From 103b1160464379a2415a919b90662bc5a9edfb8e Mon Sep 17 00:00:00 2001 From: vkumbha Date: Thu, 7 Dec 2023 18:28:27 +0530 Subject: [PATCH] Add cred support for ip profiler --- ip_profiler/README.md | 1793 ++++++++++++++++----------- ip_profiler/flowpipe.fpvars.example | 2 - ip_profiler/ip_profiler.fp | 36 +- ip_profiler/mod.fp | 12 +- ip_profiler/variables.fp | 9 - 5 files changed, 1095 insertions(+), 757 deletions(-) delete mode 100644 ip_profiler/flowpipe.fpvars.example delete mode 100644 ip_profiler/variables.fp diff --git a/ip_profiler/README.md b/ip_profiler/README.md index f133e23..3c00970 100644 --- a/ip_profiler/README.md +++ b/ip_profiler/README.md @@ -1,736 +1,1097 @@ # IP Profiler -A composite Flowpipe mod that aggregates data from AbuseIPDB, ReallyFreeGeoIP and VirusTotal, offering in-depth and actionable intelligence on IP addresses." +Flowpipe sample mod that aggregates data from AbuseIPDB, ReallyFreeGeoIP and VirusTotal, offering in-depth and actionable intelligence on IP addresses. ## Usage -- Add your AbuseIPDB and VirusTotal API keys to `flowpipe.pvars` +- Add your AbuseIPDB and VirusTotal API keys to `credential` resource in any `.fpc` file in the config directory (~/.flowpipe/config/\*.fpc). - Run the pipeline and specify the IP addresses you want to scan. -- Example: `flowpipe pipeline run ip_profiler --pipeline-arg ip_addresses='["2600:1f18:61c9:6100:42a3:2e94:e60d:1ad1", "76.76.21.21"]'` +- Example: `flowpipe pipeline run ip_profiler --arg ip_addresses='["2600:1f18:61c9:6100:42a3:2e94:e60d:1ad1", "76.76.21.21"]'` ```json { - "flowpipe": { - "execution_id": "exec_cl46skocj6rgqucfmlng", - "pipeline_execution_id": "pexec_cl46skocj6rgqucfmlo0", - "status": "finished" + "2600:1f18:61c9:6100:42a3:2e94:e60d:1ad1": { + "abuseipdb_ip_abuse_reports": [], + "abuseipdb_ip_report": { + "abuseConfidenceScore": 0, + "countryCode": "US", + "domain": "amazon.com", + "hostnames": [], + "ipAddress": "2600:1f18:61c9:6100:42a3:2e94:e60d:1ad1", + "ipVersion": 6, + "isPublic": true, + "isTor": false, + "isWhitelisted": null, + "isp": "Amazon.com Inc.", + "lastReportedAt": null, + "numDistinctUsers": 0, + "totalReports": 0, + "usageType": "Data Center/Web Hosting/Transit" + }, + "reallyfreegeoip_ip_geolocation": { + "city": "Ashburn", + "country_code": "US", + "country_name": "United States", + "ip": "2600:1f18:61c9:6100:42a3:2e94:e60d:1ad1", + "latitude": 39.0481, + "longitude": -77.4729, + "metro_code": 511, + "region_code": "VA", + "region_name": "Virginia", + "time_zone": "America/New_York", + "zip_code": "20149" + }, + "virustotal_ip_scan": "Must be a valid IPv4 for VirusTotal scan." }, - "ip_profile": { - "2600:1f18:61c9:6100:42a3:2e94:e60d:1ad1": { - "abuseipdb_abuse_reports": null, - "abuseipdb_ip_info": { - "abuseConfidenceScore": 0, - "countryCode": "US", - "domain": "amazon.com", - "hostnames": null, - "ipAddress": "2600:1f18:61c9:6100:42a3:2e94:e60d:1ad1", - "ipVersion": 6, - "isPublic": true, - "isTor": false, - "isWhitelisted": null, - "isp": "Amazon.com Inc.", - "lastReportedAt": null, - "numDistinctUsers": 0, - "totalReports": 0, - "usageType": "Data Center/Web Hosting/Transit" - }, - "reallyfreegeoip_ip_location": { - "city": "Ashburn", - "country_code": "US", - "country_name": "United States", - "ip": "2600:1f18:61c9:6100:42a3:2e94:e60d:1ad1", - "latitude": 39.0481, - "longitude": -77.4729, - "metro_code": 511, - "region_code": "VA", - "region_name": "Virginia", - "time_zone": "America/New_York", - "zip_code": "20149" - }, - "virustotal_ip_scan": "Must be a valid IPv4 for VirusTotal scan." + "76.76.21.21": { + "abuseipdb_ip_abuse_reports": [ + { + "categories": [17], + "comment": "check@mx-check.com is a banned address.", + "reportedAt": "2023-12-02T03:31:33+00:00", + "reporterCountryCode": "US", + "reporterCountryName": "United States of America", + "reporterId": 107700 + }, + { + "categories": [14], + "comment": "Splunk® : port scan detected:\nNov 11 08:16:15 localhost kernel: Firewall: *TCP_IN Blocked* IN=eth0 OUT= MAC=82:c6:52:d1:6e:53:fe:00:00:00:01:01:08:00 SRC=76.76.21.21 DST=104.248.11.191 LEN=40 TOS=0x00 PREC=0x00 TTL=113 ID=2375 PROTO=TCP SPT=55237 DPT=3994 WINDOW=1 RES=0x00 SYN URGP=0", + "reportedAt": "2023-11-11T13:30:49+00:00", + "reporterCountryCode": "US", + "reporterCountryName": "United States of America", + "reporterId": 119100 + }, + { + "categories": [14], + "comment": "Splunk® : port scan detected:\nNov 11 08:16:10 localhost kernel: Firewall: *TCP_IN Blocked* IN=eth0 OUT= MAC=82:c6:52:d1:6e:53:fe:00:00:00:01:01:08:00 SRC=76.76.21.21 DST=104.248.11.191 LEN=40 TOS=0x00 PREC=0x00 TTL=86 ID=43574 PROTO=TCP SPT=55548 DPT=176 WINDOW=1360 RES=0x00 SYN URGP=0", + "reportedAt": "2023-11-11T13:30:49+00:00", + "reporterCountryCode": "US", + "reporterCountryName": "United States of America", + "reporterId": 119100 + }, + { + "categories": [14], + "comment": "Splunk® : port scan detected:\nNov 11 08:16:22 localhost kernel: Firewall: *TCP_IN Blocked* IN=eth0 OUT= MAC=82:c6:52:d1:6e:53:fe:00:00:00:01:01:08:00 SRC=76.76.21.21 DST=104.248.11.191 LEN=40 TOS=0x00 PREC=0x00 TTL=7 ID=6792 PROTO=TCP SPT=16462 DPT=5353 WINDOW=29200 RES=0x00 SYN URGP=0", + "reportedAt": "2023-11-11T13:30:48+00:00", + "reporterCountryCode": "US", + "reporterCountryName": "United States of America", + "reporterId": 119100 + }, + { + "categories": [14], + "comment": "Splunk® : port scan detected:\nNov 11 08:16:20 localhost kernel: Firewall: *TCP_IN Blocked* IN=eth0 OUT= MAC=82:c6:52:d1:6e:53:fe:00:00:00:01:01:08:00 SRC=76.76.21.21 DST=104.248.11.191 LEN=40 TOS=0x00 PREC=0x00 TTL=29 ID=10839 PROTO=TCP SPT=12025 DPT=5353 WINDOW=64240 RES=0x00 SYN URGP=0", + "reportedAt": "2023-11-11T13:30:48+00:00", + "reporterCountryCode": "US", + "reporterCountryName": "United States of America", + "reporterId": 119100 + }, + { + "categories": [14], + "comment": "Splunk® : port scan detected:\nNov 11 08:16:24 localhost kernel: Firewall: *TCP_IN Blocked* IN=eth0 OUT= MAC=82:c6:52:d1:6e:53:fe:00:00:00:01:01:08:00 SRC=76.76.21.21 DST=104.248.11.191 LEN=40 TOS=0x00 PREC=0x00 TTL=41 ID=10893 PROTO=TCP SPT=36282 DPT=8080 WINDOW=1460 RES=0x00 SYN URGP=0", + "reportedAt": "2023-11-11T13:30:47+00:00", + "reporterCountryCode": "US", + "reporterCountryName": "United States of America", + "reporterId": 119100 + }, + { + "categories": [14], + "comment": "Splunk® : port scan detected:\nNov 11 08:16:28 localhost kernel: Firewall: *TCP_IN Blocked* IN=eth0 OUT= MAC=82:c6:52:d1:6e:53:fe:00:00:00:01:01:08:00 SRC=76.76.21.21 DST=104.248.11.191 LEN=40 TOS=0x00 PREC=0x00 TTL=91 ID=4654 PROTO=TCP SPT=65454 DPT=8080 WINDOW=1460 RES=0x00 SYN URGP=0", + "reportedAt": "2023-11-11T13:30:46+00:00", + "reporterCountryCode": "US", + "reporterCountryName": "United States of America", + "reporterId": 119100 + }, + { + "categories": [14], + "comment": "Splunk® : port scan detected:\nNov 11 08:16:33 localhost kernel: Firewall: *TCP_IN Blocked* IN=eth0 OUT= MAC=82:c6:52:d1:6e:53:fe:00:00:00:01:01:08:00 SRC=76.76.21.21 DST=104.248.11.191 LEN=40 TOS=0x00 PREC=0x00 TTL=70 ID=51 PROTO=TCP SPT=40771 DPT=434 WINDOW=0 RES=0x00 SYN URGP=0", + "reportedAt": "2023-11-11T13:30:45+00:00", + "reporterCountryCode": "US", + "reporterCountryName": "United States of America", + "reporterId": 119100 + }, + { + "categories": [14], + "comment": "Splunk® : port scan detected:\nNov 11 08:16:30 localhost kernel: Firewall: *TCP_IN Blocked* IN=eth0 OUT= MAC=82:c6:52:d1:6e:53:fe:00:00:00:01:01:08:00 SRC=76.76.21.21 DST=104.248.11.191 LEN=40 TOS=0x00 PREC=0x00 TTL=49 ID=48391 PROTO=TCP SPT=18076 DPT=3478 WINDOW=64240 RES=0x00 SYN URGP=0", + "reportedAt": "2023-11-11T13:30:45+00:00", + "reporterCountryCode": "US", + "reporterCountryName": "United States of America", + "reporterId": 