shadowbq-threatinator 0.5.0

data/spec/feeds/blocklist_de_bots-ip_reputation_spec.rb

@@ -0,0 +1,47 @@
+require 'spec_helper'
+
+describe 'feeds/blocklist_de_bots-ip_reputation.feed', :feed do
+  let(:provider) { 'blocklist_de' }
+  let(:name) { 'bots_ip_reputation' }
+  let(:event_types) { [:scanning]}
+
+
+  it_fetches_url 'http://www.blocklist.de/lists/bots.txt'
+
+  describe_parsing_the_file feed_data('blocklist_de_bots-ip-reputation.txt') do
+    it "should have parsed 13 records" do
+      expect(num_records_parsed).to eq(13)
+    end
+    it "should have filtered 2 records" do
+      expect(num_records_filtered).to eq(2)
+    end
+  end
+
+  describe_parsing_a_record '101.71.196.164' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:scanning) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['101.71.196.164'])) }
+    end
+  end
+
+  describe_parsing_a_record '200.93.43.157' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:scanning) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['200.93.43.157'])) }
+    end
+  end
+end

data/spec/feeds/blocklist_de_ftp-ip_reputation_spec.rb

@@ -0,0 +1,47 @@
+require 'spec_helper'
+
+describe 'feeds/blocklist_de_ftp-ip_reputation.feed', :feed do
+  let(:provider) { 'blocklist_de' }
+  let(:name) { 'ftp_ip_reputation' }
+  let(:event_types) { [:scanning]}
+
+
+  it_fetches_url 'http://www.blocklist.de/lists/ftp.txt'
+
+  describe_parsing_the_file feed_data('blocklist_de_ftp-ip-reputation.txt') do
+    it "should have parsed 7 records" do
+      expect(num_records_parsed).to eq(7)
+    end
+    it "should have filtered 0 records" do
+      expect(num_records_filtered).to eq(0)
+    end
+  end
+
+  describe_parsing_a_record '111.192.138.169' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:scanning) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['111.192.138.169'])) }
+    end
+  end
+
+  describe_parsing_a_record '112.198.77.229' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:scanning) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['112.198.77.229'])) }
+    end
+  end
+end

data/spec/feeds/blocklist_de_imap-ip_reputation_spec.rb

@@ -0,0 +1,47 @@
+require 'spec_helper'
+
+describe 'feeds/blocklist_de_imap-ip_reputation.feed', :feed do
+  let(:provider) { 'blocklist_de' }
+  let(:name) { 'imap_ip_reputation' }
+  let(:event_types) { [:scanning]}
+
+
+  it_fetches_url 'http://www.blocklist.de/lists/imap.txt'
+
+  describe_parsing_the_file feed_data('blocklist_de_imap-ip-reputation.txt') do
+    it "should have parsed 8 records" do
+      expect(num_records_parsed).to eq(8)
+    end
+    it "should have filtered 0 records" do
+      expect(num_records_filtered).to eq(0)
+    end
+  end
+
+  describe_parsing_a_record '1.93.46.156' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:scanning) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['1.93.46.156'])) }
+    end
+  end
+
+  describe_parsing_a_record '103.10.134.220' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:scanning) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['103.10.134.220'])) }
+    end
+  end
+end

data/spec/feeds/blocklist_de_pop3-ip_reputation_spec.rb

@@ -0,0 +1,47 @@
+require 'spec_helper'
+
+describe 'feeds/blocklist_de_pop3-ip_reputation.feed', :feed do
+  let(:provider) { 'blocklist_de' }
+  let(:name) { 'pop3_ip_reputation' }
+  let(:event_types) { [:scanning]}
+
+
+  it_fetches_url 'http://www.blocklist.de/lists/pop3.txt'
+
+  describe_parsing_the_file feed_data('blocklist_de_pop3-ip-reputation.txt') do
+    it "should have parsed 11 records" do
+      expect(num_records_parsed).to eq(11)
+    end
+    it "should have filtered 0 records" do
+      expect(num_records_filtered).to eq(0)
+    end
+  end
+
+  describe_parsing_a_record '1.175.64.9' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:scanning) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['1.175.64.9'])) }
+    end
+  end
+
+  describe_parsing_a_record '1.53.0.215' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:scanning) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['1.53.0.215'])) }
+    end
+  end
+end

