shadowbq-threatinator 0.5.0

Sign up to get free protection for your applications and to get access to all the features.
Files changed (389) hide show
  1. checksums.yaml +7 -0
  2. data/CHANGELOG.md +66 -0
  3. data/CONTRIBUTING.md +119 -0
  4. data/Gemfile +38 -0
  5. data/LICENSE +165 -0
  6. data/README.md +101 -0
  7. data/Rakefile +47 -0
  8. data/VERSION +1 -0
  9. data/bin/threatinator +5 -0
  10. data/bin/threatinator_loader +21 -0
  11. data/feeds/ET_block-ip_reputation.feed +27 -0
  12. data/feeds/ET_compromised-ip_reputation.feed +20 -0
  13. data/feeds/ET_openbadlist-ip_reputation.feed +36 -0
  14. data/feeds/alienvault-ip_reputation.feed +39 -0
  15. data/feeds/arbor_fastflux-domain_reputation.feed +19 -0
  16. data/feeds/arbor_ssh-ip_reputation.feed +24 -0
  17. data/feeds/autoshun_shunlist.feed +17 -0
  18. data/feeds/bambenek_c2_masterlist-domain_reputation.feed +16 -0
  19. data/feeds/bambenek_c2_masterlist-ip_reputation.feed +16 -0
  20. data/feeds/bambenek_dga_feed-domain_reputation.feed +16 -0
  21. data/feeds/berkeley-ip_reputation.feed +25 -0
  22. data/feeds/bitcash_cz_blacklist.feed +22 -0
  23. data/feeds/blocklist_de_apache-ip_reputation.feed +26 -0
  24. data/feeds/blocklist_de_bots-ip_reputation.feed +26 -0
  25. data/feeds/blocklist_de_ftp-ip_reputation.feed +25 -0
  26. data/feeds/blocklist_de_imap-ip_reputation.feed +25 -0
  27. data/feeds/blocklist_de_pop3-ip_reputation.feed +26 -0
  28. data/feeds/blocklist_de_proftpd-ip_reputation.feed +26 -0
  29. data/feeds/blocklist_de_sip-ip_reputation.feed +25 -0
  30. data/feeds/blocklist_de_ssh-ip_reputation.feed +25 -0
  31. data/feeds/blocklist_de_strongips-ip_reputation.feed +25 -0
  32. data/feeds/botscout-ip_reputation.feed +25 -0
  33. data/feeds/cert_mxpoison-ip_reputation.feed +22 -0
  34. data/feeds/chaosreigns-ip_reputation.feed +37 -0
  35. data/feeds/ciarmy-ip_reputation.feed +20 -0
  36. data/feeds/cruzit-ip_reputation.feed +30 -0
  37. data/feeds/cydef_torexit-ip_reputation.feed +25 -0
  38. data/feeds/dan_me_uk_torlist-ip_reputation.feed +25 -0
  39. data/feeds/danger_bruteforce-ip_reputation.feed +24 -0
  40. data/feeds/dshield_attackers-top1000.feed +34 -0
  41. data/feeds/falconcrest-ip_reputation.feed +19 -0
  42. data/feeds/feodo-domain_reputation.feed +19 -0
  43. data/feeds/feodo-ip_reputation.feed +20 -0
  44. data/feeds/h3x_asprox.feed +18 -0
  45. data/feeds/hosts-file_hphostspartial-domain_reputation.feed +19 -0
  46. data/feeds/infiltrated-ip_reputation.feed +26 -0
  47. data/feeds/infiltrated_vabl-ip_reputation.feed +30 -0
  48. data/feeds/isc_suspicious_high-domain_reputation.feed +26 -0
  49. data/feeds/isc_suspicious_low-domain_reputation.feed +26 -0
  50. data/feeds/isc_suspicious_medium-domain_reputation.feed +26 -0
  51. data/feeds/malc0de-domain_reputation.feed +24 -0
  52. data/feeds/malc0de-ip_reputation.feed +26 -0
  53. data/feeds/malwaredomainlist-url_reputation.feed +18 -0
  54. data/feeds/malwaredomains-domain_reputation.feed +29 -0
  55. data/feeds/malwaredomains_dyndns-domain_reputation.feed +29 -0
  56. data/feeds/malwaredomains_justdomains-domain_reputation.feed +20 -0
  57. data/feeds/mirc-domain_reputation.feed +30 -0
  58. data/feeds/multiproxy-ip_reputation.feed +22 -0
  59. data/feeds/nothink_irc-ip_reputation.feed +23 -0
  60. data/feeds/nothink_ssh-ip_reputation.feed +21 -0
  61. data/feeds/openbl-ip_reputation.feed +21 -0
  62. data/feeds/openphish-url_reputation.feed +24 -0
  63. data/feeds/packetmail_perimeterbad-ip_reputation.feed +28 -0
  64. data/feeds/palevo-domain_reputation.feed +22 -0
  65. data/feeds/palevo-ip_reputation.feed +23 -0
  66. data/feeds/phishtank.feed +22 -0
  67. data/feeds/sigmaproject_atma.feed +27 -0
  68. data/feeds/sigmaproject_spyware.feed +28 -0
  69. data/feeds/sigmaproject_webexploit.feed +26 -0
  70. data/feeds/snort_bpf-ip_reputation.feed +19 -0
  71. data/feeds/spyeye-domain_reputation.feed +18 -0
  72. data/feeds/spyeye-ip_reputation.feed +19 -0
  73. data/feeds/steeman-ip_reputation.feed +20 -0
  74. data/feeds/t-arend-de_ssh-ip_reputation.feed +20 -0
  75. data/feeds/the_haleys_ssh-ip_reputation.feed +20 -0
  76. data/feeds/trustedsec-ip_reputation.feed +18 -0
  77. data/feeds/virbl-ip_reputation.feed +25 -0
  78. data/feeds/vxvault-url_reputation.feed +23 -0
  79. data/feeds/yourcmc_ssh-ip_reputation.feed +20 -0
  80. data/feeds/yoyo_adservers-domain_reputation.feed +17 -0
  81. data/feeds/zeus-domain_reputation.feed +19 -0
  82. data/feeds/zeus-ip_reputation.feed +21 -0
  83. data/lib/threatinator/action.rb +14 -0
  84. data/lib/threatinator/actions/list/action.rb +97 -0
  85. data/lib/threatinator/actions/list/config.rb +12 -0
  86. data/lib/threatinator/actions/list.rb +2 -0
  87. data/lib/threatinator/actions/run/action.rb +57 -0
  88. data/lib/threatinator/actions/run/config.rb +32 -0
  89. data/lib/threatinator/actions/run/coverage_observer.rb +59 -0
  90. data/lib/threatinator/actions/run/output_config.rb +59 -0
  91. data/lib/threatinator/actions/run/status_observer.rb +37 -0
  92. data/lib/threatinator/actions/run.rb +2 -0
  93. data/lib/threatinator/cli/action_builder.rb +33 -0
  94. data/lib/threatinator/cli/list_action_builder.rb +19 -0
  95. data/lib/threatinator/cli/parser.rb +123 -0
  96. data/lib/threatinator/cli/run_action_builder.rb +41 -0
  97. data/lib/threatinator/cli.rb +19 -0
  98. data/lib/threatinator/config/base.rb +35 -0
  99. data/lib/threatinator/config/feed_search.rb +25 -0
  100. data/lib/threatinator/config/logger.rb +14 -0
  101. data/lib/threatinator/config.rb +7 -0
  102. data/lib/threatinator/decoder.rb +24 -0
  103. data/lib/threatinator/decoders/gzip.rb +30 -0
  104. data/lib/threatinator/event.rb +63 -0
  105. data/lib/threatinator/event_builder.rb +70 -0
  106. data/lib/threatinator/exceptions.rb +58 -0
  107. data/lib/threatinator/feed.rb +88 -0
  108. data/lib/threatinator/feed_builder.rb +161 -0
  109. data/lib/threatinator/feed_registry.rb +47 -0
  110. data/lib/threatinator/feed_runner.rb +177 -0
  111. data/lib/threatinator/fetcher.rb +22 -0