119100 + }, + { + "categories": [14], + "comment": "Splunk® : port scan detected:\nNov 11 08:16:35 localhost kernel: Firewall: *TCP_IN Blocked* IN=eth0 OUT= MAC=82:c6:52:d1:6e:53:fe:00:00:00:01:01:08:00 SRC=76.76.21.21 DST=104.248.11.191 LEN=40 TOS=0x00 PREC=0x00 TTL=29 ID=22732 PROTO=TCP SPT=36774 DPT=3074 WINDOW=1460 RES=0x00 SYN URGP=0", + "reportedAt": "2023-11-11T13:30:44+00:00", + "reporterCountryCode": "US", + "reporterCountryName": "United States of America", + "reporterId": 119100 + }, + { + "categories": [14], + "comment": "Splunk® : port scan detected:\nNov 11 08:16:43 localhost kernel: Firewall: *TCP_IN Blocked* IN=eth0 OUT= MAC=82:c6:52:d1:6e:53:fe:00:00:00:01:01:08:00 SRC=76.76.21.21 DST=104.248.11.191 LEN=40 TOS=0x00 PREC=0x00 TTL=91 ID=37726 PROTO=TCP SPT=31862 DPT=3478 WINDOW=1 RES=0x00 SYN URGP=0", + "reportedAt": "2023-11-11T13:30:36+00:00", + "reporterCountryCode": "US", + "reporterCountryName": "United States of America", + "reporterId": 119100 + }, + { + "categories": [14], + "comment": "Splunk® : port scan detected:\nNov 11 08:16:40 localhost kernel: Firewall: *TCP_IN Blocked* IN=eth0 OUT= MAC=82:c6:52:d1:6e:53:fe:00:00:00:01:01:08:00 SRC=76.76.21.21 DST=104.248.11.191 LEN=40 TOS=0x00 PREC=0x00 TTL=39 ID=20386 PROTO=TCP SPT=19492 DPT=8080 WINDOW=1460 RES=0x00 SYN URGP=0", + "reportedAt": "2023-11-11T13:30:36+00:00", + "reporterCountryCode": "US", + "reporterCountryName": "United States of America", + "reporterId": 119100 + }, + { + "categories": [14], + "comment": "Splunk® : port scan detected:\nNov 11 08:16:38 localhost kernel: Firewall: *TCP_IN Blocked* IN=eth0 OUT= MAC=82:c6:52:d1:6e:53:fe:00:00:00:01:01:08:00 SRC=76.76.21.21 DST=104.248.11.191 LEN=40 TOS=0x00 PREC=0x00 TTL=93 ID=1024 PROTO=TCP SPT=28440 DPT=5353 WINDOW=1 RES=0x00 SYN URGP=0", + "reportedAt": "2023-11-11T13:30:36+00:00", + "reporterCountryCode": "US", + "reporterCountryName": "United States of America", + "reporterId": 119100 + }, + { + "categories": [14], + "comment": "Splunk® : port scan detected:\nNov 11 08:16:45 localhost kernel: Firewall: *TCP_IN Blocked* IN=eth0 OUT= MAC=82:c6:52:d1:6e:53:fe:00:00:00:01:01:08:00 SRC=76.76.21.21 DST=104.248.11.191 LEN=40 TOS=0x00 PREC=0x00 TTL=52 ID=3051 PROTO=TCP SPT=34022 DPT=434 WINDOW=29200 RES=0x00 SYN URGP=0", + "reportedAt": "2023-11-11T13:30:35+00:00", + "reporterCountryCode": "US", + "reporterCountryName": "United States of America", + "reporterId": 119100 + }, + { + "categories": [14], + "comment": "Splunk® : port scan detected:\nNov 11 08:16:47 localhost kernel: Firewall: *TCP_IN Blocked* IN=eth0 OUT= MAC=82:c6:52:d1:6e:53:fe:00:00:00:01:01:08:00 SRC=76.76.21.21 DST=104.248.11.191 LEN=40 TOS=0x00 PREC=0x00 TTL=47 ID=59381 PROTO=TCP SPT=53430 DPT=102 WINDOW=0 RES=0x00 SYN URGP=0", + "reportedAt": "2023-11-11T13:30:34+00:00", + "reporterCountryCode": "US", + "reporterCountryName": "United States of America", + "reporterId": 119100 + }, + { + "categories": [14], + "comment": "Splunk® : port scan detected:\nNov 11 08:22:45 localhost kernel: Firewall: *TCP_IN Blocked* IN=eth0 OUT= MAC=82:c6:52:d1:6e:53:fe:00:00:00:01:01:08:00 SRC=76.76.21.21 DST=104.248.11.191 LEN=40 TOS=0x00 PREC=0x00 TTL=79 ID=5683 PROTO=TCP SPT=1248 DPT=3478 WINDOW=0 RES=0x00 SYN URGP=0", + "reportedAt": "2023-11-11T13:29:36+00:00", + "reporterCountryCode": "US", + "reporterCountryName": "United States of America", + "reporterId": 119100 + }, + { + "categories": [14], + "comment": "Splunk® : port scan detected:\nNov 11 08:22:52 localhost kernel: Firewall: *TCP_IN Blocked* IN=eth0 OUT= MAC=82:c6:52:d1:6e:53:fe:00:00:00:01:01:08:00 SRC=76.76.21.21 DST=104.248.11.191 LEN=40 TOS=0x00 PREC=0x00 TTL=29 ID=36796 PROTO=TCP SPT=53860 DPT=5353 WINDOW=29200 RES=0x00 SYN URGP=0", + "reportedAt": "2023-11-11T13:29:35+00:00", + "reporterCountryCode": "US", + "reporterCountryName": "United States of America", + "reporterId": 119100 + }, + { + "categories": [14], + "comment": "Splunk® : port scan detected:\nNov 11 08:22:49 localhost kernel: Firewall: *TCP_IN Blocked* IN=eth0 OUT= MAC=82:c6:52:d1:6e:53:fe:00:00:00:01:01:08:00 SRC=76.76.21.21 DST=104.248.11.191 LEN=40 TOS=0x00 PREC=0x00 TTL=85 ID=28258 PROTO=TCP SPT=15678 DPT=8080 WINDOW=1024 RES=0x00 SYN URGP=0", + "reportedAt": "2023-11-11T13:29:35+00:00", + "reporterCountryCode": "US", + "reporterCountryName": "United States of America", + "reporterId": 119100 + }, + { + "categories": [14], + "comment": "Splunk® : port scan detected:\nNov 11 08:22:54 localhost kernel: Firewall: *TCP_IN Blocked* IN=eth0 OUT= MAC=82:c6:52:d1:6e:53:fe:00:00:00:01:01:08:00 SRC=76.76.21.21 DST=104.248.11.191 LEN=40 TOS=0x00 PREC=0x00 TTL=21 ID=10543 PROTO=TCP SPT=40144 DPT=3478 WINDOW=1360 RES=0x00 SYN URGP=0", + "reportedAt": "2023-11-11T13:29:34+00:00", + "reporterCountryCode": "US", + "reporterCountryName": "United States of America", + "reporterId": 119100 + }, + { + "categories": [14], + "comment": "Splunk® : port scan detected:\nNov 11 08:22:58 localhost kernel: Firewall: *TCP_IN Blocked* IN=eth0 OUT= MAC=82:c6:52:d1:6e:53:fe:00:00:00:01:01:08:00 SRC=76.76.21.21 DST=104.248.11.191 LEN=40 TOS=0x00 PREC=0x00 TTL=70 ID=8138 PROTO=TCP SPT=53331 DPT=434 WINDOW=29200 RES=0x00 SYN URGP=0", + "reportedAt": "2023-11-11T13:29:33+00:00", + "reporterCountryCode": "US", + "reporterCountryName": "United States of America", + "reporterId": 119100 + }, + { + "categories": [14], + "comment": "Splunk® : port scan detected:\nNov 11 08:22:56 localhost kernel: Firewall: *TCP_IN Blocked* IN=eth0 OUT= MAC=82:c6:52:d1:6e:53:fe:00:00:00:01:01:08:00 SRC=76.76.21.21 DST=104.248.11.191 LEN=40 TOS=0x00 PREC=0x00 TTL=43 ID=23077 PROTO=TCP SPT=59589 DPT=5353 WINDOW=29200 RES=0x00 SYN URGP=0", + "reportedAt": "2023-11-11T13:29:33+00:00", + "reporterCountryCode": "US", + "reporterCountryName": "United States of America", + "reporterId": 119100 + }, + { + "categories": [14], + "comment": "Splunk® : port scan detected:\nNov 11 08:23:01 localhost kernel: Firewall: *TCP_IN Blocked* IN=eth0 OUT= MAC=82:c6:52:d1:6e:53:fe:00:00:00:01:01:08:00 SRC=76.76.21.21 DST=104.248.11.191 LEN=40 TOS=0x00 PREC=0x00 TTL=96 ID=6367 PROTO=TCP SPT=3200 DPT=4321 WINDOW=64240 RES=0x00 SYN URGP=0", + "reportedAt": "2023-11-11T13:29:32+00:00", + "reporterCountryCode": "US", + "reporterCountryName": "United States of America", + "reporterId": 119100 + }, + { + "categories": [14], + "comment": "Splunk® : port scan detected:\nNov 11 08:23:07 localhost kernel: Firewall: *TCP_IN Blocked* IN=eth0 OUT= MAC=82:c6:52:d1:6e:53:fe:00:00:00:01:01:08:00 SRC=76.76.21.21 DST=104.248.11.191 LEN=40 TOS=0x00 PREC=0x00 TTL=82 ID=62985 PROTO=TCP SPT=2364 DPT=8443 WINDOW=1360 RES=0x00 SYN URGP=0", + "reportedAt": "2023-11-11T13:29:31+00:00", + "reporterCountryCode": "US", + "reporterCountryName": "United States of America", + "reporterId": 119100 + }, + { + "categories": [14], + "comment": "Splunk® : port scan detected:\nNov 11 08:23:05 localhost kernel: Firewall: *TCP_IN Blocked* IN=eth0 OUT= MAC=82:c6:52:d1:6e:53:fe:00:00:00:01:01:08:00 SRC=76.76.21.21 DST=104.248.11.191 LEN=40 TOS=0x00 PREC=0x00 TTL=89 ID=46201 PROTO=TCP SPT=60868 DPT=8443 WINDOW=65535 RES=0x00 SYN URGP=0", + "reportedAt": "2023-11-11T13:29:31+00:00", + "reporterCountryCode": "US", + "reporterCountryName": "United States of America", + "reporterId": 119100 + }, + { + "categories": [14], + "comment": "Splunk® : port scan detected:\nNov 11 08:23:03 localhost kernel: Firewall: *TCP_IN Blocked* IN=eth0 OUT= MAC=82:c6:52:d1:6e:53:fe:00:00:00:01:01:08:00 SRC=76.76.21.21 DST=104.248.11.191 LEN=40 TOS=0x00 PREC=0x00 TTL=34 ID=11520 PROTO=TCP SPT=43244 DPT=2048 WINDOW=29200 RES=0x00 SYN URGP=0", + "reportedAt": "2023-11-11T13:29:31+00:00", + "reporterCountryCode": "US", + "reporterCountryName": "United