<commit_before># -*- coding: utf-8 -*-
# -------------------------------------------------------------------------------
# Name:         sfp_abusech
# Purpose:      Checks if an ASN, IP or domain is malicious.
#
# Author:       <EMAIL>
#
# Created:     14/12/2013
# Copyright:   (c) <NAME>, 2013
# Licence:     GPL
# -------------------------------------------------------------------------------

from netaddr import IPAddress, IPNetwork
import re

from sflib import SpiderFoot, SpiderFootPlugin, SpiderFootEvent

malchecks = {
    'abuse.ch Zeus Tracker (Domain)': {
        'id': 'abusezeusdomain',
        'type': 'list',
        'checks': ['domain'],
        'url': 'https://zeustracker.abuse.ch/blocklist.php?download=baddomains'
    },
    'abuse.ch Zeus Tracker (IP)': {
        'id': 'abusezeusip',
        'type': 'list',
        'checks': ['ip', 'netblock'],
        'url': 'https://zeustracker.abuse.ch/blocklist.php?download=badips'
    },
    'abuse.ch Feodo Tracker (IP)': {
        'id': 'abusefeodoip',
        'type': 'list',
        'checks': ['ip', 'netblock'],
        'url': 'https://feodotracker.abuse.ch/downloads/ipblocklist.txt'
    },
    'abuse.ch SSL Blacklist (IP)': {
        'id': 'abusesslblip',
        'type': 'list',
        'checks': ['ip', 'netblock'],
        'url': 'https://sslbl.abuse.ch/blacklist/sslipblacklist.csv',
        'regex': '{0},.*'
    },
    'abuse.ch URLhaus (Domain)': {
        'id': 'abuseurlhaus',
        'type': 'list',
        'checks': ['domain'],
        'url': 'https://urlhaus.abuse.ch/downloads/csv/',
        'regex': '.*//{0}/.*'
    },
    'abuse.ch Ransomware Blocklist (Domain)': {
        'id': 'abuseransomdom',
        'type': 'list',
        'checks': ['domain'],
        'url': 'https://ransomwaretracker.abuse.ch/downloads/RW_DOMBL.txt',
        'regex': '^{0}$'
    }
}

class sfp_abusech(SpiderFootPlugin):
meta = {
        'name': "abuse.ch",
        'summary': "Check if a host/domain, IP or netblock is malicious according to abuse.ch.",
        'flags': [],
        'useCases': [ "Passive", "Investigate" ],
        'categories': [ "Reputation Systems" ],
        'dataSource': {
            'website': "https://www.abuse.ch",
            'model': "FREE_AUTH_UNLIMITED",
            'references': [
                "https://bazaar.abuse.ch/",
                "https://feodotracker.abuse.ch/",
                "https://igotphished.abuse.ch/",
                "https://sslbl.abuse.ch/",
                "https://urlhaus.abuse.ch/"
            ],
            'apiKeyInstructions': [
                "Visit https://bazaar.abuse.ch/api#api_key",
                "Login using a Twitter Account",
                "Navigate to 'Account Settings'",
                "The API key is listed under 'Your API Key'",
                "Visit https://igotphished.abuse.ch/api/",
                "Request an API key from the email listed under 'Submit data to I Got Phished'",
                "Visit urlhaus.abuse.ch/api/",
                "Login using a Twitter Account at urlhaus.abuse.ch/login/",
                "Navigate to urlhaus.abuse.ch/api/#account",
                "The API Key is listed under 'API-Key'"
            ],<commit_msg>Indentation fix<commit_after># -*- coding: utf-8 -*-
# -------------------------------------------------------------------------------
# Name:         sfp_abusech
# Purpose:      Checks if an ASN, IP or domain is malicious.
#
# Author:       <EMAIL>
#
# Created:     14/12/2013
# Copyright:   (c) <NAME>, 2013
# Licence:     GPL
# -------------------------------------------------------------------------------

from netaddr import IPAddress, IPNetwork
import re

from sflib import SpiderFoot, SpiderFootPlugin, SpiderFootEvent

malchecks = {
    'abuse.ch Zeus Tracker (Domain)': {
        'id': 'abusezeusdomain',
        'type': 'list',
        'checks': ['domain'],
        'url': 'https://zeustracker.abuse.ch/blocklist.php?download=baddomains'
    },
    'abuse.ch Zeus Tracker (IP)': {
        'id': 'abusezeusip',
        'type': 'list',
        'checks': ['ip', 'netblock'],
        'url': 'https://zeustracker.abuse.ch/blocklist.php?download=badips'
    },
    'abuse.ch Feodo Tracker (IP)': {
        'id': 'abusefeodoip',
        'type': 'list',
        'checks': ['ip', 'netblock'],
        'url': 'https://feodotracker.abuse.ch/downloads/ipblocklist.txt'
    },
    'abuse.ch SSL Blacklist (IP)': {
        'id': 'abusesslblip',
        'type': 'list',
        'checks': ['ip', 'netblock'],
        'url': 'https://sslbl.abuse.ch/blacklist/sslipblacklist.csv',
        'regex': '{0},.*'
    },
    'abuse.ch URLhaus (Domain)': {
        'id': 'abuseurlhaus',
        'type': 'list',
        'checks': ['domain'],
        'url': 'https://urlhaus.abuse.ch/downloads/csv/',
        'regex': '.*//{0}/.*'
    },
    'abuse.ch Ransomware Blocklist (Domain)': {
        'id': 'abuseransomdom',
        'type': 'list',
        'checks': ['domain'],
        'url': 'https://ransomwaretracker.abuse.ch/downloads/RW_DOMBL.txt',
        'regex': '^{0}$'
    }
}

class sfp_abusech(SpiderFootPlugin):
    meta = {
        'name': "abuse.ch",
        'summary': "Check if a host/domain, IP or netblock is malicious according to abuse.ch.",
        'flags': [],
        'useCases': [ "Passive", "Investigate" ],
        'categories': [ "Reputation Systems" ],
        'dataSource': {
            'website': "https://www.abuse.ch",
            'model': "FREE_AUTH_UNLIMITED",
            'references': [
                "https://bazaar.abuse.ch/",
                "https://feodotracker.abuse.ch/",
                "https://igotphished.abuse.ch/",
                "https://sslbl.abuse.ch/",
                "https://urlhaus.abuse.ch/"
            ],
            'apiKeyInstructions': [
                "Visit https://bazaar.abuse.ch/api#api_key",
                "Login using a Twitter Account",
                "Navigate to 'Account Settings'",
                "The API key is listed under 'Your API Key'",
                "Visit https://igotphished.abuse.ch/api/",
                "Request an API key from the email listed under 'Submit data to I Got Phished'",
                "Visit urlhaus.abuse.ch/api/",
                "Login using a Twitter Account at urlhaus.abuse.ch/login/",
                "Navigate to urlhaus.abuse.ch/api/#account",
                "The API Key is listed under 'API-Key'"
            ],
{'fraction_non_alphanumeric': 0.21475256769374415, 'fraction_numerical': 0.004979769685652039, 'mean_word_length': 1.707245155855097, 'pattern_counts': {'":': 0, '<': 7, '<?xml version=': 0, '>': 7, 'https://': 28, 'lorem ipsum': 0, 'www.': 2, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 10, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '1513153', 'n_tokens_mistral': 2095, 'n_tokens_neox': 2008, 'n_words': 425}