Repository: smicallef/spiderfoot
File: modules/sfp_seon.py (Python)

Code before:
            resultSet = data.get('data')
            if resultSet:
                if resultSet.get('score') >= self.opts['fraud_threshold']:
                    maliciousDesc = f"SEON [{eventData}]\n - FRAUD SCORE: {resultSet.get('score')}"
                    evt = SpiderFootEvent("MALICIOUS_IPADDR", maliciousDesc, self.__name__, event)
                    self.notifyListeners(evt)

                    if resultSet.get('tor'):
                        evt = SpiderFootEvent("WEBSERVER_TECHNOLOGY", f"Server is TOR node: {resultSet.get('tor')}", self.__name__, event)
                        self.notifyListeners(evt)

                    if resultSet.get('vpn'):
                        evt = SpiderFootEvent("WEBSERVER_TECHNOLOGY", f"Server is VPN: {resultSet.get('vpn')}", self.__name__, event)
                        self.notifyListeners(evt)

                    if resultSet.get('web_proxy'):
                        evt = SpiderFootEvent("WEBSERVER_TECHNOLOGY", f"Server is Web Proxy: {resultSet.get('web_proxy')}", self.__name__, event)
                        self.notifyListeners(evt)

                    if resultSet.get('public_proxy'):
                        evt = SpiderFootEvent("WEBSERVER_TECHNOLOGY", f"Server is Public Proxy: {resultSet.get('public_proxy')}", self.__name__, event)
                        self.notifyListeners(evt)

                if resultSet.get('country'):
                    location = ', '.join(filter(None, [resultSet.get('city'), resultSet.get('state_prov'), resultSet.get('country')]))
                    location += f"\n-Latitude: {resultSet.get('latitude')}\n-Longitude: {resultSet.get('longitude')}"
                    evt = SpiderFootEvent('GEOINFO', location, self.__name__, event)
                    self.notifyListeners(evt)

                if resultSet.get('open_ports'):
                    for port in resultSet.get('open_ports'):
                        evt = SpiderFootEvent('TCP_PORT_OPEN', f"{eventData}:{port}", self.__name__, event)
                        self.notifyListeners(evt)

                evt = SpiderFootEvent('RAW_RIR_DATA', str(resultSet), self.__name__, event)
                self.notifyListeners(evt)

        elif eventName == "EMAILADDR":
            data = self.query(eventData, eventName)
            if data is None:
                return None

            resultSet = data.get('data')
            if resultSet:
                if resultSet.get('score') >= self.opts['fraud_threshold']:
                    maliciousDesc = f"SEON [{eventData}]\n - FRAUD SCORE: {resultSet.get('score')}"
                    evt = SpiderFootEvent("MALICIOUS_EMAILADDR", maliciousDesc, self.__name__, event)
                    self.notifyListeners(evt)

                if resultSet.get('deliverable'):
                    evt = SpiderFootEvent("EMAILADDR_DELIVERABLE", eventData, self.__name__, event)

Review comment (suggestion):
Lat/Lon has its own event type - `PHYSICAL_COORDINATES`, so should be a separate additional event.

Code after:
        # Don't look up stuff twice
        if eventData in self.results:
            self.sf.debug(f"Skipping {eventData}, already checked.")
            return None
        else:
            self.results[eventData] = True

        dataFound = False
        if eventName == "IP_ADDRESS" or eventName == "IPV6_ADDRESS":
            data = self.query(eventData, eventName)
            if data is None:
                return None

            resultSet = data.get('data')
            if resultSet:
                if resultSet.get('score', 0) >= self.opts['fraud_threshold']:
                    maliciousDesc = f"SEON [{eventData}]\n - FRAUD SCORE: {resultSet.get('score')}"
                    evt = SpiderFootEvent("MALICIOUS_IPADDR", maliciousDesc, self.__name__, event)
                    self.notifyListeners(evt)
                    dataFound = True

                    if resultSet.get('tor'):
                        evt = SpiderFootEvent("WEBSERVER_TECHNOLOGY", f"Server is TOR node: {resultSet.get('tor')}", self.__name__, event)
                        self.notifyListeners(evt)
                        dataFound = True

                    if resultSet.get('vpn'):
                        evt = SpiderFootEvent("WEBSERVER_TECHNOLOGY", f"Server is VPN: {resultSet.get('vpn')}", self.__name__, event)
                        self.notifyListeners(evt)
                        dataFound = True

                    if resultSet.get('web_proxy'):
                        evt = SpiderFootEvent("WEBSERVER_TECHNOLOGY", f"Server is Web Proxy: {resultSet.get('web_proxy')}", self.__name__, event)
                        self.notifyListeners(evt)
                        dataFound = True

                    if resultSet.get('public_proxy'):
                        evt = SpiderFootEvent("WEBSERVER_TECHNOLOGY", f"Server is Public Proxy: {resultSet.get('public_proxy')}", self.__name__, event)
                        self.notifyListeners(evt)
                        dataFound = True

                if resultSet.get('country'):
                    location = ', '.join(filter(None, [resultSet.get('city'), resultSet.get('state_prov'), resultSet.get('country')]))
                    evt = SpiderFootEvent('GEOINFO', location, self.__name__, event)
                    self.notifyListeners(evt)

                    evt = SpiderFootEvent('PHYSICAL_COORDINATES', f"{resultSet.get('latitude')}, {resultSet.get('longitude')}", self.__name__, event)
                    self.notifyListeners(evt)
                    dataFound = True
                if resultSet.get('open_ports'):
                    for port in resultSet.get('open_ports'):