  112. data/lib/threatinator/fetchers/http.rb +50 -0
  113. data/lib/threatinator/filter.rb +12 -0
  114. data/lib/threatinator/filters/block.rb +18 -0
  115. data/lib/threatinator/filters/comments.rb +16 -0
  116. data/lib/threatinator/filters/whitespace.rb +19 -0
  117. data/lib/threatinator/logger.rb +66 -0
  118. data/lib/threatinator/logging.rb +20 -0
  119. data/lib/threatinator/model/base.rb +23 -0
  120. data/lib/threatinator/model/collection.rb +89 -0
  121. data/lib/threatinator/model/observables/fqdn_collection.rb +15 -0
  122. data/lib/threatinator/model/observables/ipv4.rb +33 -0
  123. data/lib/threatinator/model/observables/ipv4_collection.rb +14 -0
  124. data/lib/threatinator/model/observables/url_collection.rb +16 -0
  125. data/lib/threatinator/model/validations/type.rb +21 -0
  126. data/lib/threatinator/model/validations.rb +1 -0
  127. data/lib/threatinator/output.rb +50 -0
  128. data/lib/threatinator/parser.rb +23 -0
  129. data/lib/threatinator/parsers/csv/parser.rb +77 -0
  130. data/lib/threatinator/parsers/csv.rb +7 -0
  131. data/lib/threatinator/parsers/getline/parser.rb +45 -0
  132. data/lib/threatinator/parsers/getline.rb +8 -0
  133. data/lib/threatinator/parsers/json/adapters/oj.rb +65 -0
  134. data/lib/threatinator/parsers/json/parser.rb +45 -0
  135. data/lib/threatinator/parsers/json/record.rb +20 -0
  136. data/lib/threatinator/parsers/json.rb +8 -0
  137. data/lib/threatinator/parsers/xml/node.rb +79 -0
  138. data/lib/threatinator/parsers/xml/node_builder.rb +39 -0
  139. data/lib/threatinator/parsers/xml/parser.rb +44 -0
  140. data/lib/threatinator/parsers/xml/path.rb +70 -0
  141. data/lib/threatinator/parsers/xml/pattern.rb +53 -0
  142. data/lib/threatinator/parsers/xml/record.rb +14 -0
  143. data/lib/threatinator/parsers/xml/sax_document.rb +64 -0
  144. data/lib/threatinator/parsers/xml.rb +8 -0
  145. data/lib/threatinator/plugin_loader.rb +115 -0
  146. data/lib/threatinator/plugins/output/amqp/config.rb +18 -0
  147. data/lib/threatinator/plugins/output/amqp.rb +41 -0
  148. data/lib/threatinator/plugins/output/csv.rb +58 -0
  149. data/lib/threatinator/plugins/output/json/config.rb +14 -0
  150. data/lib/threatinator/plugins/output/json.rb +53 -0
  151. data/lib/threatinator/plugins/output/null.rb +17 -0
  152. data/lib/threatinator/plugins/output/rubydebug.rb +16 -0
  153. data/lib/threatinator/record.rb +22 -0
  154. data/lib/threatinator/registry.rb +53 -0
  155. data/lib/threatinator/util.rb +15 -0
  156. data/lib/threatinator.rb +3 -0
  157. data/spec/feeds/ET_block-ip_reputation_spec.rb +50 -0
  158. data/spec/feeds/ET_compromised-ip_reputation_spec.rb +47 -0
  159. data/spec/feeds/ET_openbadlist-ip_reputation_spec.rb +56 -0
  160. data/spec/feeds/alienvault-ip_reputation_spec.rb +46 -0
  161. data/spec/feeds/arbor_fastflux-domain_reputation_spec.rb +46 -0
  162. data/spec/feeds/arbor_ssh-ip_reputation_spec.rb +46 -0
  163. data/spec/feeds/autoshun_shunlist_spec.rb +38 -0
  164. data/spec/feeds/bambenek_c2_masterlist-domain_reputation_spec.rb +38 -0
  165. data/spec/feeds/bambenek_c2_masterlist-ip_reputation_spec.rb +39 -0
  166. data/spec/feeds/bambenek_dga_feed-domain_reputation_spec.rb +39 -0
  167. data/spec/feeds/berkeley-ip_reputation_spec.rb +47 -0
  168. data/spec/feeds/bitcash_cz_blacklist-ip_reputation_spec.rb +50 -0
  169. data/spec/feeds/blocklist_de_apache-ip_reputation_spec.rb +47 -0
  170. data/spec/feeds/blocklist_de_bots-ip_reputation_spec.rb +47 -0
  171. data/spec/feeds/blocklist_de_ftp-ip_reputation_spec.rb +47 -0
  172. data/spec/feeds/blocklist_de_imap-ip_reputation_spec.rb +47 -0
  173. data/spec/feeds/blocklist_de_pop3-ip_reputation_spec.rb +47 -0
  174. data/spec/feeds/blocklist_de_proftpd-ip_reputation_spec.rb +47 -0
  175. data/spec/feeds/blocklist_de_sip-ip_reputation_spec.rb +47 -0
  176. data/spec/feeds/blocklist_de_ssh-ip_reputation_spec.rb +47 -0
  177. data/spec/feeds/blocklist_de_strongips-ip_reputation_spec.rb +47 -0
  178. data/spec/feeds/botscout-ip_reputation_spec.rb +50 -0
  179. data/spec/feeds/cert_mxpoison-ip_reputation_spec.rb +47 -0
  180. data/spec/feeds/chaosreigns-ip_reputation_spec.rb +50 -0
  181. data/spec/feeds/ciarmy-ip_reputation_spec.rb +47 -0
  182. data/spec/feeds/cruzit-ip_reputation_spec.rb +47 -0
  183. data/spec/feeds/cydef_torexit-ip_reputation_spec.rb +47 -0
  184. data/spec/feeds/dan_me_uk_torlist-ip_reputation_spec.rb +47 -0
  185. data/spec/feeds/danger_bruteforce-ip_reputation_spec.rb +47 -0
  186. data/spec/feeds/data/ET_block-ip_reputation.txt +80 -0
  187. data/spec/feeds/data/ET_compromised-ip_reputation.txt +11 -0
  188. data/spec/feeds/data/ET_openbadlist-ip_reputation.txt +62 -0
  189. data/spec/feeds/data/alienvault-ip_reputation.txt +18 -0
  190. data/spec/feeds/data/arbor_domainlist.txt +11 -0
  191. data/spec/feeds/data/arbor_ssh.txt +16 -0
  192. data/spec/feeds/data/autoshun_shunlist.csv +20 -0
  193. data/spec/feeds/data/bambenek_c2-dommasterlist.csv +30 -0
  194. data/spec/feeds/data/bambenek_c2-ipmasterlist.csv +27 -0
  195. data/spec/feeds/data/bambenek_dga_feed.csv +42 -0
  196. data/spec/feeds/data/berkeley.txt +29 -0
  197. data/spec/feeds/data/bitcash_cz_blacklist.txt +7 -0
  198. data/spec/feeds/data/blocklist_de_apache-ip-reputation.txt +17 -0
  199. data/spec/feeds/data/blocklist_de_bots-ip-reputation.txt +15 -0
  200. data/spec/feeds/data/blocklist_de_ftp-ip-reputation.txt +7 -0
  201. data/spec/feeds/data/blocklist_de_imap-ip-reputation.txt +8 -0
  202. data/spec/feeds/data/blocklist_de_pop3-ip-reputation.txt +11 -0
  203. data/spec/feeds/data/blocklist_de_proftpd-ip-reputation.txt +12 -0
  204. data/spec/feeds/data/blocklist_de_sip-ip-reputation.txt +9 -0
  205. data/spec/feeds/data/blocklist_de_ssh-ip-reputation.txt +10 -0
  206. data/spec/feeds/data/blocklist_de_strongips-ip-reputation.txt +11 -0
  207. data/spec/feeds/data/botscout-ip-reputation.txt +713 -0
  208. data/spec/feeds/data/cert_mxpoison-ip_reputation.txt +17 -0
  209. data/spec/feeds/data/chaosreigns-ip-reputation.txt +26 -0
  210. data/spec/feeds/data/ciarmy-ip-reputation.txt +11 -0