data/spec/feeds/blocklist_de_proftpd-ip_reputation_spec.rb

@@ -0,0 +1,47 @@
+require 'spec_helper'
+
+describe 'feeds/blocklist_de_proftpd-ip_reputation.feed', :feed do
+  let(:provider) { 'blocklist_de' }
+  let(:name) { 'proftpd_ip_reputation' }
+  let(:event_types) { [:scanning]}
+
+
+  it_fetches_url 'http://www.blocklist.de/lists/proftpd.txt'
+
+  describe_parsing_the_file feed_data('blocklist_de_proftpd-ip-reputation.txt') do
+    it "should have parsed 12 records" do
+      expect(num_records_parsed).to eq(12)
+    end
+    it "should have filtered 0 records" do
+      expect(num_records_filtered).to eq(0)
+    end
+  end
+
+  describe_parsing_a_record '111.192.148.129' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:scanning) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['111.192.148.129'])) }
+    end
+  end
+
+  describe_parsing_a_record '112.90.37.220' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:scanning) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['112.90.37.220'])) }
+    end
+  end
+end

data/spec/feeds/blocklist_de_sip-ip_reputation_spec.rb

@@ -0,0 +1,47 @@
+require 'spec_helper'
+
+describe 'feeds/blocklist_de_sip-ip_reputation.feed', :feed do
+  let(:provider) { 'blocklist_de' }
+  let(:name) { 'sip_ip_reputation' }
+  let(:event_types) { [:scanning]}
+
+
+  it_fetches_url 'http://www.blocklist.de/lists/sip.txt'
+
+  describe_parsing_the_file feed_data('blocklist_de_sip-ip-reputation.txt') do
+    it "should have parsed 9 records" do
+      expect(num_records_parsed).to eq(9)
+    end
+    it "should have filtered 0 records" do
+      expect(num_records_filtered).to eq(0)
+    end
+  end
+
+  describe_parsing_a_record '178.32.229.159' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:scanning) }
+      its(:ipv4s) { is_expected.to eq(build(:ipv4s, values: ['178.32.229.159'])) }
+    end
+  end
+
+  describe_parsing_a_record '198.204.224.10' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:scanning) }
+      its(:ipv4s) { is_expected.to eq(build(:ipv4s, values: ['198.204.224.10'])) }
+    end
+  end
+end

data/spec/feeds/blocklist_de_ssh-ip_reputation_spec.rb

@@ -0,0 +1,47 @@
+require 'spec_helper'
+
+describe 'feeds/blocklist_de_ssh-ip_reputation.feed', :feed do
+  let(:provider) { 'blocklist_de' }
+  let(:name) { 'ssh_ip_reputation' }
+  let(:event_types) { [:scanning]}
+
+
+  it_fetches_url 'http://www.blocklist.de/lists/ssh.txt'
+
+  describe_parsing_the_file feed_data('blocklist_de_ssh-ip-reputation.txt') do
+    it "should have parsed 10 records" do
+      expect(num_records_parsed).to eq(10)
+    end
+    it "should have filtered 0 records" do
+      expect(num_records_filtered).to eq(0)
+    end
+  end
+
+  describe_parsing_a_record '1.93.24.83' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:scanning) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['1.93.24.83'])) }
+    end
+  end
+
+  describe_parsing_a_record '1.93.25.251' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:scanning) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['1.93.25.251'])) }
+    end
+  end
+end

