<jupyter_start><jupyter_text>AbuseCH Data Scraper  Ransomware Blacklist> Ransomware Tracker tracks and monitors the status of domain names, IP addresses and URLs that are associated with Ransomware, such as Botnet C&C servers, distribution sites and payment sites. By using data provided by Ransomware Tracker, hosting- and internet service provider (ISPs), as well as national CERTs/CSIRTs, law enforcement agencies (LEA) and security researchers can receive an overview on infrastructure used by Ransomware and whether these are actively being used by miscreant to commit fraud.Reference: https://ransomwaretracker.abuse.ch/<jupyter_code>from pprint import pprint
from abusech.ransomware import RansomwareBl
ransomware = RansomwareBl()<jupyter_output><empty_output><jupyter_text>Blocklists> The table below provides separated blocklists for each malware and blocklist type. They allow you to be more specific in what you want to block (e.g. only a certain malware family or blocklist type).Reference: https://ransomwaretracker.abuse.ch/blocklist/<jupyter_code>blocklists = ransomware.get_blocklists()
pprint(blocklists[0])<jupyter_output>Blocklist(name='CW_C2_URLBL', malware='cryptowall', scope='c2', type='url', false_positives='low', url='https://ransomwaretracker.abuse.ch/downloads/CW_C2_URLBL.txt')<jupyter_text>Get Blocklist - IpAddress> false positives are possible, especially with regards to RW_IPBL. IP addresses associated with Ransomware Payment Sites (*_PS_IPBL) or Locky botnet C&Cs (LY_C2_IPBL) stay listed on RW_IPBL for a time of 30 days after the last appearence. This means that an IP address stays listed on RW_IPBL even after the threat has been eliminated (e.g. the VPS / server has been suspended by the hosting provider) for another 30 days.Reference: https://ransomwaretracker.abuse.ch/blocklist/<jupyter_code>data = ransomware.get_blocklist(url='https://ransomwaretracker.abuse.ch/downloads/TC_PS_IPBL.txt')
pprint(data)<jupyter_output>['192.168.3.11', '192.168.3.11']<jupyter_text>Get Blocklist - Domain> Ransomware Tracker offers various types of blocklists that allows you to block Ransomware botnet C&C traffic. The available Ransomware blocklists are documented below. The update interval is 5 minutes.Reference: https://ransomwaretracker.abuse.ch/blocklist/<jupyter_code>data = ransomware.get_blocklist(url='https://ransomwaretracker.abuse.ch/downloads/CW_C2_DOMBL.txt')
pprint(data[0:5])<jupyter_output>['anime-tuner.square7.ch',
 'dichiro.com',
 'double-wing.de',
 'dining-bar.com',
 'weberteam.hu']<jupyter_text>Get Blocklist - URL> Ransomware Tracker offers various types of blocklists that allows you to block Ransomware botnet C&C traffic. The available Ransomware blocklists are documented below. The update interval is 5 minutes.Reference: https://ransomwaretracker.abuse.ch/blocklist/<jupyter_code>data = ransomware.get_blocklist(url='https://ransomwaretracker.abuse.ch/downloads/CW_C2_URLBL.txt')
pprint(data[0:5])<jupyter_output>['http://connectao.com/wp-content/themes/twentyeleven/cc.php',
 'http://businessaviators.com/r1doyF.php',
 'http://aditaborai.com.br/WgNGXe.php',
 'http://procrediti.com.ua/d6yGOX.php',
 'http://www.hanecaklaw.com/']<jupyter_text>Tracker Data> Ransomware Tracker offers feeds for Hosting- and Internet Service Providers, as well as for national CERTs / CSIRTs, Law Enforcement Agencies and other interested parties. The available feeds are described below. Unlike the blocklists provided by Ransomware Tracker, all feeds referenced below are being generated in real time whenever you hit it. Please be advised that it is recommended to not fetch any feed more often than once every 5 minutes.Reference: https://ransomwaretracker.abuse.ch/feeds/<jupyter_code>data = ransomware.get_tracker()
pprint(data[0:5])<jupyter_output>[Ransomware(timestamp=datetime.datetime(2018, 8, 12, 0, 46, 13), threat='c2', malware='locky', host='172.16.17.32', url='http://172.16.17.32/linuxsucks.php', status='offline', registrar=None, ipaddress='172.16.17.32', asn=199669, country='ru'),
 Ransomware(timestamp=datetime.datetime(2018, 8, 10, 5, 43, 15), threat='c2', malware='locky', host='pagaldaily.com', url='http://pagaldaily.com/apache_handler.php', status='offline', registrar='Danesco Trading Ltd.', ipaddress='172.16.31.10', asn=59729, country='bg'),
 Ransomware(timestamp=datetime.datetime(2018, 8, 10, 5, 43, 15), threat='c2', malware='locky', host='172.16.31.10', url='http://192.168.127.122/apache_handler.php', status='offline', registrar=None, ipaddress='172.16.31.10', asn=59729, country='bg'),
 Ransomware(timestamp=datetime.datetime(2018, 8, 9, 16, 50, 50), threat='c2', malware='locky', host='172.16.31.10', url='http://9192.168.3.1104/checkupdate', status='offline', registrar=None, ipaddress='172.16.31.10', asn=1238[...]
{'fraction_non_alphanumeric': 0.12095933263816476, 'fraction_numerical': 0.04358706986444213, 'mean_word_length': 6.517241379310345, 'pattern_counts': {'":': 0, '<': 20, '<?xml version=': 0, '>': 26, 'https://': 10, 'lorem ipsum': 0, 'www.': 1, 'xml': 0}, 'pii_count': 12, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 4, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'chain_length': '6', 'dir': 'jupyter-structured-clean-dedup', 'id': '594676', 'license': 'MIT', 'n_tokens_mistral': 1746, 'n_tokens_neox': 1545, 'n_words': 416, 'path': 'docs/ransomware_blacklist.ipynb', 'repo_name': 'threatlead/abusech', 'size': '4807'}