U
    @6^n                     @   s(   d dl mZmZmZ G dd deZdS )    )
SpiderFootSpiderFootPluginSpiderFootEventc                   @   sV   e Zd ZdZddiZddiZdZdZe fddZ	d	d
 Z
dd Zdd Zdd ZdS )sfp_malwarepatrolzxMalwarePatrol:Investigate,Passive:Reputation Systems:apikey:Searches malwarepatrol.net's database of malicious URLs/IPs.api_key zMalwarepatrol.com 'receipt' ID, provided once signing up for their open-source feed. Without this you cannot obtain their feed.NFc                 C   s4   || _ |  | _t| D ]}|| | j|< qd S )N)sftempStorageresultslistkeysopts)selfsfcuserOptsopt r   </var/www/spiderfoot.crq.systems/modules/sfp_malwarepatrol.pysetup   s    
zsfp_malwarepatrol.setupc                 C   s   dddddgS )NINTERNET_NAME
IP_ADDRESSAFFILIATE_INTERNET_NAMEAFFILIATE_IPADDRCO_HOSTED_SITEr   r   r   r   r   watchedEvents&   s
     zsfp_malwarepatrol.watchedEventsc                 C   s   dddddgS )NMALICIOUS_IPADDRMALICIOUS_INTERNET_NAMEMALICIOUS_AFFILIATE_IPADDR!MALICIOUS_AFFILIATE_INTERNET_NAMEMALICIOUS_COHOSTr   r   r   r   r   producedEvents.   s
     z sfp_malwarepatrol.producedEventsc                 C   s   t  }d| jd  d }| jdd|d< |d d kr| jj|| jd d}|d d krn| jd	| d
 d S | jd|d  |d dD ],}t|dk s|	drq|	|r dS qd
S )Nz3http://lists.malwarepatrol.net/cgi/getfile?receipt=r   z&product=8&list=smoothwallZsfmalwarepatrolH   content
_useragent)	useragentzUnable to fetch F
   #T)
dictr   r   cacheGetfetchUrlerrorcachePutsplitlen
startswith)r   qaddrdataurlliner   r   r   	queryAddr3   s&    
zsfp_malwarepatrol.queryAddrc                 C   s   |j }|j}|j}| jrd S | jd| d |  | jd sV| jdd d| _d S || jkrx| jd| d  d S d| j|< d	}|d
kr|dkrd}nd}|dkr|dkrd}|dkrd}|dkrd}| 	|rt
|d| d | j|}| | d S )NzReceived event, z, from r   z@You enabled sfp_malwarepatrol but did not provide an receipt ID!FTz	Skipping z as already searched.r   )r   r   r   r   r   )r   r   r   r   r   r   r   r   r    zMalwarePatrol [])	eventTypemoduler2   
errorStater   debugr   r,   r
   r5   r   __name__notifyListeners)r   event	eventNamesrcModuleName	eventDataevtTypeevtr   r   r   handleEventK   s:    



zsfp_malwarepatrol.handleEvent)r;   
__module____qualname____doc__r   optdescsr
   r9   r)   r   r   r!   r5   rC   r   r   r   r   r      s     r   N)sflibr   r   r   r   r   r   r   r   <module>   s   