  211. data/spec/feeds/data/cruzit-ip-reputation.txt +14 -0
  212. data/spec/feeds/data/cydef_torexit-ip_reputation.txt +27 -0
  213. data/spec/feeds/data/dan_me_uk_torlist-ip-reputation.txt +11 -0
  214. data/spec/feeds/data/danger_bruteforce-ip_reputation.txt +12 -0
  215. data/spec/feeds/data/dshield_topattackers.xml +4 -0
  216. data/spec/feeds/data/falconcrest_iplist.txt +345 -0
  217. data/spec/feeds/data/feodo_domainlist.txt +18 -0
  218. data/spec/feeds/data/feodo_iplist.txt +20 -0
  219. data/spec/feeds/data/h3x_asprox.txt +20 -0
  220. data/spec/feeds/data/hosts-file_hphostspartial_domainlist.txt +24 -0
  221. data/spec/feeds/data/infiltrated_iplist.txt +16 -0
  222. data/spec/feeds/data/infiltrated_vabl_iplist.txt +33 -0
  223. data/spec/feeds/data/isc_suspicious_high_domainlist.txt +26 -0
  224. data/spec/feeds/data/isc_suspicious_low_domainlist.txt +34 -0
  225. data/spec/feeds/data/isc_suspicious_medium_domainlist.txt +32 -0
  226. data/spec/feeds/data/malc0de_domainlist.txt +18 -0
  227. data/spec/feeds/data/malc0de_iplist.txt +14 -0
  228. data/spec/feeds/data/malwaredomainlist-url-reputation.txt +8 -0
  229. data/spec/feeds/data/malwaredomains_domainlist.txt +24 -0
  230. data/spec/feeds/data/malwaredomains_dyndns_domainlist.txt +34 -0
  231. data/spec/feeds/data/malwaredomains_justdomains_domainlist.txt +18 -0
  232. data/spec/feeds/data/mirc_domainlist.txt +31 -0
  233. data/spec/feeds/data/multiproxy_iplist.txt +15 -0
  234. data/spec/feeds/data/nothink_irc_iplist.txt +14 -0
  235. data/spec/feeds/data/nothink_ssh_iplist.txt +10 -0
  236. data/spec/feeds/data/openbl_iplist.txt +12 -0
  237. data/spec/feeds/data/openphish-url-reputation.txt +16 -0
  238. data/spec/feeds/data/packetmail_perimeterbad-ip_reputation.txt +44 -0
  239. data/spec/feeds/data/palevo_domainlist.txt +25 -0
  240. data/spec/feeds/data/palevo_iplist.txt +24 -0
  241. data/spec/feeds/data/phishtank-sample.json.gz +0 -0
  242. data/spec/feeds/data/sigmaproject_atma.return.gz +0 -0
  243. data/spec/feeds/data/sigmaproject_spyware.return.gz +0 -0
  244. data/spec/feeds/data/sigmaproject_webexploit.return.gz +0 -0
  245. data/spec/feeds/data/snort_bpf-ip_reputation.txt +16 -0
  246. data/spec/feeds/data/spyeye_domainlist.txt +16 -0
  247. data/spec/feeds/data/spyeye_iplist.txt +19 -0
  248. data/spec/feeds/data/steeman-ip-reputation.txt +13 -0
  249. data/spec/feeds/data/t-arend-de_ssh_iplist.txt +17 -0
  250. data/spec/feeds/data/the_haleys_ssh_iplist.txt +12 -0
  251. data/spec/feeds/data/trustedsec-ip-reputation.txt +12 -0
  252. data/spec/feeds/data/valid.json +2908 -0
  253. data/spec/feeds/data/virbl-ip_reputation.txt +14 -0
  254. data/spec/feeds/data/vxvault-url-reputation.txt +15 -0
  255. data/spec/feeds/data/yourcmc_ssh-ip_reputation.txt +27 -0
  256. data/spec/feeds/data/yoyo_adservers.txt +25 -0
  257. data/spec/feeds/data/zeus-ip_reputation.txt +285 -0
  258. data/spec/feeds/data/zeus_domainlist.txt +27 -0
  259. data/spec/feeds/dshield_attackers-top1000_spec.rb +39 -0
  260. data/spec/feeds/falconcrest-ip_reputation_spec.rb +39 -0
  261. data/spec/feeds/feodo-domain_reputation_spec.rb +47 -0
  262. data/spec/feeds/feodo-ip_reputation_spec.rb +47 -0
  263. data/spec/feeds/h3x_asprox-ip_reputation_spec.rb +50 -0
  264. data/spec/feeds/hosts-file_hphostspartial-domain_reputation_spec.rb +47 -0
  265. data/spec/feeds/infiltrated-ip_reputation_spec.rb +47 -0
  266. data/spec/feeds/infiltrated_vabl-ip_reputation_spec.rb +47 -0
  267. data/spec/feeds/isc_suspicious_high-domain_reputation_spec.rb +47 -0
  268. data/spec/feeds/isc_suspicious_low-domain_reputation_spec.rb +47 -0
  269. data/spec/feeds/isc_suspicious_medium-domain_reputation_spec.rb +47 -0
  270. data/spec/feeds/malc0de-domain_reputation_spec.rb +47 -0
  271. data/spec/feeds/malc0de-ip_reputation_spec.rb +47 -0
  272. data/spec/feeds/malwaredomainlist_url_reputation_spec.rb +50 -0
  273. data/spec/feeds/malwaredomains-domain_reputation_spec.rb +47 -0
  274. data/spec/feeds/malwaredomains_dyndns-domain_reputation_spec.rb +47 -0
  275. data/spec/feeds/malwaredomains_justdomains-domain_reputation_spec.rb +47 -0
  276. data/spec/feeds/mirc-domain_reputation_spec.rb +47 -0
  277. data/spec/feeds/multiproxy-ip_reputation_spec.rb +47 -0
  278. data/spec/feeds/nothink_irc-ip_reputation_spec.rb +47 -0
  279. data/spec/feeds/nothink_ssh-ip_reputation_spec.rb +47 -0
  280. data/spec/feeds/openbl-ip_reputation_spec.rb +47 -0
  281. data/spec/feeds/openphish_url_reputation_spec.rb +50 -0
  282. data/spec/feeds/packetmail_perimeterbad-ip_reputation_spec.rb +47 -0
  283. data/spec/feeds/palevo-domain_reputation_spec.rb +47 -0
  284. data/spec/feeds/palevo-ip_reputation_spec.rb +47 -0
  285. data/spec/feeds/phishtank_spec.rb +41 -0
  286. data/spec/feeds/sigmaproject_atma_spec.rb +62 -0
  287. data/spec/feeds/sigmaproject_spyware_spec.rb +63 -0
  288. data/spec/feeds/sigmaproject_webexploit_spec.rb +62 -0
  289. data/spec/feeds/snort_bpf-ip_reputation_spec.rb +47 -0
  290. data/spec/feeds/spyeye-domain_reputation_spec.rb +47 -0
  291. data/spec/feeds/spyeye-ip_reputation_spec.rb +47 -0
  292. data/spec/feeds/steeman-ip_reputation_spec.rb +50 -0
  293. data/spec/feeds/t-arend-de_ssh-ip_reputation_spec.rb +47 -0
  294. data/spec/feeds/the_haleys_ssh-ip_reputation_spec.rb +47 -0
  295. data/spec/feeds/trustedsec-ip_reputation_spec.rb +47 -0
  296. data/spec/feeds/virbl-ip_reputation_spec.rb +47 -0
  297. data/spec/feeds/vxvault_url_reputation_spec.rb +50 -0
  298. data/spec/feeds/yourcmc_ssh-ip_reputation_spec.rb +47 -0
  299. data/spec/feeds/yoyo_adservers_spec.rb +47 -0
  300. data/spec/feeds/zeus-domain_reputation_spec.rb +47 -0
  301. data/spec/feeds/zeus-ip_reputation_spec.rb +47 -0
  302. data/spec/fixtures/feed/provider1/feed1.feed +6 -0
  303. data/spec/fixtures/parsers/test.xml +13 -0
  304. data/spec/fixtures/parsers/test_self_closing.xml +20 -0
  305. data/spec/fixtures/plugins/bad/threatinator/plugins/test_error1/plugin.rb +1 -0
  306. data/spec/fixtures/plugins/bad/threatinator/plugins/test_missing1/plugin.rb +0 -0
