class Enricher::IPVoid

IPVOID ipv4 allow for dynamic checks against the list checks provided by IPVOID.

Constants

APT_KEY

First you need to include the correct require files

DISABLED

Public Class Methods

hash_cache() click to toggle source
# File lib/enricher/ipvoid.rb, line 13
def self.hash_cache
  @@hash_cache
end
new(constructor = {}) click to toggle source
# File lib/enricher/ipvoid.rb, line 17
def initialize(constructor = {})
  
  raise DisabledClassIncluded if DISABLED 
  #First you need to include the correct require files
  APT_KEY = "YOUR API KEY HERE"
  @@hash_cache ||= Vash.new
  @@url_cache ||= Vash.new  
    # Voliate Cache store for 43200 (12hr)
end
url_cache() click to toggle source
# File lib/enricher/ipvoid.rb, line 9
def self.url_cache
  @@url_cache
end

Public Instance Methods

hash(hash) click to toggle source
# File lib/enricher/ipvoid.rb, line 53
def hash(hash)
  #To query a hash(sha1/sha256/md5)
  @@hash_cache["vt_#{hash}".to_sym] ||= Uirusu::VTFile.query_report(VT_APT_KEY, hash)
  result = Uirusu::VTResult.new(hash, results)
  result.to_json
end
junk() click to toggle source
# File lib/enricher/ipvoid.rb, line 27
    def junk

      # RestClient scrape with Nokogiri.... (nokogiri requires libxml which is native which is not jruby compliant.. )

=begin 
      for ip in open(conf.iplist, "r"):
    url = "http://www.ipvoid.com/scan/%s" % (ip)
    emailBody = emailBody + "IP: "+ip
    resp = requests.get(url)
    string1 = unicodedata.normalize('NFKD', resp.text).encode('ascii','ignore')
    r = string1.translate(string.maketrans("\n\t\r", "   "))
    blacklist = re.search(r'Blacklist Status</td><td><span.+>(\w.+)</span>', r)
    if blacklist != None and blacklist.group(1) == "BLACKLISTED":
         emailBody = emailBody + 'The IP is blacklisted! \n'
         detection = re.search(r'Detection Ratio</td><td>(\d+ / \d+) \(<font', r)
         emailBody = emailBody + 'Detection Ratio was %s \n' % detection.group(1)
         detected_line = re.search(r'\s+<tr><td><img src="(.+)', r)
         detected_sites = re.findall(r'Favicon" />(.+?)</td><td><img src=".+?" alt="Alert" title="Detected!".+?"nofollow" href="(.+?)" title', detected_line.group(1))
         for site in detected_sites:
             emailBody = emailBody + "List Name:" + site[0] + "Url: "+ site[1] + "\n\n"
    else:
         emailBody = emailBody + 'Not blacklisted...\n\n'
=end
    end
url(url) click to toggle source
# File lib/enricher/ipvoid.rb, line 60
def url(url)

  # Use Base 36 for symbols
  #>> "joe@momma.org".hash.to_s(36)
  #=> "37zed965f04p"
  #>> "http://joe@momma.org".hash.to_s(36)
  #=> "vj36lppwievl"
  #=> Tack on.. vt_ to url converted .hash.to_s(36)

  @@url_cache["vt_#{url.hash.to_s(36)}".to_sym] ||= Uirusu::VTUrl.query_report(VT_APT_KEY, url)
   
  result = Uirusu::VTResult.new(url, results)
  result.to_json
end