threatinator 0.1.6 → 0.2.0

data/spec/feeds/blocklist_de_bots-ip_reputation_spec.rb

@@ -13,9 +13,6 @@ describe 'feeds/blocklist_de_bots-ip_reputation.feed', :feed do
     it "should have filtered 2 records" do
       expect(num_records_filtered).to eq(2)
     end
-    it "should have missed 0 records" do
-      expect(num_records_missed).to eq(0)
-    end
   end
 
   describe_parsing_a_record '101.71.196.164' do
@@ -28,7 +25,7 @@ describe 'feeds/blocklist_de_bots-ip_reputation.feed', :feed do
 	describe 'event 0' do
       subject { events[0] }
       its(:type) { is_expected.to be(:scanning) }
-      its(:ipv4s) { is_expected.to match_array(['101.71.196.164']) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['101.71.196.164'])) }
     end
   end
 
@@ -42,7 +39,7 @@ describe 'feeds/blocklist_de_bots-ip_reputation.feed', :feed do
 	describe 'event 0' do
       subject { events[0] }
       its(:type) { is_expected.to be(:scanning) }
-      its(:ipv4s) { is_expected.to match_array(['200.93.43.157']) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['200.93.43.157'])) }
     end
   end
 end

data/spec/feeds/blocklist_de_ftp-ip_reputation_spec.rb

@@ -13,9 +13,6 @@ describe 'feeds/blocklist_de_ftp-ip_reputation.feed', :feed do
     it "should have filtered 0 records" do
       expect(num_records_filtered).to eq(0)
     end
-    it "should have missed 0 records" do
-      expect(num_records_missed).to eq(0)
-    end
   end
 
   describe_parsing_a_record '111.192.138.169' do
@@ -28,7 +25,7 @@ describe 'feeds/blocklist_de_ftp-ip_reputation.feed', :feed do
 	describe 'event 0' do
       subject { events[0] }
       its(:type) { is_expected.to be(:scanning) }
-      its(:ipv4s) { is_expected.to match_array(['111.192.138.169']) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['111.192.138.169'])) }
     end
   end
 
@@ -42,7 +39,7 @@ describe 'feeds/blocklist_de_ftp-ip_reputation.feed', :feed do
 	describe 'event 0' do
       subject { events[0] }
       its(:type) { is_expected.to be(:scanning) }
-      its(:ipv4s) { is_expected.to match_array(['112.198.77.229']) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['112.198.77.229'])) }
     end
   end
 end

data/spec/feeds/blocklist_de_imap-ip_reputation_spec.rb

@@ -13,9 +13,6 @@ describe 'feeds/blocklist_de_imap-ip_reputation.feed', :feed do
     it "should have filtered 0 records" do
       expect(num_records_filtered).to eq(0)
     end
-    it "should have missed 0 records" do
-      expect(num_records_missed).to eq(0)
-    end
   end
 
   describe_parsing_a_record '1.93.46.156' do
@@ -28,7 +25,7 @@ describe 'feeds/blocklist_de_imap-ip_reputation.feed', :feed do
 	describe 'event 0' do
       subject { events[0] }
       its(:type) { is_expected.to be(:scanning) }
-      its(:ipv4s) { is_expected.to match_array(['1.93.46.156']) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['1.93.46.156'])) }
     end
   end
 
@@ -42,7 +39,7 @@ describe 'feeds/blocklist_de_imap-ip_reputation.feed', :feed do
 	describe 'event 0' do
       subject { events[0] }
       its(:type) { is_expected.to be(:scanning) }
-      its(:ipv4s) { is_expected.to match_array(['103.10.134.220']) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['103.10.134.220'])) }
     end
   end
 end

data/spec/feeds/blocklist_de_pop3-ip_reputation_spec.rb

@@ -13,9 +13,6 @@ describe 'feeds/blocklist_de_pop3-ip_reputation.feed', :feed do
     it "should have filtered 0 records" do
       expect(num_records_filtered).to eq(0)
     end
-    it "should have missed 0 records" do
-      expect(num_records_missed).to eq(0)
-    end
   end
 
   describe_parsing_a_record '1.175.64.9' do
@@ -28,7 +25,7 @@ describe 'feeds/blocklist_de_pop3-ip_reputation.feed', :feed do
 	describe 'event 0' do
       subject { events[0] }
       its(:type) { is_expected.to be(:scanning) }
-      its(:ipv4s) { is_expected.to match_array(['1.175.64.9']) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['1.175.64.9'])) }
     end
   end
 
