threatinator 0.1.6 → 0.2.0

data/spec/feeds/malwaredomainlist_url_reputation_spec.rb

@@ -0,0 +1,50 @@
+require 'spec_helper'
+
+describe 'feeds/malwaredomainlist-url_reputation.feed', :feed do
+  let(:provider) { 'malwaredomainlist' }
+  let(:name) { 'url_reputation' }
+
+  it_fetches_url 'http://www.malwaredomainlist.com/updatescsv.php'
+
+  describe_parsing_the_file feed_data('malwaredomainlist-url-reputation.txt') do
+    it "should have parsed 8 records" do
+      expect(num_records_parsed).to eq(8)
+    end
+    it "should have filtered 0 records" do
+      expect(num_records_filtered).to eq(0)
+    end
+    it "should have missed 0 records" do
+      expect(num_records_missed).to eq(0)
+    end
+  end
+
+  describe_parsing_a_record '"2014/09/17_10:11","qwe.affairedhonneur.us/depqfie59y","192.99.197.131","-","exploit kit","Ben Bazar / benbazar2011y@mail.com","16276"' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:malware_host) }
+	  its(:urls) { is_expected.to eq(build(:urls, values: ['http://qwe.affairedhonneur.us/depqfie59y'])) }
+    end
+  end
+
+  describe_parsing_a_record '"2014/10/01_09:30","aveconomic.trailswest.org:15106/haddan_files/stories.php","87.118.127.230","ns2.km33436-26.keymachine.de.","exploit kit","T Fankhauser / artstaff@stjoearts.org","31103"' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:malware_host) }
+	  its(:urls) { is_expected.to eq(build(:urls, values: ['http://aveconomic.trailswest.org:15106/haddan_files/stories.php'])) }
+    end
+  end
+end
+
+

data/spec/feeds/malwaredomains-domain_reputation_spec.rb

@@ -0,0 +1,47 @@
+require 'spec_helper'
+
+describe 'feeds/malwaredomains-domain_reputation.feed', :feed do
+  let(:provider) { 'malwaredomains' }
+  let(:name) { 'domain_reputation' }
+
+  it_fetches_url 'http://mirror1.malwaredomains.com/files/domains.txt'
+
+  describe_parsing_the_file feed_data('malwaredomains_domainlist.txt') do
+    it "should have parsed 20 records" do
+      expect(num_records_parsed).to eq(20)
+    end
+    it "should have filtered 4 records" do
+      expect(num_records_filtered).to eq(4)
+    end
+  end
+
+  describe_parsing_a_record '	20151231	qyrzfhilst.ru	attackpage	safebrowsing.google.com	20131227	20120308	20110512' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:malware_host) }
+      its(:fqdns) { is_expected.to match_array(['qyrzfhilst.ru']) }
+    end
+  end
+
+  describe_parsing_a_record '	20151231	xc6.in	iframe	blog.unmaskparasites.com/2009/06/25/hidden-cn-iframes-are-still-prevalent	20131228	20110311	20090830' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:malware_host) }
+      its(:fqdns) { is_expected.to match_array(['xc6.in']) }
+    end
+  end
+end
+
+

data/spec/feeds/malwaredomains_dyndns-domain_reputation_spec.rb

@@ -0,0 +1,47 @@
+require 'spec_helper'
+
+describe 'feeds/malwaredomains_dyndns-domain_reputation.feed', :feed do
+  let(:provider) { 'malwaredomains' }
+  let(:name) { 'dyndns_domain_reputation' }
+
+  it_fetches_url 'http://mirror2.malwaredomains.com/files/dynamic_dns.txt'
+
+  describe_parsing_the_file feed_data('malwaredomains_dyndns_domainlist.txt') do
+    it "should have parsed 19 records" do
+      expect(num_records_parsed).to eq(19)
+    end
+    it "should have filtered 15 records" do
+      expect(num_records_filtered).to eq(15)
+    end
+  end
+
+  describe_parsing_a_record '1040ezdotcom.com	malicious	siteinspector.comodo.com/' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:scanning) }
+      its(:fqdns) { is_expected.to match_array(['1040ezdotcom.com']) }
+    end
+  end
+
+  describe_parsing_a_record '1stresponderservices.com	malicious	siteinspector.comodo.com/' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:scanning) }
+      its(:fqdns) { is_expected.to match_array(['1stresponderservices.com']) }
+    end
+  end
+end
+
+