  307. data/spec/fixtures/plugins/fake.rb +19 -0
  308. data/spec/fixtures/plugins/good/threatinator/plugins/test_type1/plugin_a.rb +8 -0
  309. data/spec/fixtures/plugins/good/threatinator/plugins/test_type1/plugin_b.rb +8 -0
  310. data/spec/fixtures/plugins/good/threatinator/plugins/test_type2/plugin_c.rb +8 -0
  311. data/spec/fixtures/plugins/good/threatinator/plugins/test_type2/plugin_d.rb +8 -0
  312. data/spec/fixtures/plugins/good/threatinator/plugins/test_type3/plugin_e.rb +8 -0
  313. data/spec/fixtures/plugins/good/threatinator/plugins/test_type3/plugin_f.rb +8 -0
  314. data/spec/spec_helper.rb +54 -0
  315. data/spec/support/bad_feeds/missing_fetcher.feed +7 -0
  316. data/spec/support/bad_feeds/missing_name.feed +6 -0
  317. data/spec/support/bad_feeds/missing_parser.feed +3 -0
  318. data/spec/support/bad_feeds/missing_provider.feed +5 -0
  319. data/spec/support/factories/event.rb +31 -0
  320. data/spec/support/factories/feed.rb +59 -0
  321. data/spec/support/factories/feed_builder.rb +65 -0
  322. data/spec/support/factories/feed_registry.rb +8 -0
  323. data/spec/support/factories/ipv4.rb +36 -0
  324. data/spec/support/factories/output.rb +11 -0
  325. data/spec/support/factories/record.rb +17 -0
  326. data/spec/support/factories/url.rb +34 -0
  327. data/spec/support/factories/xml_node.rb +33 -0
  328. data/spec/support/helpers/io.rb +11 -0
  329. data/spec/support/helpers/models.rb +13 -0
  330. data/spec/support/shared/action_builder.rb +47 -0
  331. data/spec/support/shared/decoder.rb +70 -0
  332. data/spec/support/shared/feed_runner_observer.rb +136 -0
  333. data/spec/support/shared/feeds.rb +233 -0
  334. data/spec/support/shared/fetcher.rb +48 -0
  335. data/spec/support/shared/filter.rb +14 -0
  336. data/spec/support/shared/io-like.rb +7 -0
  337. data/spec/support/shared/model/collection.rb +164 -0
  338. data/spec/support/shared/output.rb +120 -0
  339. data/spec/support/shared/parsers.rb +51 -0
  340. data/spec/support/shared/record.rb +111 -0
  341. data/spec/threatinator/actions/list/action_spec.rb +148 -0
  342. data/spec/threatinator/actions/run/action_spec.rb +106 -0
  343. data/spec/threatinator/actions/run/config_spec.rb +39 -0
  344. data/spec/threatinator/actions/run/coverage_observer_spec.rb +151 -0
  345. data/spec/threatinator/actions/run/output_config_spec.rb +89 -0
  346. data/spec/threatinator/actions/run/status_observer_spec.rb +86 -0
  347. data/spec/threatinator/cli/list_action_builder_spec.rb +57 -0
  348. data/spec/threatinator/cli/run_action_builder_spec.rb +133 -0
  349. data/spec/threatinator/cli_spec.rb +175 -0
  350. data/spec/threatinator/config/base_spec.rb +39 -0
  351. data/spec/threatinator/config/feed_search_spec.rb +76 -0
  352. data/spec/threatinator/decoders/gzip_spec.rb +75 -0
  353. data/spec/threatinator/event_builder_spec.rb +123 -0
  354. data/spec/threatinator/event_spec.rb +254 -0
  355. data/spec/threatinator/event_spec.rb.new +319 -0
  356. data/spec/threatinator/feed_builder_spec.rb +633 -0
  357. data/spec/threatinator/feed_registry_spec.rb +198 -0
  358. data/spec/threatinator/feed_runner_spec.rb +372 -0
  359. data/spec/threatinator/feed_spec.rb +169 -0
  360. data/spec/threatinator/fetcher_spec.rb +12 -0
  361. data/spec/threatinator/fetchers/http_spec.rb +32 -0
  362. data/spec/threatinator/filter_spec.rb +13 -0
  363. data/spec/threatinator/filters/block_spec.rb +16 -0
  364. data/spec/threatinator/filters/comments_spec.rb +13 -0
  365. data/spec/threatinator/filters/whitespace_spec.rb +12 -0
  366. data/spec/threatinator/logger_spec.rb +29 -0
  367. data/spec/threatinator/model/observables/fqdn_collection_spec.rb +41 -0
  368. data/spec/threatinator/model/observables/ipv4_collection_spec.rb +36 -0
  369. data/spec/threatinator/model/observables/ipv4_spec.rb +75 -0
  370. data/spec/threatinator/model/observables/url_collection_spec.rb +45 -0
  371. data/spec/threatinator/model/validations/type_spec.rb +37 -0
  372. data/spec/threatinator/parser_spec.rb +13 -0
  373. data/spec/threatinator/parsers/csv/parser_spec.rb +202 -0
  374. data/spec/threatinator/parsers/getline/parser_spec.rb +83 -0
  375. data/spec/threatinator/parsers/json/parser_spec.rb +106 -0
  376. data/spec/threatinator/parsers/json/record_spec.rb +30 -0
  377. data/spec/threatinator/parsers/xml/node_spec.rb +335 -0
  378. data/spec/threatinator/parsers/xml/parser_spec.rb +263 -0
  379. data/spec/threatinator/parsers/xml/path_spec.rb +209 -0
  380. data/spec/threatinator/parsers/xml/pattern_spec.rb +72 -0
  381. data/spec/threatinator/parsers/xml/record_spec.rb +27 -0
  382. data/spec/threatinator/plugin_loader_spec.rb +238 -0
  383. data/spec/threatinator/plugins/output/csv_spec.rb +47 -0
  384. data/spec/threatinator/plugins/output/null_spec.rb +17 -0
  385. data/spec/threatinator/plugins/output/rubydebug_spec.rb +37 -0
  386. data/spec/threatinator/record_spec.rb +19 -0
  387. data/spec/threatinator/registry_spec.rb +97 -0
  388. data/spec/threatinator/runner_spec.rb +273 -0
  389. metadata +674 -0
data/spec/feeds/data/isc_suspicious_high_domainlist.txt ADDED
@@ -0,0 +1,26 @@
1
+
2
+ #
3
+ # DShield.org Suspicious Domain List
4
+ # (c) 2014 DShield.org
5
+ # some rights reserved. Details http://creativecommons.org/licenses/by-nc-sa/2.5/
6
+ # use on your own risk. No warranties implied.
7
+ # primary URL: http://www.dshield.org/feeds/suspiciousdomains_High.txt
8
+ #
9
+ # comments: info@dshield.org
10
+ # updated: Fri Sep 12 04:27:04 2014 UTC
11
+ #
12
+ # This list consists of High Level Sensitivity website URLs
13
+ # Columns (tab delimited):
14
+ #
15
+ # (1) site
16
+ #
17
+ Site
18
+ 000007.ru
19
+ 000cc.com
20
+ 09cd.co.kr
21
+ 1-verygoods.ru
22
+ 10kpictures.com
23
+ 114bds.com
24
+ 114oldest.com
25
+ 120a.com
26
+ 123kochi.com
data/spec/feeds/data/isc_suspicious_low_domainlist.txt ADDED
@@ -0,0 +1,34 @@
1
+
2
+ #
3
+ # DShield.org Suspicious Domain List
4
+ # (c) 2014 DShield.org
5
+ # some rights reserved. Details http://creativecommons.org/licenses/by-nc-sa/2.5/
6
+ # use on your own risk. No warranties implied.