@@ -42,7 +39,7 @@ describe 'feeds/blocklist_de_pop3-ip_reputation.feed', :feed do
 	describe 'event 0' do
       subject { events[0] }
       its(:type) { is_expected.to be(:scanning) }
-      its(:ipv4s) { is_expected.to match_array(['1.53.0.215']) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['1.53.0.215'])) }
     end
   end
 end

data/spec/feeds/blocklist_de_proftpd-ip_reputation_spec.rb

@@ -13,9 +13,6 @@ describe 'feeds/blocklist_de_proftpd-ip_reputation.feed', :feed do
     it "should have filtered 0 records" do
       expect(num_records_filtered).to eq(0)
     end
-    it "should have missed 0 records" do
-      expect(num_records_missed).to eq(0)
-    end
   end
 
   describe_parsing_a_record '111.192.148.129' do
@@ -28,7 +25,7 @@ describe 'feeds/blocklist_de_proftpd-ip_reputation.feed', :feed do
 	describe 'event 0' do
       subject { events[0] }
       its(:type) { is_expected.to be(:scanning) }
-      its(:ipv4s) { is_expected.to match_array(['111.192.148.129']) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['111.192.148.129'])) }
     end
   end
 
@@ -42,7 +39,7 @@ describe 'feeds/blocklist_de_proftpd-ip_reputation.feed', :feed do
 	describe 'event 0' do
       subject { events[0] }
       its(:type) { is_expected.to be(:scanning) }
-      its(:ipv4s) { is_expected.to match_array(['112.90.37.220']) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['112.90.37.220'])) }
     end
   end
 end

data/spec/feeds/blocklist_de_sip-ip_reputation_spec.rb

@@ -13,9 +13,6 @@ describe 'feeds/blocklist_de_sip-ip_reputation.feed', :feed do
     it "should have filtered 0 records" do
       expect(num_records_filtered).to eq(0)
     end
-    it "should have missed 0 records" do
-      expect(num_records_missed).to eq(0)
-    end
   end
 
   describe_parsing_a_record '178.32.229.159' do
@@ -28,7 +25,7 @@ describe 'feeds/blocklist_de_sip-ip_reputation.feed', :feed do
 	describe 'event 0' do
       subject { events[0] }
       its(:type) { is_expected.to be(:scanning) }
-      its(:ipv4s) { is_expected.to match_array(['178.32.229.159']) }
+      its(:ipv4s) { is_expected.to eq(build(:ipv4s, values: ['178.32.229.159'])) }
     end
   end
 
@@ -42,7 +39,7 @@ describe 'feeds/blocklist_de_sip-ip_reputation.feed', :feed do
 	describe 'event 0' do
       subject { events[0] }
       its(:type) { is_expected.to be(:scanning) }
-      its(:ipv4s) { is_expected.to match_array(['198.204.224.10']) }
+      its(:ipv4s) { is_expected.to eq(build(:ipv4s, values: ['198.204.224.10'])) }
     end
   end
 end

data/spec/feeds/blocklist_de_ssh-ip_reputation_spec.rb

@@ -13,9 +13,6 @@ describe 'feeds/blocklist_de_ssh-ip_reputation.feed', :feed do
     it "should have filtered 0 records" do
       expect(num_records_filtered).to eq(0)
     end
-    it "should have missed 0 records" do
-      expect(num_records_missed).to eq(0)
-    end
   end
 
   describe_parsing_a_record '1.93.24.83' do
@@ -28,7 +25,7 @@ describe 'feeds/blocklist_de_ssh-ip_reputation.feed', :feed do
 	describe 'event 0' do
       subject { events[0] }
       its(:type) { is_expected.to be(:scanning) }
-      its(:ipv4s) { is_expected.to match_array(['1.93.24.83']) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['1.93.24.83'])) }
     end
   end
 
