@@ -0,0 +1,2009 @@
+#!/usr/bin/python%0A# -*- coding: utf-8 -*-%0A%0Aimport socket%0Aimport re%0Aimport requests%0Aimport ipwhois%0Afrom pprint import pprint%0A%0A%0Adef get_url(url):%0A    try:%0A        res = requests.get(url)%0A    except requests.exceptions.ConnectionError:%0A        raise requests.exceptions.ConnectionError(%22DNS lookup failures%22)%0A    else:%0A        if res.status_code != 200:%0A            raise requests.exceptions.ConnectionError(%0A                %22the %7B%7D, answer with %7B%7D error%22.format(url, res.status_code))%0A%0A        return res%0A%0A%0Adef get_host(ip):%0A    attempts = 5%0A    host = %22undefined%22%0A    while attempts:%0A        try:%0A            data = socket.gethostbyaddr(ip)%0A            host = data%5B0%5D%0A            break%0A        except socket.herror:%0A            attempts -= 1%0A%0A    return host%0A%0A%0Adef get_who_is_and_country(ip):%0A    try:%0A        ip_obj = ipwhois.IPWhois(ip)%0A        who_is = ip_obj.lookup(retry_count=5)%0A        return str(who_is), who_is%5B'asn_country_code'%5D%0A    except ipwhois.exceptions.IPDefinedError:%0A        return %22Private-Use Networks%22, %22undefined%22%0A    except ipwhois.exceptions.WhoisLookupError:%0A        return %22undefined%22, %22undefined%22%0A%0A%0Adef gather(base_url):%0A    res = get_url(base_url)%0A    for line in res.iter_lines():%0A        if line%5B:1%5D == %22#%22:%0A            continue%0A%0A        line = line.split('%7C')%0A        ip = line%5B2%5D.strip()%0A        attack_type = line%5B4%5D.strip()%0A        ip = re.findall(r'%5B0-9%5D+(?:%5C.%5B0-9%5D+)%7B3%7D', ip)%0A        if len(ip) == 0:%0A            continue%0A%0A        ip_address = ip%5B0%5D%0A        host = get_host(ip_address)%0A        who_is, country = get_who_is_and_country(ip_address)%0A%0A        doc = %7B%0A            'IP': ip_address,%0A            'SourceInfo': base_url,%0A            'Type': attack_type,%0A            'Country': country,%0A            'Domain': host,%0A            'URL': host,%0A            'WhoIsInfo': who_is,%0A        %7D%0A%0A        pprint(doc)%0A%0Aif __name__ == '__main__':%0A    gather('http://dragonresearchgroup.org/insight/vncprobe.txt')%0A    gather('http://dragonresearchgroup.org/insight/sshpwauth.txt')%0A

add collector for http://dragonresearchgroup.org