7
+ # primary URL: http://www.dshield.org/feeds/suspiciousdomains_Low.txt
8
+ #
9
+ # comments: info@dshield.org
10
+ # updated: Fri Sep 12 04:27:03 2014 UTC
11
+ #
12
+ # This list consists of Low Level Sensitivity website URLs
13
+ # Columns (tab delimited):
14
+ #
15
+ # (1) site
16
+ #
17
+ Site
18
+ 000007.ru
19
+ 000cc.com
20
+ 09cd.co.kr
21
+ 1-verygoods.ru
22
+ 10kpictures.com
23
+ 114bds.com
24
+ 114oldest.com
25
+ 120a.com
26
+ 123kochi.com
27
+ 123mdw.com
28
+ 13grandferi.ru
29
+ 1492tapasbar.com
30
+ 168asia.com
31
+ 18dd.net
32
+ 18xn.com
33
+ 19tenco.com
34
+ 1a-teensbilder.de
data/spec/feeds/data/isc_suspicious_medium_domainlist.txt ADDED
@@ -0,0 +1,32 @@
1
+
2
+ #
3
+ # DShield.org Suspicious Domain List
4
+ # (c) 2014 DShield.org
5
+ # some rights reserved. Details http://creativecommons.org/licenses/by-nc-sa/2.5/
6
+ # use on your own risk. No warranties implied.
7
+ # primary URL: http://www.dshield.org/feeds/suspiciousdomains_Medium.txt
8
+ #
9
+ # comments: info@dshield.org
10
+ # updated: Fri Sep 12 04:27:04 2014 UTC
11
+ #
12
+ # This list consists of Medium Level Sensitivity website URLs
13
+ # Columns (tab delimited):
14
+ #
15
+ # (1) site
16
+ #
17
+ Site
18
+ 000007.ru
19
+ 000cc.com
20
+ 09cd.co.kr
21
+ 1-verygoods.ru
22
+ 10kpictures.com
23
+ 114bds.com
24
+ 114oldest.com
25
+ 120a.com
26
+ 123kochi.com
27
+ 123mdw.com
28
+ 13grandferi.ru
29
+ 1492tapasbar.com
30
+ 168asia.com
31
+ 18dd.net
32
+ 18xn.com
data/spec/feeds/data/malc0de_domainlist.txt ADDED
@@ -0,0 +1,18 @@
1
+
2
+ // This file will be automatically updated daily and populated with the last 30 days of malicious domains.
3
+ // It will return 127.0.0.1 for all domains found to be distributing malware
4
+ // Additional information to get this working can be found http://www.malwaredomains.com/wordpress/?page_id=6
5
+ // Last updated 2014-07-08
6
+
7
+ PRIMARY beespace.com.ua blockeddomain.hosts
8
+ PRIMARY opencandy.com blockeddomain.hosts
9
+ PRIMARY netdna-cdn.com blockeddomain.hosts
10
+ PRIMARY drivers.drp.su blockeddomain.hosts
11
+ PRIMARY dropcanvas.com blockeddomain.hosts
12
+ PRIMARY 52z.com blockeddomain.hosts
13
+ PRIMARY baixaki.com.br blockeddomain.hosts
14
+ PRIMARY nzs.com.br blockeddomain.hosts
15
+ PRIMARY uniblue.com blockeddomain.hosts
16
+ PRIMARY downloadsrv13.com blockeddomain.hosts
17
+ PRIMARY cachelocal.org blockeddomain.hosts
18
+ PRIMARY ttriber.com blockeddomain.hosts
data/spec/feeds/data/malc0de_iplist.txt ADDED
@@ -0,0 +1,14 @@
1
+
2
+ // This file will be automatically updated daily and populated with the last 30 days of malicious IP addresses.
3
+ // Last updated 2014-07-08
4
+
5
+ 91.188.117.157
6
+ 216.151.164.53
7
+ 91.222.136.251
8
+ 208.111.160.6
9
+ 5.79.71.240
10
+ 162.159.242.11
11
+ 218.75.155.39
12
+ 96.17.197.34
13
+ 176.32.99.47
14
+ 23.66.230.137
data/spec/feeds/data/malwaredomainlist-url-reputation.txt ADDED
@@ -0,0 +1,8 @@
1
+ "2014/10/07_04:23","www.yehuam.com/dist/video.php?l=1","198.15.122.221","-","Leads to exploit, Malvertising","Registrar Abuse Contact abuse@enom.com","20454"
2
+ "2014/10/07_04:23","exkn0md6fh.qsdgi.com/azomytze3q","5.135.230.183","-","RIG EK","Registrar Abuse Contact abuse@web.com","16276"
3
+ "2014/10/01_09:34","radiology.starlightcapitaladvisors.net/dr/southeast/steve/dropdown.js","85.10.229.207","85-10-229-207.clients.your-server.de.","obfuscated script leads to exploit kit","-","24940"
4
+ "2014/10/01_09:30","avecat.missouritheatre.org:15106/full/cnstats/clients/stories.php?wink=322","87.118.127.230","ns2.km33436-26.keymachine.de.","exploit kit","T Fankhauser / artstaff@stjoearts.org","31103"
5
+ "2014/10/01_09:30","aveconomic.trailswest.org:15106/haddan_files/stories.php","87.118.127.230","ns2.km33436-26.keymachine.de.","exploit kit","T Fankhauser / artstaff@stjoearts.org","31103"
6
+ "2014/09/17_10:11","borneo.aqq79.com/wbxx3.html","217.23.5.88","customer.worldstream.nl.","frame leads to exploit kit","Registrar Abuse Contact domain@west263.com","49981"
7
+ "2014/09/17_10:11","asd.vicentelopez.us/vbign3s2pe","192.99.197.133","-","exploit kit","Virna Springer / virnaspringer2001@mail.com","16276"
8
+ "2014/09/17_10:11","qwe.affairedhonneur.us/depqfie59y","192.99.197.131","-","exploit kit","Ben Bazar / benbazar2011y@mail.com","16276"
data/spec/feeds/data/malwaredomains_domainlist.txt ADDED
@@ -0,0 +1,24 @@
1
+ ## notice notice duplication is not permitted
2
+ ## if you do not accept these terms, then do not use this information.
3
+ ## nextvalidation domain type original_reference-why_it_was_listed dateverified
4
+ ## for noncommercial use only. using this information indicates you agree to be bound by these terms.
