Rearranging attack detection methods to toolbelt class.

Signed-off-by: Edwin Luijten <edwin.luijten@live.nl>