import urllib2
import re
from Malcom.model.datatypes import Hostname, Evil
from feed import Feed
import Malcom.auxiliary.toolbox as toolbox

class MalwareDomains(Feed):
	def __init__(self, name):
		super(MalwareDomains, self).__init__(name)
		self.source = "http://mirror1.malwaredomains.com/files/domains.txt"
		self.description = "Malware domains blocklist"
		self.confidence = 50
		self.name = "MalwareDomains"

	def update(self):
		self.update_lines()

	def analyze(self, line):
		if line.startswith('#') or line.startswith('\n'):
			return

		splitted_mdl = line.split('\t')
		# 	20151201	agasi-story.info	malicious	blog.dynamoo.com	20131130	20121201	20120521	20110217

		# Create the new hostname and store it in the DB
		hostname = Hostname(hostname=splitted_mdl[2])
		if hostname['value'] == None: return # hostname not found
		evil = Evil()
		evil['value'] = "Malware domain blocklist (%s)" % hostname['value']
		evil['tags'] = ['malwaredomains', splitted_mdl[3]]
		evil['reference'] = splitted_mdl[4]

		return hostname, evil
		



import urllib2
import re
from Malcom.model.datatypes import Hostname, Evil
from feed import Feed
import Malcom.auxiliary.toolbox as toolbox

class MalwareDomains(Feed):
	def __init__(self, name):
		super(MalwareDomains, self).__init__(name)
		self.source = "http://mirror1.malwaredomains.com/files/domains.txt"
		self.description = "Malware domains blocklist"
		self.confidence = 50
		self.name = "MalwareDomains"

	def update(self):
		self.update_lines()

	def analyze(self, line):
		if line.startswith('#') or line.startswith('\n'):
			return

		splitted_mdl = line.split('\t')
		# 	20151201	agasi-story.info	malicious	blog.dynamoo.com	20131130	20121201	20120521	20110217

		# Create the new hostname and store it in the DB
		hostname = Hostname(hostname=splitted_mdl[2])
		if hostname['value'] == None: return # hostname not found
		evil = Evil()
		evil['value'] = "Malware domain blocklist (%s)" % hostname['value']
		evil['tags'] = ['malwaredomains', re.sub(r'[^\w]', '', splitted_mdl[3])]
		evil['reference'] = splitted_mdl[4]

		return hostname, evil
		



Deal with MalwareDomains non-ASCII characters
Deal with MalwareDomains non-ASCII characters
