JPCERT/CCが公開したフィッシングURLに対するDNSフィルタリング比較

#!/bin/bash

# JPCERT/CCのフィッシングURLのCSVを結合
URLS="phishurls.txt"
: > ${URLS}
while read i; do
  curl "$i" >> ${URLS}
done <<-EOS
https://raw.githubusercontent.com/JPCERTCC/phishurl-list/refs/heads/main/2025/202501.csv
https://raw.githubusercontent.com/JPCERTCC/phishurl-list/refs/heads/main/2025/202502.csv
https://raw.githubusercontent.com/JPCERTCC/phishurl-list/refs/heads/main/2025/202503.csv
https://raw.githubusercontent.com/JPCERTCC/phishurl-list/refs/heads/main/2025/202504.csv
https://raw.githubusercontent.com/JPCERTCC/phishurl-list/refs/heads/main/2025/202505.csv
https://raw.githubusercontent.com/JPCERTCC/phishurl-list/refs/heads/main/2025/202506.csv
https://raw.githubusercontent.com/JPCERTCC/phishurl-list/refs/heads/main/2025/202507.csv
https://raw.githubusercontent.com/JPCERTCC/phishurl-list/refs/heads/main/2025/202508.csv
https://raw.githubusercontent.com/JPCERTCC/phishurl-list/refs/heads/main/2025/202509.csv
https://raw.githubusercontent.com/JPCERTCC/phishurl-list/refs/heads/main/2025/202510.csv
https://raw.githubusercontent.com/JPCERTCC/phishurl-list/refs/heads/main/2025/202511.csv
https://raw.githubusercontent.com/JPCERTCC/phishurl-list/refs/heads/main/2025/202512.csv
https://raw.githubusercontent.com/JPCERTCC/phishurl-list/refs/heads/main/2026/202601.csv
EOS

# ドメイン部分を抜き出して重複削除
DOMAINS1="domains_1.txt"
cat ${URLS} | cut -d',' -f2 | grep 'https://' | sed -E 's|^"?https?://([^/]+).*$|\1|g' | sort -u > ${DOMAINS1}

# 現時点で応答があるものを抜き出す
function address_resolvable() {
  DOMAIN="${1}"
  DNS_SERVER="${2:-1.1.1.1}"
  local results=$(dig @${DNS_SERVER} ${DOMAIN} A +short +time=2 +tries=1 | grep -v '^$')

  if [ -z "$results" ]; then
    return 1
  else
    return 0
  fi
}

DOMAINS2="domains_2.txt"
: > ${DOMAINS2}
cat ${DOMAINS1} | while read i; do
  echo $i
  address_resolvable $i && echo $i >> ${DOMAINS2}
done

#!/bin/bash
LIST="$1"
DNS="${2:-1.1.1.1}"

function check_blocked() {
	DOMAIN="${1}"
	DNS_SERVER="${2}"
	local results=$(dig @${DNS_SERVER} ${DOMAIN} A +short +time=2 +tries=1 | grep -v '^$')

	local is_blocked=true
	local found_any_ip=false

	if [ -z "$results" ]; then
		# そもそもレコードが存在しない、あるいはNXDOMAINの場合
		is_blocked=true
	else
		# 返ってきた各行（IPまたはCNAME）をチェック
		while read -r line; do
			# IPアドレスの形式（数字とドット）かチェック
			if [[ $line =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
				found_any_ip=true
				# 0.0.0.0 または 127.0.0.1 でなければ「ブロックされていない」と判断
				if [[ "$line" != "0.0.0.0" && "$line" != "127.0.0.1" && "$line" != "156.154.112.16" && "$line" != "51.15.69.11" && "$line" != "146.112.61.108" && "$line" != "94.140.14.33" ]]; then
					is_blocked=false
					break
				fi
			fi
		done <<< "$results"
	fi

	# 最終判定の出力
	if [ "$found_any_ip" = true ] && [ "$is_blocked" = false ]; then
		#echo "[PASS] $DOMAIN はブロックされていません。 (Result: $(echo $results | tr '\n' ' '))"
		return 0
	else
		#echo "[BLOCK] $DOMAIN はブロックされています。"
		return 1
	fi
}

if [ -z "$LIST" ]; then
    echo "Usage: $0 <domain list> <dns server>"
    exit 1
fi

TOTAL=$(wc -l < $LIST)
BLOCKED_COUNT=0

while read -r domain; do
    check_blocked "$domain" "$DNS"
    if [ $? -eq 1 ]; then
        ((BLOCKED_COUNT++))
    fi
done < "$LIST"

echo "--- 調査結果 ${DNS} ---"
echo "総ドメイン数: $TOTAL"
echo "ブロック数: $BLOCKED_COUNT"
echo "ブロック率: $(echo "scale=2; $BLOCKED_COUNT * 100 / $TOTAL" | bc)%"