data/spec/feeds/blocklist_de_strongips-ip_reputation_spec.rb

@@ -0,0 +1,47 @@
+require 'spec_helper'
+
+describe 'feeds/blocklist_de_strongips-ip_reputation.feed', :feed do
+  let(:provider) { 'blocklist_de' }
+  let(:name) { 'strongips_ip_reputation' }
+  let(:event_types) { [:scanning]}
+
+
+  it_fetches_url 'http://www.blocklist.de/lists/strongips.txt'
+
+  describe_parsing_the_file feed_data('blocklist_de_strongips-ip-reputation.txt') do
+    it "should have parsed 11 records" do
+      expect(num_records_parsed).to eq(11)
+    end
+    it "should have filtered 0 records" do
+      expect(num_records_filtered).to eq(0)
+    end
+  end
+
+  describe_parsing_a_record '188.143.232.211' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:scanning) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['188.143.232.211'])) }
+    end
+  end
+
+  describe_parsing_a_record '142.54.173.130' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:scanning) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['142.54.173.130'])) }
+    end
+  end
+end

data/spec/feeds/botscout-ip_reputation_spec.rb

@@ -0,0 +1,50 @@
+require 'spec_helper'
+
+describe 'feeds/botscout-ip_reputation.feed', :feed do
+  let(:provider) { 'botscout' }
+  let(:name) { 'ip_reputation' }
+  let(:event_types) { [:scanning]}
+
+
+  it_fetches_url 'http://botscout.com/last_caught_cache.htm'
+
+  describe_parsing_the_file feed_data('botscout-ip-reputation.txt') do
+    it "should have parsed 100 records" do
+      expect(num_records_parsed).to eq(100)
+    end
+    it "should have filtered 613 records" do
+      expect(num_records_filtered).to eq(613)
+    end
+    it "should have missed 0 records" do
+      expect(num_records_missed).to eq(0)
+    end
+  end
+
+  describe_parsing_a_record '<td><a href="/ipcheck.htm?ip=71.173.145.58">71.173.145.58</a></td>' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:scanning) }
+	  its(:ipv4s) { is_expected.to eq(build(:ipv4s, values: ['71.173.145.58'])) }
+    end
+  end
+
+  describe_parsing_a_record '<td><a href="/ipcheck.htm?ip=91.200.13.5">91.200.13.5</a></td>' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:scanning) }
+	  its(:ipv4s) { is_expected.to eq(build(:ipv4s, values: ['91.200.13.5'])) }
+    end
+  end
+end

data/spec/feeds/cert_mxpoison-ip_reputation_spec.rb

@@ -0,0 +1,47 @@
+require 'spec_helper'
+
+describe 'feeds/cert_mxpoison-ip_reputation.feed', :feed do
+  let(:provider) { 'cert' }
+  let(:name) { 'mxpoison_ip_reputation' }
+  let(:event_types) { [:scanning]}
+
+
+  it_fetches_url 'http://www.cert.org/downloads/mxlist.ips.txt'
+
+  describe_parsing_the_file feed_data('cert_mxpoison-ip_reputation.txt') do
+    it "should have parsed 17 records" do
+      expect(num_records_parsed).to eq(17)
+    end
+    it "should have filtered 0 records" do
+      expect(num_records_filtered).to eq(0)
+    end
+  end
+
+  describe_parsing_a_record '74.125.196.27' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:malware_host) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['74.125.196.27'])) }
+    end
+  end
+
+  describe_parsing_a_record '74.53.119.26' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:malware_host) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['74.53.119.26'])) }
+    end
+  end
+end

