#!/usr/bin/perl -w

#################################################
# Script to track fastflux dns network.
# Shows a very approximate geographical distibution
# Usage: perl lookup.pl -exec
#################################################

use strict;
use warnings;
use IO::Socket;
use Geo::IP;

my ($target, @ipaddr, $nullip, $lastip, $reverse, $geoip, $country, $hostname);
# List all domain names to be tracked here.
my @domains = qw(example1.com example2.com example3.com);
my $file = "data.txt";
my $j = 1;

if (! $ARGV[0] or $ARGV[0] ne "-exec") {
print "Usage: perl $0 -exec\n";
print "You need to explicitly tell the script to run with \'-exec\'\n";
exit;
}
print "Check of all domains is now running...Use CTRL-C to Quit.\n";
# Really bad way to make sure the initial check for dublicate IPs doesn't return an error.
$nullip = "0.0.0.0";
push(@ipaddr, $nullip); # Store in array.
while () {
foreach $hostname (@domains) {                   # Cycle through each domain.
    open (FH, ">>$file") || die "error opening or creating file:$!\n";

    $target = inet_ntoa(inet_aton($hostname) || 0.0.0.0);
    $lastip = pop(@ipaddr);                  # Store in array.
    # Perform reverse lookup. This is to see what the IP actually resolves to.
    $reverse = gethostbyaddr(inet_aton($target), AF_INET) || "Unknown";

        if ($target eq 0.0.0.0) {
           print "No IP!!!";
        }
        elsif ($target eq $lastip) {
            print "No change to A record.\nCurrent record is : $lastip\n\n";
            push(@ipaddr, $target);
            }
            elsif($target ne $lastip) {
                push(@ipaddr, $target);

                $geoip = Geo::IP->new(GEOIP_STANDARD);
                $country = $geoip->country_name_by_addr($target) || "Unknown"; # if country is undefined then print "Unkonwn!"

                open (FH, ">>$file") || die "error opening or creating file:$!\n";
    print FH "($hostname)$country | $target => $reverse\n";
    close (FH);
    }
        sleep (2); # wait 2 sec. Change lookup frequency here.
        }
    }
exit;