threatinator 0.1.1

data/spec/feeds/blocklist_de_imap-ip_reputation_spec.rb

@@ -0,0 +1,50 @@
+require 'spec_helper'
+
+describe 'feeds/blocklist_de_imap-ip_reputation.feed', :feed do
+  let(:provider) { 'blocklist_de' }
+  let(:name) { 'imap_ip_reputation' }
+
+  it_fetches_url 'http://www.blocklist.de/lists/imap.txt'
+
+  describe_parsing_the_file feed_data('blocklist_de_imap-ip-reputation.txt') do
+    it "should have parsed 8 records" do
+      expect(num_records_parsed).to eq(8)
+    end
+    it "should have filtered 0 records" do
+      expect(num_records_filtered).to eq(0)
+    end
+    it "should have missed 0 records" do
+      expect(num_records_missed).to eq(0)
+    end
+  end
+
+  describe_parsing_a_record '1.93.46.156' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:scanning) }
+      its(:ipv4s) { is_expected.to match_array(['1.93.46.156']) }
+    end
+  end
+
+  describe_parsing_a_record '103.10.134.220' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:scanning) }
+      its(:ipv4s) { is_expected.to match_array(['103.10.134.220']) }
+    end
+  end
+end
+
+

data/spec/feeds/blocklist_de_pop3-ip_reputation_spec.rb

@@ -0,0 +1,50 @@
+require 'spec_helper'
+
+describe 'feeds/blocklist_de_pop3-ip_reputation.feed', :feed do
+  let(:provider) { 'blocklist_de' }
+  let(:name) { 'pop3_ip_reputation' }
+
+  it_fetches_url 'http://www.blocklist.de/lists/pop3.txt'
+
+  describe_parsing_the_file feed_data('blocklist_de_pop3-ip-reputation.txt') do
+    it "should have parsed 11 records" do
+      expect(num_records_parsed).to eq(11)
+    end
+    it "should have filtered 0 records" do
+      expect(num_records_filtered).to eq(0)
+    end
+    it "should have missed 0 records" do
+      expect(num_records_missed).to eq(0)
+    end
+  end
+
+  describe_parsing_a_record '1.175.64.9' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:scanning) }
+      its(:ipv4s) { is_expected.to match_array(['1.175.64.9']) }
+    end
+  end
+
+  describe_parsing_a_record '1.53.0.215' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:scanning) }
+      its(:ipv4s) { is_expected.to match_array(['1.53.0.215']) }
+    end
+  end
+end
+
+

data/spec/feeds/blocklist_de_proftpd-ip_reputation_spec.rb

@@ -0,0 +1,50 @@
+require 'spec_helper'
+
+describe 'feeds/blocklist_de_proftpd-ip_reputation.feed', :feed do
+  let(:provider) { 'blocklist_de' }
+  let(:name) { 'proftpd_ip_reputation' }
+
+  it_fetches_url 'http://www.blocklist.de/lists/proftpd.txt'
+
+  describe_parsing_the_file feed_data('blocklist_de_proftpd-ip-reputation.txt') do
+    it "should have parsed 12 records" do
+      expect(num_records_parsed).to eq(12)
+    end
+    it "should have filtered 0 records" do
+      expect(num_records_filtered).to eq(0)
+    end
+    it "should have missed 0 records" do
+      expect(num_records_missed).to eq(0)
+    end
+  end
+
+  describe_parsing_a_record '111.192.148.129' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:scanning) }
+      its(:ipv4s) { is_expected.to match_array(['111.192.148.129']) }
+    end
+  end
+
+  describe_parsing_a_record '112.90.37.220' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:scanning) }
+      its(:ipv4s) { is_expected.to match_array(['112.90.37.220']) }
+    end
+  end
+end
+
+

data/spec/feeds/blocklist_de_sip-ip_reputation_spec.rb

@@ -0,0 +1,50 @@
+require 'spec_helper'
+
+describe 'feeds/blocklist_de_sip-ip_reputation.feed', :feed do
+  let(:provider) { 'blocklist_de' }
+  let(:name) { 'sip_ip_reputation' }
+
+  it_fetches_url 'http://www.blocklist.de/lists/sip.txt'
+
+  describe_parsing_the_file feed_data('blocklist_de_sip-ip-reputation.txt') do
+    it "should have parsed 9 records" do
+      expect(num_records_parsed).to eq(9)
+    end
+    it "should have filtered 0 records" do
+      expect(num_records_filtered).to eq(0)
+    end
+    it "should have missed 0 records" do
+      expect(num_records_missed).to eq(0)
+    end
+  end
+
+  describe_parsing_a_record '178.32.229.159' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:scanning) }
+      its(:ipv4s) { is_expected.to match_array(['178.32.229.159']) }
+    end
+  end
+
+  describe_parsing_a_record '198.204.224.10' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:scanning) }
+      its(:ipv4s) { is_expected.to match_array(['198.204.224.10']) }
+    end
+  end
+end
+
+

