Repository: smicallef/spiderfoot
File: modules/sfp_spur.py (Python)

Code before:

            if geoTag:
                city = geoTag.get('city')
                country = geoTag.get('country')
                state = geoTag.get('state')

                geoInfo = ""
                if city:
                    geoInfo += city + ", "
                
                if state:
                    geoInfo += state + ", "
                
                if country:
                    geoInfo += country
                
                evt = SpiderFootEvent("GEOINFO", geoInfo, self.__name__, event)
                self.notifyListeners(evt)
            
            asData = data.get('as')

            if asData:
                orgName = asData.get('organization')  

                if orgName:
                    evt = SpiderFootEvent("COMPANY_NAME", orgName, self.__name__, event)
                    self.notifyListeners(evt)
            
            vpnOperators = data.get('vpnOperators')
            
            vpnOperatorsExists = vpnOperators.get('exists')

            if vpnOperatorsExists:
                vpnOperatorNames = vpnOperators.get('operators')

                maliciousIPDesc = "spur.us [ " + str(addr) + " ]\n"
                maliciousIPDesc += "VPN Operators : "

                for operatorNameDict in vpnOperatorNames:
                    operatorName = operatorNameDict.get('name')

                    if operatorName:
                        maliciousIPDesc += operatorName + ", "

                maliciousIPDesc = maliciousIPDesc.strip(", ")

                if eventName.startswith("NETBLOCK_"):
                    evt = SpiderFootEvent("MALICIOUS_IPADDR", maliciousIPDesc, self.__name__, ipEvt)
                    self.notifyListeners(evt)
                else:
                    evt = SpiderFootEvent("MALICIOUS_IPADDR", maliciousIPDesc, self.__name__, event)

Review comment (suggestion):
Should probably use `ipEvt` instead of `event`, since it was the IP address you looked up, not the netblock.

Code after:
                self.notifyListeners(evt)

            if eventName.startswith("NETBLOCK_"):
                evt = SpiderFootEvent("RAW_RIR_DATA", str(data), self.__name__, ipEvt)
                self.notifyListeners(evt)
            else:
                evt = SpiderFootEvent("RAW_RIR_DATA", str(data), self.__name__, event)
                self.notifyListeners(evt)

            geoTag = data.get('geoLite')

            if geoTag:
                city = geoTag.get('city')
                country = geoTag.get('country')
                state = geoTag.get('state')

                geoInfo = ""
                if city:
                    geoInfo += city + ", "
                
                if state:
                    geoInfo += state + ", "
                
                if country:
                    geoInfo += country
                
                if eventName.startswith("NETBLOCK_"):
                    evt = SpiderFootEvent("GEOINFO", geoInfo, self.__name__, ipEvt)
                    self.notifyListeners(evt)
                elif eventName.startswith("AFFILIATE_"):
                    # Don't report GEOINFO for Affiliates
                    pass
                else:
                    evt = SpiderFootEvent("GEOINFO", geoInfo, self.__name__, event)
                    self.notifyListeners(evt)
            
            asData = data.get('as')

            if asData:
                orgName = asData.get('organization')  

                if orgName:
                    if eventName.startswith("NETBLOCK_"):
                        evt = SpiderFootEvent("COMPANY_NAME", orgName, self.__name__, ipEvt)
                        self.notifyListeners(evt)
                    elif eventName.startswith("AFFILIATE_"):
                        # Don't report COMPANY_NAME for Affiliates
                        pass
                    else:
                        evt = SpiderFootEvent("COMPANY_NAME", orgName, self.__name__, event)
                        self.notifyListeners(evt)