States of America", + "reporterId": 119100 + }, + { + "categories": [14], + "comment": "Splunk® : port scan detected:\nNov 11 08:23:11 localhost kernel: Firewall: *TCP_IN Blocked* IN=eth0 OUT= MAC=82:c6:52:d1:6e:53:fe:00:00:00:01:01:08:00 SRC=76.76.21.21 DST=104.248.11.191 LEN=40 TOS=0x00 PREC=0x00 TTL=88 ID=36460 PROTO=TCP SPT=59555 DPT=434 WINDOW=1360 RES=0x00 SYN URGP=0", + "reportedAt": "2023-11-11T13:29:30+00:00", + "reporterCountryCode": "US", + "reporterCountryName": "United States of America", + "reporterId": 119100 + }, + { + "categories": [14], + "comment": "Splunk® : port scan detected:\nNov 11 08:23:09 localhost kernel: Firewall: *TCP_IN Blocked* IN=eth0 OUT= MAC=82:c6:52:d1:6e:53:fe:00:00:00:01:01:08:00 SRC=76.76.21.21 DST=104.248.11.191 LEN=40 TOS=0x00 PREC=0x00 TTL=93 ID=31701 PROTO=TCP SPT=14556 DPT=8443 WINDOW=0 RES=0x00 SYN URGP=0", + "reportedAt": "2023-11-11T13:29:30+00:00", + "reporterCountryCode": "US", + "reporterCountryName": "United States of America", + "reporterId": 119100 + }, + { + "categories": [14], + "comment": "Splunk® : port scan detected:\nNov 11 08:23:13 localhost kernel: Firewall: *TCP_IN Blocked* IN=eth0 OUT= MAC=82:c6:52:d1:6e:53:fe:00:00:00:01:01:08:00 SRC=76.76.21.21 DST=104.248.11.191 LEN=40 TOS=0x00 PREC=0x00 TTL=62 ID=39852 PROTO=TCP SPT=12842 DPT=3074 WINDOW=65535 RES=0x00 SYN URGP=0", + "reportedAt": "2023-11-11T13:29:29+00:00", + "reporterCountryCode": "US", + "reporterCountryName": "United States of America", + "reporterId": 119100 + }, + { + "categories": [14], + "comment": "Splunk® : port scan detected:\nNov 11 08:23:20 localhost kernel: Firewall: *TCP_IN Blocked* IN=eth0 OUT= MAC=82:c6:52:d1:6e:53:fe:00:00:00:01:01:08:00 SRC=76.76.21.21 DST=104.248.11.191 LEN=40 TOS=0x00 PREC=0x00 TTL=15 ID=8004 PROTO=TCP SPT=53514 DPT=3074 WINDOW=0 RES=0x00 SYN URGP=0", + "reportedAt": "2023-11-11T13:29:23+00:00", + "reporterCountryCode": "US", + "reporterCountryName": "United States of America", + "reporterId": 119100 + }, + { + "categories": [14], + "comment": "Splunk® : port scan detected:\nNov 11 08:23:15 localhost kernel: Firewall: *TCP_IN Blocked* IN=eth0 OUT= MAC=82:c6:52:d1:6e:53:fe:00:00:00:01:01:08:00 SRC=76.76.21.21 DST=104.248.11.191 LEN=40 TOS=0x00 PREC=0x00 TTL=19 ID=10362 PROTO=TCP SPT=25672 DPT=4321 WINDOW=1460 RES=0x00 SYN URGP=0", + "reportedAt": "2023-11-11T13:29:23+00:00", + "reporterCountryCode": "US", + "reporterCountryName": "United States of America", + "reporterId": 119100 + }, + { + "categories": [14], + "comment": "Splunk® : port scan detected:\nNov 11 08:23:22 localhost kernel: Firewall: *TCP_IN Blocked* IN=eth0 OUT= MAC=82:c6:52:d1:6e:53:fe:00:00:00:01:01:08:00 SRC=76.76.21.21 DST=104.248.11.191 LEN=40 TOS=0x00 PREC=0x00 TTL=93 ID=11097 PROTO=TCP SPT=17300 DPT=4321 WINDOW=1024 RES=0x00 SYN URGP=0", + "reportedAt": "2023-11-11T13:29:22+00:00", + "reporterCountryCode": "US", + "reporterCountryName": "United States of America", + "reporterId": 119100 + }, + { + "categories": [14], + "comment": "Splunk® : port scan detected:\nNov 11 08:25:37 localhost kernel: Firewall: *TCP_IN Blocked* IN=eth0 OUT= MAC=82:c6:52:d1:6e:53:fe:00:00:00:01:01:08:00 SRC=76.76.21.21 DST=104.248.11.191 LEN=40 TOS=0x00 PREC=0x00 TTL=34 ID=30451 PROTO=TCP SPT=42471 DPT=8443 WINDOW=1460 RES=0x00 SYN URGP=0", + "reportedAt": "2023-11-11T13:28:56+00:00", + "reporterCountryCode": "US", + "reporterCountryName": "United States of America", + "reporterId": 119100 + }, + { + "categories": [14], + "comment": "Splunk® : port scan detected:\nNov 11 08:25:42 localhost kernel: Firewall: *TCP_IN Blocked* IN=eth0 OUT= MAC=82:c6:52:d1:6e:53:fe:00:00:00:01:01:08:00 SRC=76.76.21.21 DST=104.248.11.191 LEN=40 TOS=0x00 PREC=0x00 TTL=116 ID=50617 PROTO=TCP SPT=47169 DPT=8080 WINDOW=1024 RES=0x00 SYN URGP=0", + "reportedAt": "2023-11-11T13:28:55+00:00", + "reporterCountryCode": "US", + "reporterCountryName": "United States of America", + "reporterId": 119100 + }, + { + "categories": [14], + "comment": "Splunk® : port scan detected:\nNov 11 08:25:51 localhost kernel: Firewall: *TCP_IN Blocked* IN=eth0 OUT= MAC=82:c6:52:d1:6e:53:fe:00:00:00:01:01:08:00 SRC=76.76.21.21 DST=104.248.11.191 LEN=40 TOS=0x00 PREC=0x00 TTL=26 ID=23515 PROTO=TCP SPT=65220 DPT=5353 WINDOW=1 RES=0x00 SYN URGP=0", + "reportedAt": "2023-11-11T13:28:54+00:00", + "reporterCountryCode": "US", + "reporterCountryName": "United States of America", + "reporterId": 119100 + }, + { + "categories": [14], + "comment": "Splunk® : port scan detected:\nNov 11 08:25:58 localhost kernel: Firewall: *TCP_IN Blocked* IN=eth0 OUT= MAC=82:c6:52:d1:6e:53:fe:00:00:00:01:01:08:00 SRC=76.76.21.21 DST=104.248.11.191 LEN=40 TOS=0x00 PREC=0x00 TTL=104 ID=61725 PROTO=TCP SPT=49336 DPT=8443 WINDOW=1024 RES=0x00 SYN URGP=0", + "reportedAt": "2023-11-11T13:28:42+00:00", + "reporterCountryCode": "US", + "reporterCountryName": "United States of America", + "reporterId": 119100 + }, + { + "categories": [14], + "comment": "Splunk® : port scan detected:\nNov 11 08:26:13 localhost kernel: Firewall: *TCP_IN Blocked* IN=eth0 OUT= MAC=82:c6:52:d1:6e:53:fe:00:00:00:01:01:08:00 SRC=76.76.21.21 DST=104.248.11.191 LEN=40 TOS=0x00 PREC=0x00 TTL=21 ID=10550 PROTO=TCP SPT=8299 DPT=8443 WINDOW=1360 RES=0x00 SYN URGP=0", + "reportedAt": "2023-11-11T13:28:36+00:00", + "reporterCountryCode": "US", + "reporterCountryName": "United States of America", + "reporterId": 119100 + }, + { + "categories": [14], + "comment": "Splunk® : port scan detected:\nNov 11 08:26:09 localhost kernel: Firewall: *TCP_IN Blocked* IN=eth0 OUT= MAC=82:c6:52:d1:6e:53:fe:00:00:00:01:01:08:00 SRC=76.76.21.21 DST=104.248.11.191 LEN=40 TOS=0x00 PREC=0x00 TTL=30 ID=35191 PROTO=TCP SPT=4681 DPT=434 WINDOW=29200 RES=0x00 SYN URGP=0", + "reportedAt": "2023-11-11T13:28:36+00:00", + "reporterCountryCode": "US", + "reporterCountryName": "United States of America", + "reporterId": 119100 + }, + { + "categories": [14], + "comment": "Splunk® : port scan detected:\nNov 11 08:26:15 localhost kernel: Firewall: *TCP_IN Blocked* IN=eth0 OUT= MAC=82:c6:52:d1:6e:53:fe:00:00:00:01:01:08:00 SRC=76.76.21.21 DST=104.248.11.191 LEN=40 TOS=0x00 PREC=0x00 TTL=32 ID=1259 PROTO=TCP SPT=59352 DPT=4321 WINDOW=1460 RES=0x00 SYN URGP=0", + "reportedAt": "2023-11-11T13:28:35+00:00", + "reporterCountryCode": "US", + "reporterCountryName": "United States of America", + "reporterId": 119100 + }, + { + "categories": [14, 18], + "comment": "[H1.VM2] Blocked by UFW", + "reportedAt": "2023-11-11T13:25:53+00:00", + "reporterCountryCode": "DE", + "reporterCountryName": "Germany", + "reporterId": 25836 + }, + { + "categories": [14, 18], + "comment": "[mail-backup-2] Blocked by UFW", + "reportedAt": "2023-11-11T13:23:23+00:00", + "reporterCountryCode": "DE", + "reporterCountryName": "Germany", + "reporterId": 25833 + }, + { + "categories": [14], + "comment": "*Port Scan* detected from 76.76.21.21 (US/United States/California/Walnut/-/[redacted]).", + "reportedAt": "2023-11-11T13:23:17+00:00", + "reporterCountryCode": "DE", + "reporterCountryName": "Germany", + "reporterId": 81851 + }, + { + "categories": [14], + "comment": "*Port Scan* detected from 76.76.21.21 (US/United States/-).", + "reportedAt": "2023-11-11T13:23:02+00:00", + "reporterCountryCode": "DE", + "reporterCountryName": "Germany", + "reporterId": 22685 + }, + { + "categories": [14], + "comment": "Nov 11 14:16:15 ns3006402 kernel: [560230.873881] [UFW BLOCK] IN=eno1 OUT= MAC=f0:79:59:6e:bf:2b:00:ff:ff:ff:ff:fb:08:00 SRC=76.76.21.21 DST=151.80.47.9 LEN=40 TOS=0x00 PREC=0x00 TTL=28 ID=37982 PROTO=TCP SPT=1059 DPT=3478 WINDOW=1 RES=0x00 SYN URGP=0 \nNov 11 14:16:23 ns3006402 kernel: [560239.634550] [UFW BLOCK] IN=eno1 OUT= MAC=f0:79:59:6e:bf:2b:00:ff:ff:ff:ff:fb:08:00 