data/spec/feeds/chaosreigns-ip_reputation_spec.rb

@@ -0,0 +1,50 @@
+require 'spec_helper'
+
+describe 'feeds/chaosreigns-ip_reputation.feed', :feed do
+  let(:provider) { 'chaosreigns' }
+  let(:name) { 'ip_reputation' }
+  let(:event_types) { [:scanning]}
+
+
+  it_fetches_url 'http://www.chaosreigns.com/iprep/iprep.txt'
+
+  describe_parsing_the_file feed_data('chaosreigns-ip-reputation.txt') do
+    it "should have parsed 5 records" do
+      expect(num_records_parsed).to eq(5)
+    end
+    it "should have filtered 21 records" do
+      expect(num_records_filtered).to eq(21)
+    end
+    it "should have missed 0 records" do
+      expect(num_records_missed).to eq(0)
+    end
+  end
+
+  describe_parsing_a_record '       5.9.94.3     0    17' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:scanning) }
+	  its(:ipv4s) { is_expected.to eq(build(:ipv4s, values: ['5.9.94.3'])) }
+    end
+  end
+
+  describe_parsing_a_record '       1.52.9.7     0     0' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:scanning) }
+	  its(:ipv4s) { is_expected.to eq(build(:ipv4s, values: ['1.52.9.7'])) }
+    end
+  end
+end

data/spec/feeds/ciarmy-ip_reputation_spec.rb

@@ -0,0 +1,47 @@
+require 'spec_helper'
+
+describe 'feeds/ciarmy-ip_reputation.feed', :feed do
+  let(:provider) { 'ciarmy' }
+  let(:name) { 'ip_reputation' }
+  let(:event_types) { [:scanning]}
+
+
+  it_fetches_url 'http://www.ciarmy.com/list/ci-badguys.txt'
+
+  describe_parsing_the_file feed_data('ciarmy-ip-reputation.txt') do
+    it "should have parsed 11 records" do
+      expect(num_records_parsed).to eq(11)
+    end
+    it "should have filtered 0 records" do
+      expect(num_records_filtered).to eq(0)
+    end
+  end
+
+  describe_parsing_a_record '5.79.68.161' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:scanning) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['5.79.68.161'])) }
+    end
+  end
+
+  describe_parsing_a_record '10.0.100.121' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:scanning) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['10.0.100.121'])) }
+    end
+  end
+end

data/spec/feeds/cruzit-ip_reputation_spec.rb

@@ -0,0 +1,47 @@
+require 'spec_helper'
+
+describe 'feeds/cruzit-ip_reputation.feed', :feed do
+  let(:provider) { 'cruzit' }
+  let(:name) { 'ip_reputation' }
+  let(:event_types) { [:scanning]}
+
+
+  it_fetches_url 'http://www.cruzit.com/xwbl2txt.php'
+
+  describe_parsing_the_file feed_data('cruzit-ip-reputation.txt') do
+    it "should have parsed 14 records" do
+      expect(num_records_parsed).to eq(14)
+    end
+    it "should have filtered 0 records" do
+      expect(num_records_filtered).to eq(0)
+    end
+  end
+
+  describe_parsing_a_record '107.170.248.56' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:scanning) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['107.170.248.56'])) }
+    end
+  end
+
+  describe_parsing_a_record '80.82.64.114' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:scanning) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['80.82.64.114'])) }
+    end
+  end
+end

data/spec/feeds/cydef_torexit-ip_reputation_spec.rb

@@ -0,0 +1,47 @@
+require 'spec_helper'
+
+describe 'feeds/cydef_torexit-ip_reputation.feed', :feed do
+  let(:provider) { 'cydef' }
+  let(:name) { 'torexit_ip_reputation' }
+  let(:event_types) { [:scanning]}
+
+
+  it_fetches_url 'https://cydef.us/torexit.txt'
+
+  describe_parsing_the_file feed_data('cydef_torexit-ip_reputation.txt') do
+    it "should have parsed 26 records" do
+      expect(num_records_parsed).to eq(26)
+    end
+    it "should have filtered 1 records" do
+      expect(num_records_filtered).to eq(1)
+    end
+  end
+
+  describe_parsing_a_record '5.9.195.140' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:scanning) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['5.9.195.140'])) }
+    end
+  end
+
+  describe_parsing_a_record '5.45.104.141' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:scanning) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['5.45.104.141'])) }
+    end
+  end
+end