5
+ 20161231 brenz.pl attackpage safebrowsing.clients.google.com 20140302 20131228 20110304 20100805 relisted
6
+ 20161231 retro-7-3.cz.cc harmful safebrowsing.clients.google.com 20140703 20131227 20130614 20120724 20110503 relisted
7
+ 20161231 38zu.cn attackpage safebrowsing.google.com 20140703 20140302 20130325 20120426 20110715
8
+ 20161231 pempoo.com attackpage safebrowsing.google.com 20140703 20140307 20131227 20120423 20110712
9
+ 20161230 gumblar.cn attackpage safebrowsing.clients.google.com 20140703 20140226 20131228 20130526 20110711 20100403
10
+ 20160601 cg79wo20kl92doowfn01oqpo9mdieowv5tyj.com malware safebrowsing.google.com 20130611 20131228 20121227 20120724 20110319 relisted
11
+ 20160601 neepelsty.cz.cc attackpage www.google.com/interstitial?url=neepelsty.cz.cc 20130614 20131228 20121227 20120724 20110520 relisted
12
+ 20160601 x0a.in iframe blog.unmaskparasites.com/2009/06/25/hidden-cn-iframes-are-still-prevalent 20131226 20110311 20090830
13
+ 20160601 x1g.in iframe blog.unmaskparasites.com/2009/06/25/hidden-cn-iframes-are-still-prevalent 20131226 20110311 20090830
14
+ 20160601 x3v.in iframe blog.unmaskparasites.com/2009/06/25/hidden-cn-iframes-are-still-prevalent 20131226 20110311 20090830
15
+ 20160601 x5o.ru iframe blog.unmaskparasites.com/2009/06/25/hidden-cn-iframes-are-still-prevalent 20131226 20110311 20090830
16
+ 20160601 x6i.ru iframe blog.unmaskparasites.com/2009/06/25/hidden-cn-iframes-are-still-prevalent 20131226 20110311 20090830
17
+ 20160601 x6p.in iframe blog.unmaskparasites.com/2009/06/25/hidden-cn-iframes-are-still-prevalent 20131226 20110311 20090830
18
+ 20160601 x3b.ru attackpage google.com/safebrowsing 20131226 20110311 20090913
19
+ 20160601 x0c.ru malware hosts-file.net/?s=80.93.90.88&view=history 20131226 20110311 20090830
20
+ 20160601 x3y.ru malware hosts-file.net/?s=80.93.90.88&view=history 20131226 20110311 20090830
21
+ 20160601 x9m.ru malware hosts-file.net/?s=80.93.90.88&view=history 20131226 20110311 20090830
22
+ 20160601 x8l.in iframe safebrowsing.google.com 20131226 20110311 20090826
23
+ 20160601 x8o.ru iframe safebrowsing.google.com 20131226 20110311 20090826
24
+ 20160601 x8v.ru iframe safebrowsing.google.com 20131226 20110311 20090826
data/spec/feeds/data/malwaredomains_dyndns_domainlist.txt ADDED
@@ -0,0 +1,34 @@
1
+
2
+ ## this is a listdynamic dns providers - for informational purposes only, use as a blocklist at your own risk
3
+ ##please send additions or corrrections to malwaredomains2@gmail23.com1 (remove numbers in email address)
4
+ #easydns4u.com
5
+ #freelancedeveloper.com
6
+ #ipupdater.com
7
+ #iwas2.net
8
+ #microtech.co.gg
9
+ #myip.us
10
+ #ohflip.com
11
+ #reidmail.com
12
+ #reidsville-dns.com
13
+ #sysopworld.com
14
+ #thebbs.org
15
+
16
+ 0000000000000000000000.com #from http://freedns.afraid.org
17
+ 020huahai.com malicious siteinspector.comodo.com/
18
+ 021christine.com malicious siteinspector.comodo.com/
19
+ 051.no malicious siteinspector.comodo.com/
20
+ 0815x.com #from http://freedns.afraid.org
21
+ 0bit.org #from http://freedns.afraid.org
22
+ 0wnz-u.com #from http://freedns.afraid.org
23
+ 0x.no #from http://freedns.afraid.org
24
+ 101main.com #from http://dns2go.com
25
+ 101main.net #from http://dns2go.com
26
+ 1040ezdotcom.com malicious siteinspector.comodo.com/
27
+ 120v.ac #from http://freedns.afraid.org
28
+ 1243.ru malicious siteinspector.comodo.com/
29
+ 12wildwood.ca #from http://freedns.afraid.org
30
+ 1313.pl #from http://freedns.afraid.org
31
+ 1337.cx #from http://freedns.afraid.org
32
+ 136k.com #from http://freedns.afraid.org
33
+ 17life.com #from http://freedns.afraid.org
34
+ 18videoclip.com harmful safebrowsing.clients.google.com
data/spec/feeds/data/malwaredomains_justdomains_domainlist.txt ADDED
@@ -0,0 +1,18 @@
1
+ brenz.pl
2
+ retro-7-3.cz.cc
3
+ 38zu.cn
4
+ pempoo.com
5
+ gumblar.cn
6
+ cg79wo20kl92doowfn01oqpo9mdieowv5tyj.com
7
+ neepelsty.cz.cc
8
+ x0a.in
9
+ x1g.in
10
+ x3v.in
11
+ x5o.ru
12
+ x6i.ru
13
+ x6p.in
14
+ x3b.ru
15
+ x0c.ru
16
+ x3y.ru
17
+ x9m.ru
18
+ x8l.in
data/spec/feeds/data/mirc_domainlist.txt ADDED
@@ -0,0 +1,31 @@
1
+ ;For more information about this file see http://www.mirc.com/serverslist.html
2
+
3
+ [timestamp]
4
+ date=13/06/2012
5
+
6
+ [networks]
7
+ n0=DALnet
8
+ n1=EFnet
9
+ n2=Freenode
10
+ n3=GameSurge
11
+ n4=IRCnet
12
+ n5=Quakenet
13
+ n6=Rizon
14
+ n7=SwiftIRC
15
+ n8=Undernet
16
+ n9=WebChat
17
+
18
+ [servers]
19
+ n0=Random serverSERVER:irc.dal.net:6660-6667GROUP:DALnet
20
+ n1=Random AU serverSERVER:irc.au.dal.net:6665-6668,7000GROUP:DALnet
21
+ n2=Random EU serverSERVER:irc.eu.dal.net:6665-6668,7000GROUP:DALnet
22
+ n3=Random US serverSERVER:irc.us.dal.net:6665-6668,7000GROUP:DALnet
23
+ n4=US, CA, OrangeSERVER:krypt.ca.us.dal.net:6665-6668,7000GROUP:DALnet
24
+ n5=US, NJ, ChoopaSERVER:choopa.nj.us.dal.net:6667:GROUP:DALnet
25
+ n6=US, VA, RichmondSERVER:punch.va.us.dal.net:6665-6668,7000GROUP:DALnet
26
+ n7=US, WA, SeattleSERVER:serverbuffet.wa.us.dal.net:6665-6668,7000GROUP:DALnet
27
+ n8=Random serverSERVER:irc.efnet.org:6667GROUP:EFnet
28
+ n9=CA, AB, CalgarySERVER:irc.arcti.ca:6665-6669GROUP:EFnet
29
+ n10=CA, ON, TorontoSERVER:irc.teksavvy.ca:6661-6669GROUP:EFnet
30
+ n11=EU, DK, AarhusSERVER:irc.inet.tele.dk:6661-6669GROUP:EFnet
31
+ n12=EU, NL, AmsterdamSERVER:efnet.xs4all.nl:6661-6669GROUP:EFnet
data/spec/feeds/data/multiproxy_iplist.txt ADDED
@@ -0,0 +1,15 @@
1
+ 122.6.245.14:8090
2
+ 123.184.6.251:8088
3
+ 123.236.215.131:6588
4
+ 172.163.146.56:6588
5
+ 189.37.28.147:6588
6
+ 190.53.89.103:6588