SRC=76.76.21.21 DST=151.80.47.9 LEN=40 TOS=0x00 PREC=0x00 TTL=10 ID=4277 PROTO=TCP SPT=27581 DPT=3478 WINDOW=1024 RES=0x00 SYN URGP=0 \nNov 11 14:16:33 ns3006402 kernel: [560248.771963] [UFW BLOCK] IN=eno1 OUT= MAC=f0:79:59:6e:bf:2b:00:ff:ff:ff:ff:fb:08:00 SRC=76.76.21.21 DST=151.80.47.9 LEN=40 TOS=0x00 PREC=0x00 TTL=32 ID=23017 PROTO=TCP SPT=25567 DPT=8443 WINDOW=1 RES=0x00 SYN URGP=0 \nNov 11 14:16:38 ns3006402 kernel: [560253.750580] [UFW BLOCK] IN=eno1 OUT= MAC=f0:79:59:6e:bf:2b:00:ff:ff:ff:ff:fb:08:00 SRC=76.76.21.21 DST=151.80.47.9 LEN=40 TOS=0x00 PREC=0x00 TTL=56 ID=56423 PROTO=TCP SPT=48569 DPT=5353 WINDOW=1 RES=\n...", + "reportedAt": "2023-11-11T13:22:53+00:00", + "reporterCountryCode": "FR", + "reporterCountryName": "France", + "reporterId": 18017 + }, + { + "categories": [14, 18], + "comment": "[MK-VM1] Blocked by UFW", + "reportedAt": "2023-11-11T13:22:50+00:00", + "reporterCountryCode": "DE", + "reporterCountryName": "Germany", + "reporterId": 25833 + }, + { + "categories": [14, 18], + "comment": "[MK-VM2] Blocked by UFW", + "reportedAt": "2023-11-11T13:22:49+00:00", + "reporterCountryCode": "DE", + "reporterCountryName": "Germany", + "reporterId": 25833 + }, + { + "categories": [14, 18], + "comment": "[mail-backup-1] Blocked by UFW", + "reportedAt": "2023-11-11T13:16:48+00:00", + "reporterCountryCode": "DE", + "reporterCountryName": "Germany", + "reporterId": 25833 + }, + { + "categories": [14], + "comment": "*Port Scan* detected from 76.76.21.21 (US/United States/-).", + "reportedAt": "2023-11-11T13:16:42+00:00", + "reporterCountryCode": "DE", + "reporterCountryName": "Germany", + "reporterId": 103216 + }, + { + "categories": [14], + "comment": "*Port Scan* detected from 76.76.21.21 (US/United States/-). 11 hits in the last 235 seconds; Ports: *; Direction: in; Trigger: PS_LIMIT; Logs: Nov 11 14:16:09 kernel: Firewall: *TCP_IN Blocked* IN=enp0s31f6 OUT= MAC=xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx00 SRC=76.76.21.21 DST=0.X.X.X LE", + "reportedAt": "2023-11-11T13:16:33+00:00", + "reporterCountryCode": "DE", + "reporterCountryName": "Germany", + "reporterId": 108586 + }, + { + "categories": [14], + "comment": "*Port Scan* detected from 76.76.21.21 (Unknown). ; Ports: *; Direction: in; Trigger: PS_LIMIT; Logs: Nov 11 13:16:10 kernel: Firewa", + "reportedAt": "2023-11-11T13:16:30+00:00", + "reporterCountryCode": "DE", + "reporterCountryName": "Germany", + "reporterId": 82316 + }, + { + "categories": [14], + "comment": "*Port Scan* detected from 76.76.21.21 (US/United States/-).", + "reportedAt": "2023-11-11T13:16:29+00:00", + "reporterCountryCode": "FR", + "reporterCountryName": "France", + "reporterId": 74467 + }, + { + "categories": [14], + "comment": "Fail2Ban - UFW port probing on unauthorized port", + "reportedAt": "2023-11-11T13:16:23+00:00", + "reporterCountryCode": "DE", + "reporterCountryName": "Germany", + "reporterId": 50466 + } + ], + "abuseipdb_ip_report": { + "abuseConfidenceScore": 46, + "countryCode": "US", + "domain": "vercel.com", + "hostnames": [], + "ipAddress": "76.76.21.21", + "ipVersion": 4, + "isPublic": true, + "isTor": false, + "isWhitelisted": false, + "isp": "Vercel Inc", + "lastReportedAt": "2023-12-02T03:31:33+00:00", + "numDistinctUsers": 12, + "totalReports": 51, + "usageType": "Content Delivery Network" }, - "76.76.21.21": { - "abuseipdb_abuse_reports": [ - { - "categories": [15], - "comment": "(PERMBLOCK) 76.76.21.21 (US/United States/-) has had more than 4 temp blocks", - "reportedAt": "2023-10-21T05:10:34+00:00", - "reporterCountryCode": "LT", - "reporterCountryName": "Lithuania", - "reporterId": 84727 - }, - { - "categories": [4], - "comment": "(CT) IP 76.76.21.21 (US/United States/-) found to have 568 connections", - "reportedAt": "2023-10-21T04:40:28+00:00", - "reporterCountryCode": "LT", - "reporterCountryName": "Lithuania", - "reporterId": 84727 - }, - { - "categories": [4], - "comment": "(CT) IP 76.76.21.21 (US/United States/-) found to have 610 connections", - "reportedAt": "2023-10-21T04:10:17+00:00", - "reporterCountryCode": "LT", - "reporterCountryName": "Lithuania", - "reporterId": 84727 + "reallyfreegeoip_ip_geolocation": { + "city": "", + "country_code": "US", + "country_name": "United States", + "ip": "76.76.21.21", + "latitude": 37.751, + "longitude": -97.822, + "metro_code": 0, + "region_code": "", + "region_name": "", + "time_zone": "America/Chicago", + "zip_code": "" + }, + "virustotal_ip_scan": { + "attributes": { + "as_owner": "AMAZON-02", + "asn": 16509, + "continent": "NA", + "country": "US", + "last_analysis_date": 1701943668, + "last_analysis_results": { + "0xSI_f33d": { + "category": "undetected", + "engine_name": "0xSI_f33d", + "method": "blacklist", + "result": "unrated" + }, + "ADMINUSLabs": { + "category": "harmless", + "engine_name": "ADMINUSLabs", + "method": "blacklist", + "result": "clean" + }, + "AILabs (MONITORAPP)": { + "category": "harmless", + "engine_name": "AILabs (MONITORAPP)", + "method": "blacklist", + "result": "clean" + }, + "Abusix": { + "category": "harmless", + "engine_name": "Abusix", + "method": "blacklist", + "result": "clean" + }, + "Acronis": { + "category": "harmless", + "engine_name": "Acronis", + "method": "blacklist", + "result": "clean" + }, + "AlienVault": { + "category": "harmless", + "engine_name": "AlienVault", + "method": "blacklist", + "result": "clean" + }, + "AlphaSOC": { + "category": "undetected", + "engine_name": "AlphaSOC", + "method": "blacklist", + "result": "unrated" + }, + "Antiy-AVL": { + "category": "harmless", + "engine_name": "Antiy-AVL", + "method": "blacklist", + "result": "clean" + }, + "ArcSight Threat Intelligence": { + "category": "undetected", + "engine_name": "ArcSight Threat Intelligence", + "method": "blacklist", + "result": "unrated" + }, + "AutoShun": { + "category": "undetected", + "engine_name": "AutoShun", + "method": "blacklist", + "result": "unrated" + }, + "Avira": { + "category": "harmless", + "engine_name": "Avira", + "method": "blacklist", + "result": "clean" + }, + "Bfore.Ai PreCrime": { + "category": "harmless", + "engine_name": "Bfore.Ai PreCrime", + "method": "blacklist", + "result": "clean" + }, + "BitDefender": { + "category": "harmless", + "engine_name": "BitDefender", + "method": "blacklist", + "result": "clean" + }, + "Bkav": { + "category": "undetected", + "engine_name": "Bkav", + "method": "blacklist", + "result": "unrated" + }, + "Blueliv": { + "category": "harmless", + "engine_name": "Blueliv", + "method": "blacklist", + "result": "clean" + }, + "CINS Army": { + "category": "harmless", + "engine_name": "CINS Army", + "method": "blacklist", + "result": "clean" + }, + "CMC Threat Intelligence": { + "category": "harmless", + "engine_name": "CMC Threat Intelligence", + "method": "blacklist", + "result": "clean" + }, + "CRDF": { + "category": "harmless", + "engine_name": "CRDF", + "method": "blacklist", + "result": "clean" + }, + "Certego": { + "category": "harmless", + "engine_name": "Certego", + "method": "blacklist", + "result": "clean" + }, + "Chong Lua Dao": { + "category": "harmless", + "engine_name": "Chong Lua Dao", + "method": "blacklist", + "result": "clean" + }, + "Cluster25": { + "category": "undetected", + "engine_name": "Cluster25", + "method": "blacklist", + "result": "unrated" + }, + "Criminal IP": { + "category": "malicious", + "engine_name": "Criminal