data/spec/feeds/malwaredomains_justdomains-domain_reputation_spec.rb

@@ -0,0 +1,47 @@
+require 'spec_helper'
+
+describe 'feeds/malwaredomains_justdomains-domain_reputation.feed', :feed do
+  let(:provider) { 'malwaredomains' }
+  let(:name) { 'justdomains_domain_reputation' }
+
+  it_fetches_url 'http://mirror3.malwaredomains.com/files/justdomains'
+
+  describe_parsing_the_file feed_data('malwaredomains_justdomains_domainlist.txt') do
+    it "should have parsed 18 records" do
+      expect(num_records_parsed).to eq(18)
+    end
+    it "should have filtered 0 records" do
+      expect(num_records_filtered).to eq(0)
+    end
+  end
+
+  describe_parsing_a_record 'cg79wo20kl92doowfn01oqpo9mdieowv5tyj.com' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:malware_host) }
+      its(:fqdns) { is_expected.to match_array(["cg79wo20kl92doowfn01oqpo9mdieowv5tyj.com"]) }
+    end
+  end
+
+  describe_parsing_a_record 'x6p.in' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:malware_host) }
+      its(:fqdns) { is_expected.to match_array(["x6p.in"]) }
+    end
+  end
+end
+
+

data/spec/feeds/mirc-domain_reputation_spec.rb

@@ -13,9 +13,6 @@ describe 'feeds/mirc-domain_reputation.feed', :feed do
     it "should have filtered 18 records" do
       expect(num_records_filtered).to eq(18)
     end
-    it "should have missed 0 records" do
-      expect(num_records_missed).to eq(0)
-    end
   end
 
   describe_parsing_a_record 'n3=Random US serverSERVER:irc.us.dal.net:6665-6668,7000GROUP:DALnet' do

data/spec/feeds/multiproxy-ip_reputation_spec.rb

@@ -0,0 +1,47 @@
+require 'spec_helper'
+
+describe 'feeds/multiproxy-ip_reputation.feed', :feed do
+  let(:provider) { 'multiproxy' }
+  let(:name) { 'ip_reputation' }
+
+  it_fetches_url 'http://multiproxy.org/txt_all/proxy.txt'
+
+  describe_parsing_the_file feed_data('multiproxy_iplist.txt') do
+    it "should have parsed 15 records" do
+      expect(num_records_parsed).to eq(15)
+    end
+    it "should have filtered 0 records" do
+      expect(num_records_filtered).to eq(0)
+    end
+  end
+
+  describe_parsing_a_record '190.53.89.103:6588' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:scanning) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['190.53.89.103'])) }
+    end
+  end
+
+  describe_parsing_a_record '211.140.151.214:8080' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:scanning) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['211.140.151.214'])) }
+    end
+  end
+end
+
+

data/spec/feeds/nothink_irc-ip_reputation_spec.rb

@@ -13,9 +13,6 @@ describe 'feeds/nothink_irc-ip_reputation.feed', :feed do
     it "should have filtered 3 records" do
       expect(num_records_filtered).to eq(3)
     end
-    it "should have missed 0 records" do
-      expect(num_records_missed).to eq(0)
-    end
   end
 
   describe_parsing_a_record '189.107.132.113' do
@@ -28,7 +25,7 @@ describe 'feeds/nothink_irc-ip_reputation.feed', :feed do
 	describe 'event 0' do
       subject { events[0] }
       its(:type) { is_expected.to be(:c2) }
-      its(:ipv4s) { is_expected.to match_array(['189.107.132.113']) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['189.107.132.113'])) }
     end
   end
 
@@ -42,7 +39,7 @@ describe 'feeds/nothink_irc-ip_reputation.feed', :feed do
 	describe 'event 0' do
       subject { events[0] }
       its(:type) { is_expected.to be(:c2) }
-      its(:ipv4s) { is_expected.to match_array(['201.48.61.38']) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['201.48.61.38'])) }
     end
   end
 end

data/spec/feeds/nothink_ssh-ip_reputation_spec.rb

@@ -13,9 +13,6 @@ describe 'feeds/nothink_ssh-ip_reputation.feed', :feed do
     it "should have filtered 3 records" do
       expect(num_records_filtered).to eq(3)
     end
-    it "should have missed 0 records" do
-      expect(num_records_missed).to eq(0)
-    end
   end
 
   describe_parsing_a_record '36.39.246.121' do
@@ -28,7 +25,7 @@ describe 'feeds/nothink_ssh-ip_reputation.feed', :feed do
 	describe 'event 0' do
       subject { events[0] }
       its(:type) { is_expected.to be(:scanning) }
-      its(:ipv4s) { is_expected.to match_array(['36.39.246.121']) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['36.39.246.121'])) }
     end
   end
 
