Repository: smicallef/spiderfoot
File: modules/sfp_ipqualityscore.py (Python)

Code before:
            maliciousDesc = f"IPQualityScore [ {eventData} ]\n"

        if eventName == "PHONE_NUMBER":
            if malicious:
                maliciousDesc += f" - FRAUD SCORE : {data.get('fraud_score')}\n - ACTIVE : {data.get('active')}\n - RISKY : {data.get('risky')}\n - RECENT ABUSE : {data.get('recent_abuse')}"
                evt = SpiderFootEvent("MALICIOUS_PHONE_NUMBER", maliciousDesc, self.__name__, event)
                self.notifyListeners(evt)

            geoInfo = ""
            city = data.get('city')
            country = data.get('country')
            zipcode = data.get('zip_code')
            region = data.get('region')

            if city:
                geoInfo += city + ", "
            if region:
                geoInfo += region + ", "
            if country:
                geoInfo += country + " "
            if zipcode:
                geoInfo += zipcode + ". "

            evt = SpiderFootEvent("GEOINFO", geoInfo, self.__name__, event)
            self.notifyListeners(evt)

        elif eventName == "EMAILADDR":
            if malicious:
                maliciousDesc += f" - FRAUD SCORE : {data.get('fraud_score')}\n - HONEYPOT : {data.get('honeypot')}\n - SPAM TRAP SCORE : {data.get('spam_trap_score')}\n - RECENT ABUSE : {data.get('recent_abuse')}"
                evt = SpiderFootEvent("MALICIOUS_EMAILADDR", maliciousDesc, self.__name__, event)
                self.notifyListeners(evt)

            if data.get('disposable'):
                evt = SpiderFootEvent("EMAILADDR_DISPOSABLE", eventData, self.__name__, event)
                self.notifyListeners(evt)

            if data.get('leaked'):
                evt = SpiderFootEvent("EMAILADDR_COMPROMISED", f"{eventData} [ {data.get('suggested_domain')} ]", self.__name__, event)
                self.notifyListeners(evt)
        elif eventName == "IP_ADDRESS" or eventName == "DOMAIN_NAME":
            if malicious:
                maliciousDesc += f" - FRAUD SCORE : {data.get('fraud_score')}\n - BOT STATUS : {data.get('bot_status')}\n - RECENT ABUSE : {data.get('recent_abuse')}\n - ABUSE VELOCITY : {data.get('abuse_velocity')}\n - VPN : {data.get('vpn')}\n - ACTIVE VPN : {data.get('active_vpn')}\n - TOR : {data.get('tor')}\n - ACTIVE TOR : {data.get('active_t')}"
                if eventName == "IP_ADDRESS":
                    evt = SpiderFootEvent("MALICIOUS_IPADDR", maliciousDesc, self.__name__, event)
                elif eventName == "DOMAIN_NAME":
                    evt = SpiderFootEvent("MALICIOUS_INTERNET_NAME", maliciousDesc, self.__name__, event)
                self.notifyListeners(evt)

            geoInfo = ""
            city = data.get('city')
            country = data.get('country_code')

Review comment (suggestion):
I believe the API also indicates the phone number type, or at least if it's disposable? That way this module could return `PHONE_NUMBER_TYPE`, and we could also add `PHONE_NUMBER_DISPOSABLE` as a type, just as we have for emails.

Code after:
            self.errorState = True
            return None

        if eventData in self.results:
            self.sf.debug(f"Skipping {eventData} as already mapped.")
            return None
        self.results[eventData] = True

        data = self.query(eventData, eventName)

        if data is None:
            return

        fraudScore = data.get('fraud_score')
        recentAbuse = data.get('recent_abuse')
        botStatus = data.get('bot_status')
        malicious = False
        maliciousDesc = ""

        if fraudScore >= self.opts['abuse_score_threshold'] or recentAbuse or botStatus:
            evt = SpiderFootEvent("RAW_RIR_DATA", str(data), self.__name__, event)
            self.notifyListeners(evt)
            malicious = True
            maliciousDesc = f"IPQualityScore [{eventData}]\n"

        if eventName == "PHONE_NUMBER":
            if malicious:
                maliciousDesc += f" - FRAUD SCORE : {fraudScore}\n - ACTIVE : {data.get('active')}\n - RISKY : {data.get('risky')}\n - RECENT ABUSE : {recentAbuse}"
                evt = SpiderFootEvent("MALICIOUS_PHONE_NUMBER", maliciousDesc, self.__name__, event)
                self.notifyListeners(evt)

            phoneNumberType = data.get('line_type')
            if phoneNumberType:
                evt = SpiderFootEvent("PHONE_NUMBER_TYPE", phoneNumberType, self.__name__, event)
                self.notifyListeners(evt)

            geoInfo = self.getGeoInfo(data)
            if geoInfo:
                evt = SpiderFootEvent("GEOINFO", geoInfo, self.__name__, event)
                self.notifyListeners(evt)

        elif eventName == "EMAILADDR":
            if malicious:
                maliciousDesc += f" - FRAUD SCORE : {fraudScore}\n - HONEYPOT : {data.get('honeypot')}\n - SPAM TRAP SCORE : {data.get('spam_trap_score')}\n - RECENT ABUSE : {recentAbuse}"
                evt = SpiderFootEvent("MALICIOUS_EMAILADDR", maliciousDesc, self.__name__, event)
                self.notifyListeners(evt)

            if data.get('disposable'):
                evt = SpiderFootEvent("EMAILADDR_DISPOSABLE", eventData, self.__name__, event)
                self.notifyListeners(evt)