IP", + "method": "blacklist", + "result": "malicious" + }, + "CrowdSec": { + "category": "undetected", + "engine_name": "CrowdSec", + "method": "blacklist", + "result": "unrated" + }, + "CyRadar": { + "category": "harmless", + "engine_name": "CyRadar", + "method": "blacklist", + "result": "clean" + }, + "Cyan": { + "category": "undetected", + "engine_name": "Cyan", + "method": "blacklist", + "result": "unrated" + }, + "Cyble": { + "category": "harmless", + "engine_name": "Cyble", + "method": "blacklist", + "result": "clean" + }, + "DNS8": { + "category": "harmless", + "engine_name": "DNS8", + "method": "blacklist", + "result": "clean" + }, + "Dr.Web": { + "category": "harmless", + "engine_name": "Dr.Web", + "method": "blacklist", + "result": "clean" + }, + "ESET": { + "category": "harmless", + "engine_name": "ESET", + "method": "blacklist", + "result": "clean" + }, + "ESTsecurity": { + "category": "harmless", + "engine_name": "ESTsecurity", + "method": "blacklist", + "result": "clean" + }, + "EmergingThreats": { + "category": "harmless", + "engine_name": "EmergingThreats", + "method": "blacklist", + "result": "clean" + }, + "Emsisoft": { + "category": "harmless", + "engine_name": "Emsisoft", + "method": "blacklist", + "result": "clean" + }, + "Ermes": { + "category": "undetected", + "engine_name": "Ermes", + "method": "blacklist", + "result": "unrated" + }, + "Forcepoint ThreatSeeker": { + "category": "harmless", + "engine_name": "Forcepoint ThreatSeeker", + "method": "blacklist", + "result": "clean" + }, + "Fortinet": { + "category": "harmless", + "engine_name": "Fortinet", + "method": "blacklist", + "result": "clean" + }, + "G-Data": { + "category": "harmless", + "engine_name": "G-Data", + "method": "blacklist", + "result": "clean" + }, + "Google Safebrowsing": { + "category": "harmless", + "engine_name": "Google Safebrowsing", + "method": "blacklist", + "result": "clean" + }, + "GreenSnow": { + "category": "harmless", + "engine_name": "GreenSnow", + "method": "blacklist", + "result": "clean" + }, + "Heimdal Security": { + "category": "harmless", + "engine_name": "Heimdal Security", + "method": "blacklist", + "result": "clean" + }, + "IPsum": { + "category": "harmless", + "engine_name": "IPsum", + "method": "blacklist", + "result": "clean" + }, + "Juniper Networks": { + "category": "harmless", + "engine_name": "Juniper Networks", + "method": "blacklist", + "result": "clean" + }, + "K7AntiVirus": { + "category": "harmless", + "engine_name": "K7AntiVirus", + "method": "blacklist", + "result": "clean" + }, + "Kaspersky": { + "category": "undetected", + "engine_name": "Kaspersky", + "method": "blacklist", + "result": "unrated" + }, + "Lionic": { + "category": "harmless", + "engine_name": "Lionic", + "method": "blacklist", + "result": "clean" + }, + "Lumu": { + "category": "undetected", + "engine_name": "Lumu", + "method": "blacklist", + "result": "unrated" + }, + "MalwarePatrol": { + "category": "harmless", + "engine_name": "MalwarePatrol", + "method": "blacklist", + "result": "clean" + }, + "Malwared": { + "category": "harmless", + "engine_name": "Malwared", + "method": "blacklist", + "result": "clean" + }, + "Netcraft": { + "category": "undetected", + "engine_name": "Netcraft", + "method": "blacklist", + "result": "unrated" + }, + "OpenPhish": { + "category": "harmless", + "engine_name": "OpenPhish", + "method": "blacklist", + "result": "clean" + }, + "PREBYTES": { + "category": "harmless", + "engine_name": "PREBYTES", + "method": "blacklist", + "result": "clean" + }, + "PhishFort": { + "category": "undetected", + "engine_name": "PhishFort", + "method": "blacklist", + "result": "unrated" + }, + "PhishLabs": { + "category": "undetected", + "engine_name": "PhishLabs", + "method": "blacklist", + "result": "unrated" + }, + "Phishing Database": { + "category": "harmless", + "engine_name": "Phishing Database", + "method": "blacklist", + "result": "clean" + }, + "Phishtank": { + "category": "harmless", + "engine_name": "Phishtank", + "method": "blacklist", + "result": "clean" + }, + "PrecisionSec": { + "category": "undetected", + "engine_name": "PrecisionSec", + "method": "blacklist", + "result": "unrated" + }, + "Quick Heal": { + "category": "harmless", + "engine_name": "Quick Heal", + "method": "blacklist", + "result": "clean" + }, + "Quttera": { + "category": "harmless", + "engine_name": "Quttera", + "method": "blacklist", + "result": "clean" + }, + "SCUMWARE.org": { + "category": "harmless", + "engine_name": "SCUMWARE.org", + "method": "blacklist", + "result": "clean" + }, + "SOCRadar": { + "category": "harmless", + "engine_name": "SOCRadar", + "method": "blacklist", + "result": "clean" + }, + "SafeToOpen": { + "category": "undetected", + "engine_name": "SafeToOpen", + "method": "blacklist", + "result": "unrated" + }, + "Scantitan": { + "category": "harmless", + "engine_name": "Scantitan", + "method": "blacklist", + "result": "clean" + }, + "Seclookup": { + "category": "harmless", + "engine_name": "Seclookup", + "method": "blacklist", + "result": "clean" + }, + "SecureBrain": { + "category": "harmless", + "engine_name": "SecureBrain", + "method": "blacklist", + "result": "clean" + }, + "Segasec": { + "category": "undetected", + "engine_name": "Segasec", + "method": "blacklist", + "result": "unrated" + }, + "Snort IP sample list": { + "category": "harmless", + "engine_name": "Snort IP sample list", + "method": "blacklist", + "result": "clean" + }, + "Sophos": { + "category": "harmless", + "engine_name": "Sophos", + "method": "blacklist", + "result": "clean" + }, + "Spam404": { + "category": "harmless", + "engine_name": "Spam404", + "method": "blacklist", + "result": "clean" + }, + "StopForumSpam": { + "category": "harmless", + "engine_name": "StopForumSpam", + "method": "blacklist", + "result": "clean" + }, + "Sucuri SiteCheck": { + "category": "harmless", + "engine_name": "Sucuri SiteCheck", + "method": "blacklist", + "result": "clean" + }, + "ThreatHive": { + "category": "harmless", + "engine_name": "ThreatHive", + "method": "blacklist", + "result": "clean" + }, + "Threatsourcing": { + "category": "harmless", + "engine_name": "Threatsourcing", + "method": "blacklist", + "result": "clean" + }, + "Trustwave": { + "category": "harmless", + "engine_name": "Trustwave", + "method": "blacklist", + "result": "clean" + }, + "URLQuery": { + "category": "undetected", + "engine_name": "URLQuery", + "method": "blacklist", + "result": "unrated" + }, + "URLhaus": { + "category": "harmless", + "engine_name": "URLhaus", + "method": "blacklist", + "result": "clean" + }, + "VIPRE": { + "category": "undetected", + "engine_name": "VIPRE", + "method": "blacklist", + "result": "unrated" + }, + "VX Vault": { + "category": "harmless", + "engine_name": "VX Vault", + "method": "blacklist", + "result": "clean" + }, + "Viettel Threat Intelligence": { + "category": "harmless", + "engine_name": "Viettel Threat Intelligence", + "method": "blacklist", + "result": "clean" + }, + "ViriBack": { + "category": "harmless", + "engine_name": "ViriBack", + "method": "blacklist", + "result": "clean" + }, + "Webroot": { + "category": "harmless", + "engine_name": "Webroot", + "method": "blacklist", + "result": "clean" + }, + "Xcitium Verdict Cloud": { + "category": "undetected", + "engine_name": "Xcitium Verdict Cloud", + "method": "blacklist", + "result": "unrated" + }, + "Yandex Safebrowsing": { + "category": "harmless", + "engine_name": "Yandex Safebrowsing", + "method": "blacklist", + "result": "clean" + }, + "ZeroCERT": { + "category": "harmless", + "engine_name": "ZeroCERT", + "method": "blacklist", + "result": "clean" + }, + "alphaMountain.ai": { + "category": "harmless", + "engine_name": "alphaMountain.ai", + "method": "blacklist", + "result": "clean" + }, + "benkow.cc": { + "category": "harmless", + "engine_name": "benkow.cc", + "method": "blacklist", + "result": "clean" + }, + "desenmascara.me": { + "category": "harmless", + "engine_name": "desenmascara.me", + "method": "blacklist", + "result": "clean" + }, + "malwares.com URL checker": { + "category": "harmless", + "engine_name": "malwares.com