7
+ 200.104.104.91:6588
8
+ 200.126.98.135:6588
9
+ 200.252.201.144:80
10
+ 201.42.59.201:6588
11
+ 202.134.202.226:80
12
+ 211.140.151.214:8080
13
+ 212.12.114.252:3128
14
+ 218.252.37.227:808
15
+ 59.95.1.229:6588
data/spec/feeds/data/nothink_irc_iplist.txt ADDED
@@ -0,0 +1,14 @@
1
+ # Provided by nothink.org
2
+ # Malware IRC network traffic blacklist (IP address)
3
+ # Generated 2014-07-07 22:05:01 UTC
4
+ 122.160.232.194
5
+ 123.240.75.169
6
+ 173.163.151.27
7
+ 189.107.132.113
8
+ 193.107.16.22
9
+ 193.136.119.33
10
+ 194.14.236.50
11
+ 201.48.61.38
12
+ 218.61.22.10
13
+ 218.61.22.28
14
+ 46.166.162.116
data/spec/feeds/data/nothink_ssh_iplist.txt ADDED
@@ -0,0 +1,10 @@
1
+ # Provided by nothink.org
2
+ # SSH blacklist, last 24 hours (IP address)
3
+ # Generated 2014-07-08 22:05:01 UTC
4
+ 1.93.26.15
5
+ 31.196.84.131
6
+ 36.39.246.121
7
+ 61.144.43.235
8
+ 64.111.196.174
9
+ 88.191.151.44
10
+ 94.32.71.168
data/spec/feeds/data/openbl_iplist.txt ADDED
@@ -0,0 +1,12 @@
1
+ # openbl.org/lists/base_90days.txt
2
+ # Wed Jul 9 15:12:00 2014 UTC
3
+ #
4
+ # source ip
5
+ 61.174.51.216
6
+ 61.174.51.233
7
+ 218.108.247.91
8
+ 183.46.250.53
9
+ 61.174.51.230
10
+ 61.174.51.204
11
+ 1.93.29.130
12
+ 117.21.191.35
data/spec/feeds/data/openphish-url-reputation.txt ADDED
@@ -0,0 +1,16 @@
1
+ http://22872.in/
2
+ http://www.sikaram.lk/wp-content/uploads/10421312312/19890907.html
3
+ http://www.seventoons.com/includes/languages/espanol/images/sfre/9a8c90c1e89a8d9660b5eb59308d5f15/cas.php?clicid=13698&default=031c2011f7b699ad4676d01035827f44
4
+ http://www.alternativ-credit.fr/includes/html/classic/ibks/bradesco/?WLMFKUGXUPHVZUFEZWIKYHYWGUGPFXEPNGOFZEYGTSTNTWUIYMFIRLZTUUNVRNTNPTMSTZKZKNITNRNPHLKWYKOZMXWSJYKWY
5
+ http://www.alternativ-credit.fr/includes/html/classic/ibks/bradesco/?ZNLROJIJRSSTQWEGUKKYXWQJKMPRLJNOYVHNXTGSJVTNPLTPTKEOLVHGSLXXIURSPFWXHYNKSWJSYNQZKRGXMSRLZVTGRVXPNJTV
6
+ http://www.jacks-music.co.uk/wp-admin/a/ef26da3516ec9b3f8d06a8d876804d0a/da276c95119f380b9466516ca1f35551/4db64aeb194a008c3589ca0252caf430/14526566c864daf0a9cf4f6cc527b315/884c7f2309881eef92d29429c9b15f32/95a77b9c4a1258900b96726a003351ec/a06ae15727fc9b5a8daf9a61563a9b2a/?pagein=https://signin.ebay.it/ws/eBayISAPI.dll?SignIn&ru=http://www.ebay.it/
7
+ http://www.jacks-music.co.uk/wp-admin/a/e4f701810e80c05c0533876dd4b4246d/97286d2ffb4c29125e8534b5f34eac1f/?pagein=https://signin.ebay.it/ws/eBayISAPI.dll?SignIn&ru=http://www.ebay.it/
8
+ http://www.jacks-music.co.uk/wp-admin/a/ef26da3516ec9b3f8d06a8d876804d0a/da276c95119f380b9466516ca1f35551/4db64aeb194a008c3589ca0252caf430/14526566c864daf0a9cf4f6cc527b315/6f9b49ea7ad3bd488d03146e455585f7/c144bd8041f407331fe66af1d6c07c51/8c3f20513475139edeccc7f47f237552/?pagein=https://signin.ebay.it/ws/eBayISAPI.dll?SignIn&ru=http://www.ebay.it/
9
+ http://www.jacks-music.co.uk/wp-admin/a/ef26da3516ec9b3f8d06a8d876804d0a/da276c95119f380b9466516ca1f35551/4db64aeb194a008c3589ca0252caf430/14526566c864daf0a9cf4f6cc527b315/884c7f2309881eef92d29429c9b15f32/95a77b9c4a1258900b96726a003351ec/bfe3005edf73b44b6c18a88ddf633d08/?pagein=https://signin.ebay.it/ws/eBayISAPI.dll?SignIn&ru=http://www.ebay.it/
10
+ http://www.jacks-music.co.uk/wp-admin/a/ef26da3516ec9b3f8d06a8d876804d0a/da276c95119f380b9466516ca1f35551/4db64aeb194a008c3589ca0252caf430/14526566c864daf0a9cf4f6cc527b315/d5f8fba1e788b4723fb87c788aae85a7/d5c3a11c45b2d46ff81cd25281d43510/2102dde13e5e7dcb942d34af83a59c31/?pagein=https://signin.ebay.it/ws/eBayISAPI.dll?SignIn&ru=http://www.ebay.it/
11
+ http://www.jacks-music.co.uk/wp-admin/a/ef26da3516ec9b3f8d06a8d876804d0a/da276c95119f380b9466516ca1f35551/40001ba92bc71fa1a87cbd6014c6a93c/f855e92746daac9349ec8606bc21dc1c/?pagein=https://signin.ebay.it/ws/eBayISAPI.dll?SignIn&ru=http://www.ebay.it/
12
+ http://190.86.185.227/Site-Seguro-SSL/Cadastramento/
13
+ http://www.turesidenciapremium.com/Trader/trade/index.html
14
+ http://datosfiscales.com/plugins/connect/portfolio/index.htm
15
+ http://www.thethreetouch.com/thai/store/images/stories/safepay.wellsfargo.com/index.php
16
+ http://www.
data/spec/feeds/data/packetmail_perimeterbad-ip_reputation.txt ADDED
@@ -0,0 +1,44 @@
1
+ # Disclaimer - You may not use this list without acceptance of the below:
2
+ #
3
+ # The following IP addresses have made HTTP/HTTPS requests to files that are either non-existent or denied by configuration to
4
+ # unique and new URLs over the past 30 days.
5
+ #
6
+ # No assertion is made, nor implied, that any of the below listed IP addresses are accurate, malicious, hostile, or engaged in nefarious acts.
7
+ # Use this list at your own risk. By using this list in any capacity or capability you release all claims of damages and shall not hold or perceive any
8
+ # liability against the publisher for: damage, unexpected events or results, decision, or reputation damage, even those resulting from wilful
9
+ # or intentional neglect.
10
+ #
11
+ # No claims made against this data shall be honored; no assertions have been made about the quality, accuracy, usability, actionability,
12
+ # reputation, merit, or hostility of the below findings.
13
+ #
14
+ # If you feel that an IP address is inaccurately listed below please contact me at any RFC822 6.3, RFC1123 5.2.7, or RFC2821 4.5.1
15
+ # address associated with this domain.
16
+ #
17
+ # This list may not be included in any 'for-sale' component and may not be included in pay-wall subscription-based services except
18
+ # for organizations that I have explicitly given permission to by E-Mail which has been GPG signed using Key ID 0x37085D70.