@@ -42,7 +39,7 @@ describe 'feeds/nothink_ssh-ip_reputation.feed', :feed do
 	describe 'event 0' do
       subject { events[0] }
       its(:type) { is_expected.to be(:scanning) }
-      its(:ipv4s) { is_expected.to match_array(['94.32.71.168']) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['94.32.71.168'])) }
     end
   end
 end

data/spec/feeds/openbl-ip_reputation_spec.rb

@@ -13,9 +13,6 @@ describe 'feeds/openbl-ip_reputation.feed', :feed do
     it "should have filtered 4 records" do
       expect(num_records_filtered).to eq(4)
     end
-    it "should have missed 0 records" do
-      expect(num_records_missed).to eq(0)
-    end
   end
 
   describe_parsing_a_record '113.171.10.37' do
@@ -28,7 +25,7 @@ describe 'feeds/openbl-ip_reputation.feed', :feed do
 	describe 'event 0' do
       subject { events[0] }
       its(:type) { is_expected.to be(:scanning) }
-      its(:ipv4s) { is_expected.to match_array(['113.171.10.37']) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['113.171.10.37'])) }
     end
   end
 
@@ -42,7 +39,7 @@ describe 'feeds/openbl-ip_reputation.feed', :feed do
 	describe 'event 0' do
       subject { events[0] }
       its(:type) { is_expected.to be(:scanning) }
-      its(:ipv4s) { is_expected.to match_array(['210.209.84.57']) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['210.209.84.57'])) }
     end
   end
 end

data/spec/feeds/openphish_url_reputation_spec.rb

@@ -0,0 +1,50 @@
+require 'spec_helper'
+
+describe 'feeds/openphish-url_reputation.feed', :feed do
+  let(:provider) { 'openphish' }
+  let(:name) { 'url_reputation' }
+
+  it_fetches_url 'http://openphish.com/feed.txt'
+
+  describe_parsing_the_file feed_data('openphish-url-reputation.txt') do
+    it "should have parsed 15 records" do
+      expect(num_records_parsed).to eq(15)
+    end
+    it "should have filtered 1 records" do
+      expect(num_records_filtered).to eq(1)
+    end
+    it "should have missed 0 records" do
+      expect(num_records_missed).to eq(0)
+    end
+  end
+
+  describe_parsing_a_record 'http://107.190.137.202/~akshat/images/fr/webscr.confirmer.secure.connexion.mpp.information.compte.webapps.home/8fa5aed41992b676cf5305ee5c3d4e1e/login.php' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:malware_host) }
+	  its(:urls) { is_expected.to eq(build(:urls, values: ['http://107.190.137.202/~akshat/images/fr/webscr.confirmer.secure.connexion.mpp.information.compte.webapps.home/8fa5aed41992b676cf5305ee5c3d4e1e/login.php'])) }
+    end
+  end
+
+  describe_parsing_a_record 'http://haraiscompany.com/images/zpsiios/5g60jpjhifajb8rrvx1ixr/?jsp=main' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:malware_host) }
+	  its(:urls) { is_expected.to eq(build(:urls, values: ['http://haraiscompany.com/images/zpsiios/5g60jpjhifajb8rrvx1ixr/?jsp=main'])) }
+    end
+  end
+end
+
+

data/spec/feeds/packetmail_perimeterbad-ip_reputation_spec.rb

@@ -0,0 +1,47 @@
+require 'spec_helper'
+
+describe 'feeds/packetmail_perimeterbad-ip_reputation.feed', :feed do
+  let(:provider) { 'packetmail' }
+  let(:name) { 'perimeterbad_ip_reputation' }
+
+  it_fetches_url 'https://www.packetmail.net/iprep_perimeterbad.txt'
+
+  describe_parsing_the_file feed_data('packetmail_perimeterbad-ip_reputation.txt') do
+    it "should have parsed 8 records" do
+      expect(num_records_parsed).to eq(8)
+    end
+    it "should have filtered 36 records" do
+      expect(num_records_filtered).to eq(36)
+    end
+  end
+
+  describe_parsing_a_record '[03/Sep/2014:13:11:47 -0500]	192.99.152.38	206.82.85.197	403	GET /cc/process.php HTTP/1.1    -	Mozilla/5.0 (Windows NT 6.1; WOW64; rv:8.0) Gecko/20100101 Firefox/8.0	2014-09-03' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:scanning) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['192.99.152.38'])) }
+    end
+  end
+
+  describe_parsing_a_record '[03/Sep/2014:18:06:59 -0500]	69.28.85.204	www.hackbraten.tk	403	HEAD /Hackbraten.zip HTTP/1.1   -	curl/7.32.0	2014-09-03' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:scanning) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['69.28.85.204'])) }
+    end
+  end
+end
+
+

data/spec/feeds/palevo-domain_reputation_spec.rb

@@ -13,9 +13,6 @@ describe 'feeds/palevo-domain_reputation.feed', :feed do
     it "should have filtered 1 records" do
       expect(num_records_filtered).to eq(1)
     end
-    it "should have missed 0 records" do
-      expect(num_records_missed).to eq(0)
-    end
   end
 
   describe_parsing_a_record 'legionarios.servecounterstrike.com' do