URL checker", + "method": "blacklist", + "result": "clean" + }, + "securolytics": { + "category": "harmless", + "engine_name": "securolytics", + "method": "blacklist", + "result": "clean" + }, + "zvelo": { + "category": "undetected", + "engine_name": "zvelo", + "method": "blacklist", + "result": "unrated" + } }, - { - "categories": [4], - "comment": "(CT) IP 76.76.21.21 (US/United States/-) found to have 584 connections", - "reportedAt": "2023-10-21T03:40:13+00:00", - "reporterCountryCode": "LT", - "reporterCountryName": "Lithuania", - "reporterId": 84727 + "last_analysis_stats": { + "harmless": 66, + "malicious": 1, + "suspicious": 0, + "timeout": 0, + "undetected": 21 }, - { - "categories": [4], - "comment": "(CT) IP 76.76.21.21 (US/United States/-) found to have 504 connections", - "reportedAt": "2023-10-21T03:10:08+00:00", - "reporterCountryCode": "LT", - "reporterCountryName": "Lithuania", - "reporterId": 84727 - } - ], - "abuseipdb_ip_info": { - "abuseConfidenceScore": 10, - "countryCode": "US", - "domain": "vercel.com", - "hostnames": null, - "ipAddress": "76.76.21.21", - "ipVersion": 4, - "isPublic": true, - "isTor": false, - "isWhitelisted": false, - "isp": "Vercel Inc", - "lastReportedAt": "2023-10-21T05:10:34+00:00", - "numDistinctUsers": 1, - "totalReports": 5, - "usageType": "Content Delivery Network" - }, - "reallyfreegeoip_ip_location": { - "city": "", - "country_code": "US", - "country_name": "United States", - "ip": "76.76.21.21", - "latitude": 37.751, - "longitude": -97.822, - "metro_code": 0, - "region_code": "", - "region_name": "", - "time_zone": "America/Chicago", - "zip_code": "" - }, - "virustotal_ip_scan": { - "attributes": { - "as_owner": "AMAZON-02", - "asn": 16509, - "continent": "NA", - "country": "US", - "last_analysis_date": 1699229969, - "last_analysis_results": { - "0xSI_f33d": { - "category": "undetected", - "engine_name": "0xSI_f33d", - "method": "blacklist", - "result": "unrated" - }, - "ADMINUSLabs": { - "category": "harmless", - "engine_name": "ADMINUSLabs", - "method": "blacklist", - "result": "clean" - }, - "AILabs (MONITORAPP)": { - "category": "harmless", - "engine_name": "AILabs (MONITORAPP)", - "method": "blacklist", - "result": "clean" - }, - "Abusix": { - "category": "harmless", - "engine_name": "Abusix", - "method": "blacklist", - "result": "clean" - }, - "Acronis": { - "category": "harmless", - "engine_name": "Acronis", - "method": "blacklist", - "result": "clean" - }, - "AlienVault": { - "category": "harmless", - "engine_name": "AlienVault", - "method": "blacklist", - "result": "clean" - }, - "AlphaSOC": { - "category": "undetected", - "engine_name": "AlphaSOC", - "method": "blacklist", - "result": "unrated" - }, - "Antiy-AVL": { - "category": "harmless", - "engine_name": "Antiy-AVL", - "method": "blacklist", - "result": "clean" - }, - "ArcSight Threat Intelligence": { - "category": "undetected", - "engine_name": "ArcSight Threat Intelligence", - "method": "blacklist", - "result": "unrated" - }, - "AutoShun": { - "category": "undetected", - "engine_name": "AutoShun", - "method": "blacklist", - "result": "unrated" - }, - "Avira": { - "category": "harmless", - "engine_name": "Avira", - "method": "blacklist", - "result": "clean" - }, - "Bfore.Ai PreCrime": { - "category": "harmless", - "engine_name": "Bfore.Ai PreCrime", - "method": "blacklist", - "result": "clean" - }, - "BitDefender": { - "category": "harmless", - "engine_name": "BitDefender", - "method": "blacklist", - "result": "clean" - }, - "Bkav": { - "category": "undetected", - "engine_name": "Bkav", - "method": "blacklist", - "result": "unrated" - }, - "Blueliv": { - "category": "harmless", - "engine_name": "Blueliv", - "method": "blacklist", - "result": "clean" - }, - "CINS Army": { - "category": "harmless", - "engine_name": "CINS Army", - "method": "blacklist", - "result": "clean" - }, - "CMC Threat Intelligence": { - "category": "harmless", - "engine_name": "CMC Threat Intelligence", - "method": "blacklist", - "result": "clean" - }, - "CRDF": { - "category": "harmless", - "engine_name": "CRDF", - "method": "blacklist", - "result": "clean" - }, - "Certego": { - "category": "harmless", - "engine_name": "Certego", - "method": "blacklist", - "result": "clean" - }, - "Chong Lua Dao": { - "category": "harmless", - "engine_name": "Chong Lua Dao", - "method": "blacklist", - "result": "clean" - }, - "Cluster25": { - "category": "undetected", - "engine_name": "Cluster25", - "method": "blacklist", - "result": "unrated" - }, - "Criminal IP": { - "category": "malicious", - "engine_name": "Criminal IP", - "method": "blacklist", - "result": "malicious" - }, - "CrowdSec": { - "category": "undetected", - "engine_name": "CrowdSec", - "method": "blacklist", - "result": "unrated" - }, - "CyRadar": { - "category": "harmless", - "engine_name": "CyRadar", - "method": "blacklist", - "result": "clean" - }, - "Cyan": { - "category": "undetected", - "engine_name": "Cyan", - "method": "blacklist", - "result": "unrated" - }, - "Cyble": { - "category": "harmless", - "engine_name": "Cyble", - "method": "blacklist", - "result": "clean" - }, - "DNS8": { - "category": "harmless", - "engine_name": "DNS8", - "method": "blacklist", - "result": "clean" - }, - "Dr.Web": { - "category": "harmless", - "engine_name": "Dr.Web", - "method": "blacklist", - "result": "clean" - }, - "ESET": { - "category": "harmless", - "engine_name": "ESET", - "method": "blacklist", - "result": "clean" - }, - "ESTsecurity": { - "category": "harmless", - "engine_name": "ESTsecurity", - "method": "blacklist", - "result": "clean" - }, - "EmergingThreats": { - "category": "harmless", - "engine_name": "EmergingThreats", - "method": "blacklist", - "result": "clean" - }, - "Emsisoft": { - "category": "harmless", - "engine_name": "Emsisoft", - "method": "blacklist", - "result": "clean" - }, - "Ermes": { - "category": "undetected", - "engine_name": "Ermes", - "method": "blacklist", - "result": "unrated" - }, - "Forcepoint ThreatSeeker": { - "category": "harmless", - "engine_name": "Forcepoint ThreatSeeker", - "method": "blacklist", - "result": "clean" - }, - "Fortinet": { - "category": "harmless", - "engine_name": "Fortinet", - "method": "blacklist", - "result": "clean" - }, - "G-Data": { - "category": "harmless", - "engine_name": "G-Data", - "method": "blacklist", - "result": "clean" - }, - "Google Safebrowsing": { - "category": "harmless", - "engine_name": "Google Safebrowsing", - "method": "blacklist", - "result": "clean" - }, - "GreenSnow": { - "category": "harmless", - "engine_name": "GreenSnow", - "method": "blacklist", - "result": "clean" - }, - "Heimdal Security": { - "category": "harmless", - "engine_name": "Heimdal Security", - "method": "blacklist", - "result": "clean" - }, - "IPsum": { - "category": "harmless", - "engine_name": "IPsum", - "method": "blacklist", - "result": "clean" - }, - "Juniper Networks": { - "category": "harmless", - "engine_name": "Juniper Networks", - "method": "blacklist", - "result": "clean" - }, - "K7AntiVirus": { - "category": "harmless", - "engine_name": "K7AntiVirus", - "method": "blacklist", - "result": "clean" - }, - "Kaspersky": { - "category": "undetected", - "engine_name": "Kaspersky", - "method": "blacklist", - "result": "unrated" - }, - "Lionic": { - "category": "harmless", - "engine_name": "Lionic", - "method": "blacklist", - "result": "clean" - }, - "Lumu": { - "category": "undetected", - "engine_name": "Lumu", - "method": "blacklist", - "result": "unrated" - }, - "MalwarePatrol": { - "category": "harmless", - "engine_name": "MalwarePatrol", - "method": "blacklist", - "result": "clean" - }, - "Malwared": { - "category": "harmless", - "engine_name": "Malwared", - "method": "blacklist", - "result": "clean" - }, - "Netcraft": { - "category": "undetected", - "engine_name": "Netcraft", - "method": "blacklist", - "result": "unrated" - }, - "OpenPhish": { - "category": "harmless", - "engine_name": "OpenPhish", - "method": "blacklist", - "result": "clean" - }, - "PREBYTES": { - "category": "harmless", - "engine_name": "PREBYTES", - "method": "blacklist", - "result": "clean" - }, - "PhishFort": { - "category": "undetected", - "engine_name": "PhishFort", - "method": "blacklist", - "result": "unrated" - }, - "PhishLabs": { - "category": "undetected", - "engine_name": "PhishLabs", - "method": "blacklist", - "result": "unrated" - }, - "Phishing