3
@6^n                 @   s(   d dl mZmZmZ G dd deZdS )    )
SpiderFootSpiderFootPluginSpiderFootEventc               @   sV   e Zd ZdZddiZddiZdZdZe fddZ	d	d
 Z
dd Zdd Zdd ZdS )sfp_malwarepatrolzxMalwarePatrol:Investigate,Passive:Reputation Systems:apikey:Searches malwarepatrol.net's database of malicious URLs/IPs.api_key zMalwarepatrol.com 'receipt' ID, provided once signing up for their open-source feed. Without this you cannot obtain their feed.NFc             C   s8   || _ | j | _x"t|j D ]}|| | j|< qW d S )N)sftempStorageresultslistkeysopts)selfsfcuserOptsopt r   </var/www/spiderfoot.crq.systems/modules/sfp_malwarepatrol.pysetup   s    
zsfp_malwarepatrol.setupc             C   s   dddddgS )NINTERNET_NAME
IP_ADDRESSAFFILIATE_INTERNET_NAMEAFFILIATE_IPADDRCO_HOSTED_SITEr   )r   r   r   r   watchedEvents&   s    zsfp_malwarepatrol.watchedEventsc             C   s   dddddgS )NMALICIOUS_IPADDRMALICIOUS_INTERNET_NAMEMALICIOUS_AFFILIATE_IPADDR!MALICIOUS_AFFILIATE_INTERNET_NAMEMALICIOUS_COHOSTr   )r   r   r   r   producedEvents.   s    z sfp_malwarepatrol.producedEventsc             C   s   t  }d| jd  d }| jjdd|d< |d d kr| jj|| jd d}|d d krn| jjd	| d
 d S | jjd|d  x<|d jdD ]*}t|dk s|j	drq|j	|rdS qW d
S )Nz3http://lists.malwarepatrol.net/cgi/getfile?receipt=r   z&product=8&list=smoothwallZsfmalwarepatrolH   content
_useragent)	useragentzUnable to fetch F
   #T)
dictr   r   cacheGetfetchUrlerrorcachePutsplitlen
startswith)r   qaddrdataurlliner   r   r   	queryAddr3   s    
zsfp_malwarepatrol.queryAddrc             C   s   |j }|j}|j}| jrd S | jjd| d |  | jd sV| jjdd d| _d S || jkrx| jjd| d  d S d| j|< d	}|dkr|d
krd}nd}|dkr|dkrd}|dkrd}|dkrd}| j	| rt
|d| d | j|}| j| d S )NzReceived event, z, from r   z@You enabled sfp_malwarepatrol but did not provide an receipt ID!FTz	Skipping z as already searched.r   r   r   r   r   r   r   r   r   r   r   zMalwarePatrol [])r   r   )r   r   r   )	eventTypemoduler1   
errorStater   debugr   r+   r
   r4   r   __name__notifyListeners)r   event	eventNamesrcModuleName	eventDataevtTypeevtr   r   r   handleEventK   s<    


zsfp_malwarepatrol.handleEvent)r:   
__module____qualname____doc__r   optdescsr
   r8   r(   r   r   r    r4   rB   r   r   r   r   r      s   r   N)sflibr   r   r   r   r   r   r   r   <module>   s   