@@ -42,7 +39,7 @@ describe 'feeds/blocklist_de_ssh-ip_reputation.feed', :feed do
 	describe 'event 0' do
       subject { events[0] }
       its(:type) { is_expected.to be(:scanning) }
-      its(:ipv4s) { is_expected.to match_array(['1.93.25.251']) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['1.93.25.251'])) }
     end
   end
 end

data/spec/feeds/blocklist_de_strongips-ip_reputation_spec.rb

@@ -13,9 +13,6 @@ describe 'feeds/blocklist_de_strongips-ip_reputation.feed', :feed do
     it "should have filtered 0 records" do
       expect(num_records_filtered).to eq(0)
     end
-    it "should have missed 0 records" do
-      expect(num_records_missed).to eq(0)
-    end
   end
 
   describe_parsing_a_record '188.143.232.211' do
@@ -28,7 +25,7 @@ describe 'feeds/blocklist_de_strongips-ip_reputation.feed', :feed do
 	describe 'event 0' do
       subject { events[0] }
       its(:type) { is_expected.to be(:scanning) }
-      its(:ipv4s) { is_expected.to match_array(['188.143.232.211']) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['188.143.232.211'])) }
     end
   end
 
@@ -42,7 +39,7 @@ describe 'feeds/blocklist_de_strongips-ip_reputation.feed', :feed do
 	describe 'event 0' do
       subject { events[0] }
       its(:type) { is_expected.to be(:scanning) }
-      its(:ipv4s) { is_expected.to match_array(['142.54.173.130']) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['142.54.173.130'])) }
     end
   end
 end

data/spec/feeds/botscout-ip_reputation_spec.rb

@@ -0,0 +1,50 @@
+require 'spec_helper'
+
+describe 'feeds/botscout-ip_reputation.feed', :feed do
+  let(:provider) { 'botscout' }
+  let(:name) { 'ip_reputation' }
+
+  it_fetches_url 'http://botscout.com/last_caught_cache.htm'
+
+  describe_parsing_the_file feed_data('botscout-ip-reputation.txt') do
+    it "should have parsed 100 records" do
+      expect(num_records_parsed).to eq(100)
+    end
+    it "should have filtered 613 records" do
+      expect(num_records_filtered).to eq(613)
+    end
+    it "should have missed 0 records" do
+      expect(num_records_missed).to eq(0)
+    end
+  end
+
+  describe_parsing_a_record '<td><a href="/ipcheck.htm?ip=71.173.145.58">71.173.145.58</a></td>' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:scanning) }
+	  its(:ipv4s) { is_expected.to eq(build(:ipv4s, values: ['71.173.145.58'])) }
+    end
+  end
+
+  describe_parsing_a_record '<td><a href="/ipcheck.htm?ip=91.200.13.5">91.200.13.5</a></td>' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:scanning) }
+	  its(:ipv4s) { is_expected.to eq(build(:ipv4s, values: ['91.200.13.5'])) }
+    end
+  end
+end
+
+

data/spec/feeds/cert_mxpoison-ip_reputation_spec.rb

@@ -0,0 +1,47 @@
+require 'spec_helper'
+
+describe 'feeds/cert_mxpoison-ip_reputation.feed', :feed do
+  let(:provider) { 'cert' }
+  let(:name) { 'mxpoison_ip_reputation' }
+
+  it_fetches_url 'http://www.cert.org/downloads/mxlist.ips.txt'
+
+  describe_parsing_the_file feed_data('cert_mxpoison-ip_reputation.txt') do
+    it "should have parsed 17 records" do
+      expect(num_records_parsed).to eq(17)
+    end
+    it "should have filtered 0 records" do
+      expect(num_records_filtered).to eq(0)
+    end
+  end
+
+  describe_parsing_a_record '74.125.196.27' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:malware_host) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['74.125.196.27'])) }
+    end
+  end
+
+  describe_parsing_a_record '74.53.119.26' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:malware_host) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['74.53.119.26'])) }
+    end
+  end
+end
+
+