Database": { - "category": "harmless", - "engine_name": "Phishing Database", - "method": "blacklist", - "result": "clean" - }, - "Phishtank": { - "category": "harmless", - "engine_name": "Phishtank", - "method": "blacklist", - "result": "clean" - }, - "PrecisionSec": { - "category": "undetected", - "engine_name": "PrecisionSec", - "method": "blacklist", - "result": "unrated" - }, - "Quick Heal": { - "category": "harmless", - "engine_name": "Quick Heal", - "method": "blacklist", - "result": "clean" - }, - "Quttera": { - "category": "harmless", - "engine_name": "Quttera", - "method": "blacklist", - "result": "clean" - }, - "SCUMWARE.org": { - "category": "harmless", - "engine_name": "SCUMWARE.org", - "method": "blacklist", - "result": "clean" - }, - "SOCRadar": { - "category": "harmless", - "engine_name": "SOCRadar", - "method": "blacklist", - "result": "clean" - }, - "SafeToOpen": { - "category": "undetected", - "engine_name": "SafeToOpen", - "method": "blacklist", - "result": "unrated" - }, - "Scantitan": { - "category": "harmless", - "engine_name": "Scantitan", - "method": "blacklist", - "result": "clean" - }, - "Seclookup": { - "category": "harmless", - "engine_name": "Seclookup", - "method": "blacklist", - "result": "clean" - }, - "SecureBrain": { - "category": "harmless", - "engine_name": "SecureBrain", - "method": "blacklist", - "result": "clean" - }, - "Segasec": { - "category": "undetected", - "engine_name": "Segasec", - "method": "blacklist", - "result": "unrated" - }, - "Snort IP sample list": { - "category": "harmless", - "engine_name": "Snort IP sample list", - "method": "blacklist", - "result": "clean" - }, - "Sophos": { - "category": "harmless", - "engine_name": "Sophos", - "method": "blacklist", - "result": "clean" - }, - "Spam404": { - "category": "harmless", - "engine_name": "Spam404", - "method": "blacklist", - "result": "clean" - }, - "StopForumSpam": { - "category": "harmless", - "engine_name": "StopForumSpam", - "method": "blacklist", - "result": "clean" - }, - "Sucuri SiteCheck": { - "category": "harmless", - "engine_name": "Sucuri SiteCheck", - "method": "blacklist", - "result": "clean" - }, - "ThreatHive": { - "category": "harmless", - "engine_name": "ThreatHive", - "method": "blacklist", - "result": "clean" - }, - "Threatsourcing": { - "category": "harmless", - "engine_name": "Threatsourcing", - "method": "blacklist", - "result": "clean" - }, - "Trustwave": { - "category": "harmless", - "engine_name": "Trustwave", - "method": "blacklist", - "result": "clean" - }, - "URLQuery": { - "category": "undetected", - "engine_name": "URLQuery", - "method": "blacklist", - "result": "unrated" - }, - "URLhaus": { - "category": "harmless", - "engine_name": "URLhaus", - "method": "blacklist", - "result": "clean" - }, - "VIPRE": { - "category": "undetected", - "engine_name": "VIPRE", - "method": "blacklist", - "result": "unrated" - }, - "VX Vault": { - "category": "harmless", - "engine_name": "VX Vault", - "method": "blacklist", - "result": "clean" - }, - "Viettel Threat Intelligence": { - "category": "harmless", - "engine_name": "Viettel Threat Intelligence", - "method": "blacklist", - "result": "clean" - }, - "ViriBack": { - "category": "harmless", - "engine_name": "ViriBack", - "method": "blacklist", - "result": "clean" - }, - "Webroot": { - "category": "harmless", - "engine_name": "Webroot", - "method": "blacklist", - "result": "clean" - }, - "Xcitium Verdict Cloud": { - "category": "undetected", - "engine_name": "Xcitium Verdict Cloud", - "method": "blacklist", - "result": "unrated" - }, - "Yandex Safebrowsing": { - "category": "harmless", - "engine_name": "Yandex Safebrowsing", - "method": "blacklist", - "result": "clean" - }, - "ZeroCERT": { - "category": "harmless", - "engine_name": "ZeroCERT", - "method": "blacklist", - "result": "clean" - }, - "alphaMountain.ai": { - "category": "harmless", - "engine_name": "alphaMountain.ai", - "method": "blacklist", - "result": "clean" - }, - "benkow.cc": { - "category": "harmless", - "engine_name": "benkow.cc", - "method": "blacklist", - "result": "clean" - }, - "desenmascara.me": { - "category": "harmless", - "engine_name": "desenmascara.me", - "method": "blacklist", - "result": "clean" - }, - "malwares.com URL checker": { - "category": "harmless", - "engine_name": "malwares.com URL checker", - "method": "blacklist", - "result": "clean" - }, - "securolytics": { - "category": "harmless", - "engine_name": "securolytics", - "method": "blacklist", - "result": "clean" - }, - "zvelo": { - "category": "undetected", - "engine_name": "zvelo", - "method": "blacklist", - "result": "unrated" + "last_https_certificate": { + "cert_signature": { + "signature": "55d5fa3ac62de293fc9cb00c31b78f23", + "signature_algorithm": "sha256RSA" + }, + "extensions": { + "1.3.6.1.4.1.11129.2.4.2": "91716cbb51848534", + "CA": false, + "authority_key_identifier": { + "keyid": "" + }, + "ca_information_access": { + "CA Issuers": "http://r3.i.lencr.org/", + "OCSP": "http://r3.o.lencr.org" + }, + "certificate_policies": ["2.23.140.1.2.1"], + "extended_key_usage": ["serverAuth", "clientAuth"], + "key_usage": ["digitalSignature", "keyEncipherment"], + "subject_alternative_name": ["no-sni.vercel-infra.com"], + "subject_key_identifier": "" + }, + "issuer": { + "C": "US", + "CN": "R3", + "O": "Let's Encrypt" + }, + "public_key": { + "algorithm": "RSA", + "rsa": { + "exponent": "10001", + "key_size": 2048, + "modulus": "708e73fd9f28467df9be45d4b11fb86b" } }, - "last_analysis_stats": { - "harmless": 66, - "malicious": 1, - "suspicious": 0, - "timeout": 0, - "undetected": 22 - }, - "last_https_certificate": { - "cert_signature": { - "signature": "8f7406318fc81e75ca1cadafe03c55e6493a6c5b9cca2ef367beea50188bf141965fccca324e116880c50729afd2681fafed241ae6e5ab7d179122d053c7ac796bfa198ced2680b76424bb09fabe57ca8172f484b2755a7b7997dfa311678fa3adaa292097f992df63e669746ede0c1e7146574ba2d3beabde2d1299492878d4566e011c1d26c5cac6ec6a3737511b50558ca826feaf797669ccd1046041477753a69c7f9a19ac8f22f69edfbd9ec36c221775eb83ba2f0f369cc44d930e012dec2a9d23520850e7bc6681d608b1ce72c3b13d6d4566206ba72653220a3bbfb0f3821c4c29949a6ef484c1fbbfbbe1e455d5fa3ac62de293fc9cb00c31b78f23", - "signature_algorithm": "sha256RSA" - }, - "extensions": { - "1.3.6.1.4.1.11129.2.4.2": "0481f300f1007600dab6bf6b3fb5b6229f9bc2bb5c6be87091716cbb51848534", - "CA": false, - "authority_key_identifier": { - "keyid": "142eb317b75856cbae500940e61faf9d8b14c2c6" - }, - "ca_information_access": { - "CA Issuers": "http://r3.i.lencr.org/", - "OCSP": "http://r3.o.lencr.org" - }, - "certificate_policies": ["2.23.140.1.2.1"], - "extended_key_usage": ["serverAuth", "clientAuth"], - "key_usage": ["digitalSignature", "keyEncipherment"], - "subject_alternative_name": ["no-sni.vercel-infra.com"], - "subject_key_identifier": "60f599129d7a804325e09c12286dca647a2d7eec" - }, - "issuer": { - "C": "US", - "CN": "R3", - "O": "Let's Encrypt" - }, - "public_key": { - "algorithm": "RSA", - "rsa": { - "exponent": "10001", - "key_size": 