data/spec/feeds/blocklist_de_ssh-ip_reputation_spec.rb

@@ -0,0 +1,50 @@
+require 'spec_helper'
+
+describe 'feeds/blocklist_de_ssh-ip_reputation.feed', :feed do
+  let(:provider) { 'blocklist_de' }
+  let(:name) { 'ssh_ip_reputation' }
+
+  it_fetches_url 'http://www.blocklist.de/lists/ssh.txt'
+
+  describe_parsing_the_file feed_data('blocklist_de_ssh-ip-reputation.txt') do
+    it "should have parsed 10 records" do
+      expect(num_records_parsed).to eq(10)
+    end
+    it "should have filtered 0 records" do
+      expect(num_records_filtered).to eq(0)
+    end
+    it "should have missed 0 records" do
+      expect(num_records_missed).to eq(0)
+    end
+  end
+
+  describe_parsing_a_record '1.93.24.83' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:scanning) }
+      its(:ipv4s) { is_expected.to match_array(['1.93.24.83']) }
+    end
+  end
+
+  describe_parsing_a_record '1.93.25.251' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:scanning) }
+      its(:ipv4s) { is_expected.to match_array(['1.93.25.251']) }
+    end
+  end
+end
+
+

data/spec/feeds/blocklist_de_strongips-ip_reputation_spec.rb

@@ -0,0 +1,50 @@
+require 'spec_helper'
+
+describe 'feeds/blocklist_de_strongips-ip_reputation.feed', :feed do
+  let(:provider) { 'blocklist_de' }
+  let(:name) { 'strongips_ip_reputation' }
+
+  it_fetches_url 'http://www.blocklist.de/lists/strongips.txt'
+
+  describe_parsing_the_file feed_data('blocklist_de_strongips-ip-reputation.txt') do
+    it "should have parsed 11 records" do
+      expect(num_records_parsed).to eq(11)
+    end
+    it "should have filtered 0 records" do
+      expect(num_records_filtered).to eq(0)
+    end
+    it "should have missed 0 records" do
+      expect(num_records_missed).to eq(0)
+    end
+  end
+
+  describe_parsing_a_record '188.143.232.211' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:scanning) }
+      its(:ipv4s) { is_expected.to match_array(['188.143.232.211']) }
+    end
+  end
+
+  describe_parsing_a_record '142.54.173.130' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:scanning) }
+      its(:ipv4s) { is_expected.to match_array(['142.54.173.130']) }
+    end
+  end
+end
+
+

data/spec/feeds/ciarmy-ip_reputation_spec.rb

@@ -0,0 +1,50 @@
+require 'spec_helper'
+
+describe 'feeds/ciarmy-ip_reputation.feed', :feed do
+  let(:provider) { 'ciarmy' }
+  let(:name) { 'ip_reputation' }
+
+  it_fetches_url 'http://www.ciarmy.com/list/ci-badguys.txt'
+
+  describe_parsing_the_file feed_data('ciarmy-ip-reputation.txt') do
+    it "should have parsed 11 records" do
+      expect(num_records_parsed).to eq(11)
+    end
+    it "should have filtered 0 records" do
+      expect(num_records_filtered).to eq(0)
+    end
+    it "should have missed 0 records" do
+      expect(num_records_missed).to eq(0)
+    end
+  end
+
+  describe_parsing_a_record '5.79.68.161' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:scanning) }
+      its(:ipv4s) { is_expected.to match_array(['5.79.68.161']) }
+    end
+  end
+
+  describe_parsing_a_record '10.0.100.121' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:scanning) }
+      its(:ipv4s) { is_expected.to match_array(['10.0.100.121']) }
+    end
+  end
+end
+
+

data/spec/feeds/cruzit-ip_reputation_spec.rb

@@ -0,0 +1,50 @@
+require 'spec_helper'
+
+describe 'feeds/cruzit-ip_reputation.feed', :feed do
+  let(:provider) { 'cruzit' }
+  let(:name) { 'ip_reputation' }
+
+  it_fetches_url 'http://www.cruzit.com/xwbl2txt.php'
+
+  describe_parsing_the_file feed_data('cruzit-ip-reputation.txt') do
+    it "should have parsed 14 records" do
+      expect(num_records_parsed).to eq(14)
+    end
+    it "should have filtered 0 records" do
+      expect(num_records_filtered).to eq(0)
+    end
+    it "should have missed 0 records" do
+      expect(num_records_missed).to eq(0)
+    end
+  end
+
+  describe_parsing_a_record '107.170.248.56' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:scanning) }
+      its(:ipv4s) { is_expected.to match_array(['107.170.248.56']) }
+    end
+  end
+
+  describe_parsing_a_record '80.82.64.114' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:scanning) }
+      its(:ipv4s) { is_expected.to match_array(['80.82.64.114']) }
+    end
+  end
+end
+
+

data/spec/feeds/dan_me_uk_torlist-ip_reputation_spec.rb

@@ -0,0 +1,50 @@
+require 'spec_helper'
+
+describe 'feeds/dan_me_uk_torlist-ip_reputation.feed', :feed do
+  let(:provider) { 'dan_me_uk' }
+  let(:name) { 'torlist_ip_reputation' }
+
+  it_fetches_url 'https://www.dan.me.uk/torlist/'
+
+  describe_parsing_the_file feed_data('dan_me_uk_torlist-ip-reputation.txt') do
+    it "should have parsed 11 records" do
+      expect(num_records_parsed).to eq(11)
+    end
+    it "should have filtered 0 records" do
+      expect(num_records_filtered).to eq(0)
+    end
+    it "should have missed 0 records" do
+      expect(num_records_missed).to eq(0)
+    end
+  end
+
+  describe_parsing_a_record '100.34.32.230' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:scanning) }
+      its(:ipv4s) { is_expected.to match_array(['100.34.32.230']) }
+    end
+  end
+
+  describe_parsing_a_record '101.55.12.75' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:scanning) }
+      its(:ipv4s) { is_expected.to match_array(['101.55.12.75']) }
+    end
+  end
+end
+
+