data/spec/feeds/chaosreigns-ip_reputation_spec.rb

@@ -0,0 +1,50 @@
+require 'spec_helper'
+
+describe 'feeds/chaosreigns-ip_reputation.feed', :feed do
+  let(:provider) { 'chaosreigns' }
+  let(:name) { 'ip_reputation' }
+
+  it_fetches_url 'http://www.chaosreigns.com/iprep/iprep.txt'
+
+  describe_parsing_the_file feed_data('chaosreigns-ip-reputation.txt') do
+    it "should have parsed 5 records" do
+      expect(num_records_parsed).to eq(5)
+    end
+    it "should have filtered 21 records" do
+      expect(num_records_filtered).to eq(21)
+    end
+    it "should have missed 0 records" do
+      expect(num_records_missed).to eq(0)
+    end
+  end
+
+  describe_parsing_a_record '       5.9.94.3     0    17' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:scanning) }
+	  its(:ipv4s) { is_expected.to eq(build(:ipv4s, values: ['5.9.94.3'])) }
+    end
+  end
+
+  describe_parsing_a_record '       1.52.9.7     0     0' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:scanning) }
+	  its(:ipv4s) { is_expected.to eq(build(:ipv4s, values: ['1.52.9.7'])) }
+    end
+  end
+end
+
+

data/spec/feeds/ciarmy-ip_reputation_spec.rb

@@ -13,9 +13,6 @@ describe 'feeds/ciarmy-ip_reputation.feed', :feed do
     it "should have filtered 0 records" do
       expect(num_records_filtered).to eq(0)
     end
-    it "should have missed 0 records" do
-      expect(num_records_missed).to eq(0)
-    end
   end
 
   describe_parsing_a_record '5.79.68.161' do
@@ -28,7 +25,7 @@ describe 'feeds/ciarmy-ip_reputation.feed', :feed do
 	describe 'event 0' do
       subject { events[0] }
       its(:type) { is_expected.to be(:scanning) }
-      its(:ipv4s) { is_expected.to match_array(['5.79.68.161']) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['5.79.68.161'])) }
     end
   end
 
@@ -42,7 +39,7 @@ describe 'feeds/ciarmy-ip_reputation.feed', :feed do
 	describe 'event 0' do
       subject { events[0] }
       its(:type) { is_expected.to be(:scanning) }
-      its(:ipv4s) { is_expected.to match_array(['10.0.100.121']) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['10.0.100.121'])) }
     end
   end
 end

data/spec/feeds/cruzit-ip_reputation_spec.rb

@@ -13,9 +13,6 @@ describe 'feeds/cruzit-ip_reputation.feed', :feed do
     it "should have filtered 0 records" do
       expect(num_records_filtered).to eq(0)
     end
-    it "should have missed 0 records" do
-      expect(num_records_missed).to eq(0)
-    end
   end
 
   describe_parsing_a_record '107.170.248.56' do
@@ -28,7 +25,7 @@ describe 'feeds/cruzit-ip_reputation.feed', :feed do
 	describe 'event 0' do
       subject { events[0] }
       its(:type) { is_expected.to be(:scanning) }
-      its(:ipv4s) { is_expected.to match_array(['107.170.248.56']) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['107.170.248.56'])) }
     end
   end
 
@@ -42,7 +39,7 @@ describe 'feeds/cruzit-ip_reputation.feed', :feed do
 	describe 'event 0' do
       subject { events[0] }
       its(:type) { is_expected.to be(:scanning) }
-      its(:ipv4s) { is_expected.to match_array(['80.82.64.114']) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['80.82.64.114'])) }
     end
   end
 end

data/spec/feeds/cydef_torexit-ip_reputation_spec.rb

@@ -0,0 +1,47 @@
+require 'spec_helper'
+
+describe 'feeds/cydef_torexit-ip_reputation.feed', :feed do
+  let(:provider) { 'cydef' }
+  let(:name) { 'torexit_ip_reputation' }
+
+  it_fetches_url 'https://cydef.us/torexit.txt'
+
+  describe_parsing_the_file feed_data('cydef_torexit-ip_reputation.txt') do
+    it "should have parsed 26 records" do
+      expect(num_records_parsed).to eq(26)
+    end
+    it "should have filtered 1 records" do
+      expect(num_records_filtered).to eq(1)
+    end
+  end
+
+  describe_parsing_a_record '5.9.195.140' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:scanning) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['5.9.195.140'])) }
+    end
+  end
+
+  describe_parsing_a_record '5.45.104.141' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:scanning) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['5.45.104.141'])) }
+    end
+  end
+end
+
+