19
+ #
20
+ # Changelog:
21
+ # Thu Sep 04 2014 - Initial Development
22
+ #
23
+ # This file contains these \x09 (TAB) separated fields:
24
+ # date_time string Time the request was received (standard english format)
25
+ # remote_ip string Remote IP-address
26
+ # server_name string The server name according to the UseCanonicalName setting
27
+ # status string Status. For requests that got internally redirected, this is the status of the original request
28
+ # request string The first line of the request
29
+ # http_referer string HTTP Referer
30
+ # user_agent string HTTP User-Agent
31
+ # day string Day in YYYY-MM-DD format
32
+ #
33
+ #
34
+ # This list was last updated on Thu Sep 4 10:16:10 CDT 2014
35
+ #
36
+ [03/Sep/2014:13:11:47 -0500] 192.99.152.38 206.82.85.197 403 GET /cc/process.php HTTP/1.1 - Mozilla/5.0 (Windows NT 6.1; WOW64; rv:8.0) Gecko/20100101 Firefox/8.0 2014-09-03
37
+ [03/Sep/2014:10:06:47 -0500] 110.45.241.238 206.82.85.197 403 POST /cfg HTTP/1.1 - - 2014-09-03
38
+ [03/Sep/2014:13:11:47 -0500] 192.99.152.38 206.82.85.197 403 GET /process.php HTTP/1.1 - Mozilla/5.0 (Windows NT 6.1; WOW64; rv:8.0) Gecko/20100101 Firefox/8.0 2014-09-03
39
+ [03/Sep/2014:09:48:18 -0500] 62.210.167.201 206.82.85.197 403 GET /mad/inc/config.php HTTP/1.1 - Mozilla/5.0 (Windows NT 6.1; WOW64; rv:8.0) Gecko/20100101 Firefox/8.0 2014-09-03
40
+ [03/Sep/2014:05:39:48 -0500] 192.99.166.102 206.82.85.197 403 GET /Panel/bins.php HTTP/1.1 - Mozilla/5.0 (Windows NT 6.1; WOW64; rv:8.0) Gecko/20100101 Firefox/8.0 2014-09-03
41
+ [03/Sep/2014:05:39:48 -0500] 192.99.166.102 206.82.85.197 403 GET /jackposprivate12/bins.php HTTP/1.1 - Mozilla/5.0 (Windows NT 6.1; WOW64; rv:8.0) Gecko/20100101 Firefox/8.0 2014-09-03
42
+ [03/Sep/2014:05:39:48 -0500] 192.99.166.102 206.82.85.197 403 GET /jack/bins.php HTTP/1.1 - Mozilla/5.0 (Windows NT 6.1; WOW64; rv:8.0) Gecko/20100101 Firefox/8.0 2014-09-03
43
+ [03/Sep/2014:18:06:59 -0500] 69.28.85.204 www.hackbraten.tk 403 HEAD /Hackbraten.zip HTTP/1.1 - curl/7.32.0 2014-09-03
44
+
data/spec/feeds/data/palevo_domainlist.txt ADDED
@@ -0,0 +1,25 @@
1
+ # Palevo C&C Domain Blocklist by abuse.ch
2
+ arta.romail3arnest.info
3
+ asp.spinchats.com
4
+ bff.7oorq8.com
5
+ bff4.7oorq8.com
6
+ computo164.laweb.es
7
+ fitt.prince.kz
8
+ hcuewgbbnfdu1ew.com
9
+ hcuewgbbnfs1uew.com
10
+ internet.estr.es
11
+ legionarios.servecounterstrike.com
12
+ mail3.nad123nad.com
13
+ mariposita.web-personal.org
14
+ masterkey.com.ua
15
+ ms4all.twoplayers.net
16
+ mst.com.ua
17
+ ns.dunno-net.com
18
+ panchitox.laweb.es
19
+ penchatox.sin-ip.es
20
+ rastu.com.ua
21
+ s.24otuwotefsmd.com
22
+ shv4.no-ip.biz
23
+ shv4b.getmyip.com
24
+ ssl.aukro.ua
25
+ symconempkr.com
data/spec/feeds/data/palevo_iplist.txt ADDED
@@ -0,0 +1,24 @@
1
+ # Palevo C&C IP Blocklist by abuse.ch
2
+ 107.150.36.226
3
+ 109.123.109.132
4
+ 115.236.76.168
5
+ 144.76.143.4
6
+ 173.230.133.99
7
+ 176.31.117.59
8
+ 187.214.120.147
9
+ 189.135.116.163
10
+ 189.236.206.143
11
+ 193.23.48.228
12
+ 194.116.174.85
13
+ 208.185.82.133
14
+ 50.63.202.42
15
+ 67.198.207.34
16
+ 67.210.170.140
17
+ 67.210.170.141
18
+ 67.210.170.169
19
+ 69.43.161.141
20
+ 76.74.255.138
21
+ 80.83.124.187
22
+ 82.196.6.164
23
+ 91.208.194.18
24
+ 98.126.44.98
data/spec/feeds/data/snort_bpf-ip_reputation.txt ADDED
@@ -0,0 +1,16 @@
1
+ 212.89.13.111
2
+ 46.242.145.99
3
+ 91.220.62.190
4
+ 91.220.62.112
5
+ 91.213.217.36
6
+ 194.44.157.130
7
+ 193.107.17.62
8
+ 193.106.31.12
9
+ 94.63.149.51
10
+ 93.171.202.70
11
+ 204.16.169.2
12
+ 182.160.162.65
13
+ 91.228.154.199
14
+ 76.74.184.23
15
+ 85.214.26.248
16
+ 80.48.62.18
data/spec/feeds/data/spyeye_domainlist.txt ADDED
@@ -0,0 +1,16 @@
1
+ ################################################################################
2
+ # abuse.ch SpyEye domain blocklist #
3
+ # #
4
+ # For questions please referer to https://spyeyetracker.abuse.ch/blocklist.php #
5
+ ################################################################################
6
+
7
+ beromder56.com
8
+ detadomain.su
9
+ doemguing.net
10
+ firexiasds.wha.la
11
+ futuretelefonica.com
12
+ gate.eyeonarte.it
13
+ helen33nasanorth.com
14
+ sebortemesd5.com
15
+ stendtlong.net
16
+
data/spec/feeds/data/spyeye_iplist.txt ADDED
@@ -0,0 +1,19 @@
1
+ ################################################################################
2
+ # abuse.ch SpyEye IP blocklist #
3
+ # #
4
+ # For questions please referer to https://spyeyetracker.abuse.ch/blocklist.php #
5
+ ################################################################################
6
+
7
+ 188.190.126.173
8
+ 188.190.126.175
9
+ 188.190.126.176
10
+ 193.106.31.12
11
+ 193.107.17.62
12
+ 194.44.157.130
13
+ 46.166.143.56
14
+ 91.213.217.36
15
+ 91.220.62.112
16
+ 91.220.62.190
17
+ 93.171.202.70
18
+ 94.63.149.51
19
+
data/spec/feeds/data/steeman-ip-reputation.txt ADDED
@@ -0,0 +1,13 @@
1
+ # 2104 Block List (IPV4 IP addresses to avoid contact with) - Jeron Steeman - http://jeroen.steeman.org
2
+ # Created: 10/3/2014 4:00:24 PM
3
+ 1.0.253.17
4
+ 1.1.153.136
5
+ 1.10.220.118
6
+ 1.10.221.14
7
+ 1.10.221.78
8
+ 1.10.253.13
9
+ 1.161.123.10
10
+ 1.162.217.96
11
+ 1.168.163.133
12
+ 1.168.242.142
13
+ 1.169.45.13
data/spec/feeds/data/t-arend-de_ssh_iplist.txt ADDED
@@ -0,0 +1,17 @@
1
+ #Bad Guys List
2
+ #From: thomas@t-arend.de
3
+ #Date: So 6. Sep 13:03:16 CEST 2009
4
+ sshd: 113.11.200.191
5
+ sshd: 116.122.107.58
6
+ sshd: 116.127.93.201
7
+ sshd: 116.58.96.55
8
+ sshd: 116.68.194.45
9
+ sshd: 117.21.249.75
10
+ sshd: 117.32.128.141
11
+ sshd: 118.128.150.210
12
+ sshd: 119.113.0.4
13
+ sshd: 119.113.0.7
14
+ sshd: 121.13.229.221
15
+ sshd: 121.138.192.152
16
+ sshd: 121.14.142.46
17
+ sshd: 121.15.167.243
data/spec/feeds/data/the_haleys_ssh_iplist.txt ADDED
@@ -0,0 +1,12 @@
1
+ # IP addresses launching SSH dictionary attacks. As of Fri, 11 Jul 2014 15:22:17 +0100
2
+ ALL : 1.30.20.146
3
+ ALL : 1.82.184.23
4
+ ALL : 1.82.184.25
5
+ ALL : 1.85.2.246
6
+ ALL : 1.93.22.107
7
+ ALL : 1.93.24.62
8
+ ALL : 1.93.24.72
9
+ ALL : 1.93.25.63
10
+ ALL : 1.93.25.165
11
+ ALL : 1.93.25.234
12
+ ALL : 1.93.25.253
data/spec/feeds/data/trustedsec-ip-reputation.txt ADDED
@@ -0,0 +1,12 @@
1
+ #
2
+ 100.1.176.8
3
+ 100.42.209.114
4
+ 100.42.227.89
5
+ 100.42.229.73
6
+ 100.42.74.90
7
+ 101.0.4.104
8
+ 101.0.4.108
9
+ 101.0.53.229
10
+ 101.0.5.88
11
+ 101.0.5.90
12
+ 101.108.127.106