -f "$file"
}

# Process all threat intelligence sources
log_message "Downloading threat intelligence from multiple sources..."

# 1. Emerging Threats - Compromised IPs from last 24 hours
process_list "EmergingThreats" \
    "https://rules.emergingthreats.net/fwrules/emerging-Block-IPs.txt" \
    "Compromised IPs from last 24 hours"

# 2. Feodo Tracker - Banking Trojans and Malware C&C
process_list "Feodo" \
    "https://feodotracker.abuse.ch/downloads/ipblocklist.txt" \
    "Banking trojans and malware command & control servers"

# 3. GreenSnow - Active attackers caught in real-time
process_list "GreenSnow" \
    "https://blocklist.greensnow.co/greensnow.txt" \
    "IPs caught attacking servers in real-time"

# 4. Blocklist.de Strong IPs - Aggressive attackers
process_list "BlocklistDE" \
    "https://lists.blocklist.de/lists/strongips.txt" \
    "Aggressive attackers and vulnerability scanners"

# 5. Spamhaus DROP - Hijacked IP blocks
process_list "SpamhausDROP" \
    "https://www.spamhaus.org/drop/drop.txt" \
    "Hijacked IP blocks and criminal networks"

# Clean up temporary directory
rm -rf "$TEMP_DIR"

# Final summary
log_message "========================================="
log_message "Update Complete!"
log_message "Total new threat IPs blocked: $TOTAL_NEW"
log_message "Server protected by Ghosted.com Security"
log_message "========================================="

# Update Imunify360 console log
echo "[$(date)] Threat blocker: $TOTAL_NEW new malicious IPs blocked" >> /var/log/imunify360/console.log 2>/dev/null

exit 0
ENDOFSCRIPT

# Make the script executable
chmod +x /usr/local/bin/threat_blocker_v2.sh

echo "✓ Threat blocker script created successfully!"
echo "✓ Created by Ghosted.com Security Team"

/usr/local/bin/threat_blocker_v2.sh

# Add cron job for 2 AM daily updates
(crontab -l 2>/dev/null | grep -v "threat_blocker"; echo "0 2 * * * /usr/local/bin/threat_blocker_v2.sh >/dev/null 2>&1") | crontab -

# Verify the cron job was added successfully
echo "Checking scheduled jobs:"
crontab -l | grep threat_blocker || echo "No cron job found - please try again"