How to record connections details of the IP that is getting blocked?

[slrslr]

Hello,

when an IP is blocked i am sent an e-mail by the ddos.sh where i add links to the services like:

https://www.abuseipdb.com/check/54.172.1.44
http://blacklist.myip.ms/54.172.1.44
https://censys.io/ipv4/54.172.1.44/whois
https://cymon.io/54.172.1.44

Discover accessed domain: /bin/sh /scripts/ip2logfile 54.172.1.44

This way i can see details or abuse reports for this IP and i can manualy execute my ip2logfile script to check various log files for this IP and see what that IP was doing. But i do not include this script output into mailfile nor netstat details into mailfile not to put high load on server when it is "attacked" by bad IP's.

Is it good idea, or do you suggest any commands that can tell me as much details about attacking IP as possible?

I tried:

echo "First 100 netstat entries:\n"
netstat -ntu | tr -d \r|grep "$CURR_LINE_IP"|head -n 100 >> "$BANNED_IP_MAIL"

and a few other ways, but it never appear in the e-mail. Or do you suggest other way to discover/record as much data about IP as possible?