2048, - "modulus": "cde3240aa869c13c5bbde1d79a7cb89216a7057cfc11de5f26d4673c70cffa8eaec4d3aa605125d9b3806221c5051ed15e60fee24311c62a1d1af3ac1456cb6e30c3affc1aa427422976593bd18f386dd41d12d9257c877a93f87b66e6041f7e2c468a303428004999479f5b9fb5a38ecc37978f92cbc7deea91f31354761fce559ad6578b4437aaa6485f0137a2cd18acac8340209fb8367408f06741f9a2e1d22aba8c01c20ce9ff95ee471b3dea9d8016f6d6b3ff980b3ce6c077309a1e93a68b41b2c306d1ce7dcbd41f47ed9fa8f7d1b6f3c02b3f368cceff1b6fbbff86c06a4cb4660c9c1db7e0da16280b6ffd708e73fd9f28467df9be45d4b11fb86b" - } - }, - "serial_number": "4ea61ba2a2302423bc140b9b9a59b77a28c", - "size": 1280, - "subject": { - "CN": "no-sni.vercel-infra.com" - }, - "thumbprint": "646726574d0d4efd291041335b747fe74abb7ca0", - "thumbprint_sha256": "efd6a1e983b43297b84acf6b519f16547474b39d8b9fc61d384b36da8a8d722f", - "validity": { - "not_after": "2024-01-30 06:41:40", - "not_before": "2023-11-01 06:41:41" - }, - "version": "V3" - }, - "last_https_certificate_date": 1699230271, - "last_modification_date": 1699245542, - "network": "76.76.21.0/24", - "regional_internet_registry": "ARIN", - "reputation": 0, - "tags": null, - "total_votes": { - "harmless": 3, - "malicious": 3 - }, - "whois": "NetRange: 76.76.21.0 - 76.76.21.255\nCIDR: 76.76.21.0/24\nNetName: VERCEL-01\nNetHandle: NET-76-76-21-0-1\nParent: NET76 (NET-76-0-0-0-0)\nNetType: Direct Allocation\nOriginAS: \nOrganization: Vercel, Inc (ZEITI)\nRegDate: 2020-05-08\nUpdated: 2020-06-05\nComment: -----BEGIN CERTIFICATE-----MIIDmzCCAoOgAwIBAgIUYqxVc6t5udbMz0Ys6xC4VTX4NDgwDQYJKoZIhvcNAQELBQAwXTELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMQ8wDQYDVQQHDAZXYWxudXQxEzARBgNVBAoMClZlcmNlbCBJbmMxGzAZBgkqhkiG9w0BCQEWDG1AdmVyY2VsLmNvbTAeFw0yMDA1MTExMzIxMDJaFw0yMjA1MTExMzIxMDJaMF0xCzAJBgNVBAYTAlVTMQswCQYDVQQIDAJDQTEPMA0GA1UEBwwGV2FsbnV0MRMwEQYDVQQKDApWZXJjZWwgSW5jMRswGQYJKoZIhvcNAQkBFgxtQHZlcmNlbC5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDGZNRvQYOIYbBJHiZAs3VUPlT9OxU3S+zg5gFgEogAM5sCuQC+jOAfTY/RLgy9RFyfqeqrAtggW7AcSxVbywKaoPUrSeO0leksfVIWnUUpvuZvZJeoArlzrw7CjZ2AZirHkbgZpkpoPDOyR6D9nt5pY1uWiP2CF1vV2XIX7lJEwrzgu1Ki0O4a9UXRCHx818OHEJzF9OJfg5iwGuHmSwAQ0tVfOtvHCKMuFRb6wQzzdcI+4GmKIkfYKSQsTEAndDXcI8nDVEJ3lEt1mFA0x/vrFm5u4fzos9nogPGLaoQ1cUqnwFcoTckM0ic2GAuEUUnhLLr3kC+remuVMGN1HuZ/AgMBAAGjUzBRMB0GA1UdDgQWBBS8RvrS4Dyk7FAMmz+ldKyIPsITGzAfBgNVHSMEGDAWgBS8RvrS4Dyk7FAMmz+ldKyIPsITGzAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQC5JPZscR5+q3YMgwLsjCAFY/AbUDJvavT3oy8fyO597Xa9fzBJFXY6qG7b+KYQ8TfEgNGY/AUNU3+h8YG5VyRgaIzC0FANQc2EpxnmBBW+grvLIn+BlKAaFH2LvpG+hc8fUUgGicCKUvKxCyuRZMYxzpnTn4A6PzojbALdVAG1CuicfYvD91yvsBzDimniUehSG7dyWJklwsssT6sHFjqOv/1PLej2NWcE92M1Il27IZwZfOV8urG6yd6FZlGBG+8KZP8IEsMf6OropTRKlikHSvKzsOhAnmE/1J45HDjVFNeco+bZW5iOZiHu2Ov1FMTENrMe0xgjPjI7Ri2rdcU8-----END CERTIFICATE-----\nRef: https://rdap.arin.net/registry/ip/76.76.21.0\nOrgName: Vercel, Inc\nOrgId: ZEITI\nAddress: 340 S LEMON AVE #4133\nCity: Walnut\nStateProv: CA\nPostalCode: 91789\nCountry: US\nRegDate: 2020-03-26\nUpdated: 2020-06-05\nComment: https://vercel.com\nRef: https://rdap.arin.net/registry/entity/ZEITI\nOrgTechHandle: MFV2-ARIN\nOrgTechName: Vieira, Matheus Fernandez\nOrgTechPhone: +1-415-980-8007 \nOrgTechEmail: m@vercel.com\nOrgTechRef: https://rdap.arin.net/registry/entity/MFV2-ARIN\nOrgAbuseHandle: ABUSE7926-ARIN\nOrgAbuseName: Abuse \nOrgAbusePhone: +1-415-980-8007 \nOrgAbuseEmail: abuse@vercel.com\nOrgAbuseRef: https://rdap.arin.net/registry/entity/ABUSE7926-ARIN\n", - "whois_date": 1699199931 + "serial_number": "4ea61ba2a2302423bc140b9b9a59b77a28c", + "size": 1280, + "subject": { + "CN": "no-sni.vercel-infra.com" + }, + "thumbprint": "", + "thumbprint_sha256": "8b9fc61d384b36da8a8d722f", + "validity": { + "not_after": "2024-01-30 06:41:40", + "not_before": "2023-11-01 06:41:41" + }, + "version": "V3" }, - "id": "76.76.21.21", - "links": { - "self": "https://www.virustotal.com/api/v3/ip_addresses/76.76.21.21" + "last_https_certificate_date": 1701943970, + "last_modification_date": 1701953140, + "network": "76.76.21.0/24", + "regional_internet_registry": "ARIN", + "reputation": 0, + "tags": [], + "total_votes": { + "harmless": 3, + "malicious": 3 }, - "type": "ip_address" - } + "whois": "NetRange: 76.76.21.0 - 76.76.21.255\nCIDR: 76.76.21.0/24\nNetName: VERCEL-01\nNetHandle: NET-76-76-21-0-1\nParent: NET76 (NET-76-0-0-0-0)\nNetType: Direct Allocation\nOriginAS: \nOrganization: Vercel, Inc (ZEITI)\nRegDate: 2020-05-08\nUpdated: 2020-06-05\nComment: -----BEGIN CERTIFICATE-----MIIDmzCCAoOgAwIBAgIUYqxVc6t5udbMz0Ys6xC4VTX4NDgwDQYJKoZIhvcNAQELBQAwXTELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkNBMQ8wDQYDVQQHDAZXYWxudXQxEzARBgNVBAoMClZlcmNlbCBJbmMxGzAZBgkqhkiG9w0BCQEWDG1AdmVyY2VsLmNvbTAeFw0yMDA1MTExMzIxMDJaFw0yMjA1MTExMzIxMDJaMF0xCzAJBgNVBAYTAlVTMQswCQYDVQQIDAJDQTEPMA0GA1UEBwwGV2FsbnV0MRMwEQYDVQQKDApWZXJjZWwgSW5jMRswGQYJKoZIhvcNAQkBFgxtQHZlcmNlbC5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDGZNRvQYOIYbBJHiZAs3VUPlT9OxU3S+zg5gFgEogAM5sCuQC+jOAfTY/RLgy9RFyfqeqrAtggW7AcSxVbywKaoPUrSeO0leksfVIWnUUpvuZvZJeoArlzrw7CjZ2AZirHkbgZpkpoPDOyR6D9nt5pY1uWiP2CF1vV2XIX7lJEwrzgu1Ki0O4a9UXRCHx818OHEJzF9OJfg5iwGuHmSwAQ0tVfOtvHCKMuFRb6wQzzdcI+4GmKIkfYKSQsTEAndDXcI8nDVEJ3lEt1mFA0x/vrFm5u4fzos9nogPGLaoQ1cUqnwFcoTckM0ic2GAuEUUnhLLr3kC+remuVMGN1HuZ/AgMBAAGjUzBRMB0GA1UdDgQWBBS8RvrS4Dyk7FAMmz+ldKyIPsITGzAfBgNVHSMEGDAWgBS8RvrS4Dyk7FAMmz+ldKyIPsITGzAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQC5JPZscR5+q3YMgwLsjCAFY/AbUDJvavT3oy8fyO597Xa9fzBJFXY6qG7b+KYQ8TfEgNGY/AUNU3+h8YG5VyRgaIzC0FANQc2EpxnmBBW+grvLIn+BlKAaFH2LvpG+hc8fUUgGicCKUvKxCyuRZMYxzpnTn4A6PzojbALdVAG1CuicfYvD91yvsBzDimniUehSG7dyWJklwsssT6sHFjqOv/1PLej2NWcE92M1Il27IZwZfOV8urG6yd6FZlGBG+8KZP8IEsMf6OropTRKlikHSvKzsOhAnmE/1J45HDjVFNeco+bZW5iOZiHu2Ov1FMTENrMe0xgjPjI7Ri2rdcU8-----END CERTIFICATE-----\nRef: https://rdap.arin.net/registry/ip/76.76.21.0\nOrgName: Vercel, Inc\nOrgId: ZEITI\nAddress: 340 S LEMON AVE #4133\nCity: Walnut\nStateProv: CA\nPostalCode: 91789\nCountry: US\nRegDate: 2020-03-26\nUpdated: 2020-06-05\nComment: https://vercel.com\nRef: https://rdap.arin.net/registry/entity/ZEITI\nOrgTechHandle: MFV2-ARIN\nOrgTechName: Vieira, Matheus Fernandez\nOrgTechPhone: +1-415-980-8007 \nOrgTechEmail: m@vercel.com\nOrgTechRef: https://rdap.arin.net/registry/entity/MFV2-ARIN\nOrgAbuseHandle: ABUSE7926-ARIN\nOrgAbuseName: Abuse \nOrgAbusePhone: +1-415-980-8007 \nOrgAbuseEmail: abuse@vercel.com\nOrgAbuseRef: https://rdap.arin.net/registry/entity/ABUSE7926-ARIN\n", + "whois_date": 1701793121 + }, + "id": "76.76.21.21", + "links": { + "self": "https://www.virustotal.com/api/v3/ip_addresses/76.76.21.21" + }, + "type": "ip_address" } } } diff --git a/ip_profiler/flowpipe.fpvars.example b/ip_profiler/flowpipe.fpvars.example deleted file mode 100644 index b64cc14..0000000 --- a/ip_profiler/flowpipe.fpvars.example +++ /dev/null @@ -1,2 +0,0 @@ -abuseipdb_api_key="bfc6f1c42dsfsdfdsfsdf327b26977977b2bad9ac4adfdsfdsfsdda98f313c3d389126de0d" -virustotal_api_key="a1b2c3d4e5f6g7h8i9j10k11l12m13n14o15p16q17r18s19t20u21v22w23x24y" diff --git a/ip_profiler/ip_profiler.fp b/ip_profiler/ip_profiler.fp index fbade78..5c5f547 100644 --- a/ip_profiler/ip_profiler.fp +++ b/ip_profiler/ip_profiler.fp @@ -2,16 +2,16 @@ pipeline "ip_profiler" { title = "IP Profiler" description = "Get valuable information about an IP address by combining data from AbuseIPDB, ReallyFreeGeoIP and VirusTotal." - param "abuseipdb_api_key" { + param "abuseipdb_credentials" { type = string - default = var.abuseipdb_api_key - description = "API key to authenticate requests with AbuseIPDB." + default = "default" + description = "Name for AbuseIPDB credentials to use. If not provided, the default credentials will be used." } - param "virustotal_api_key" { + param "virustotal_credentials" { type = string - default = var.virustotal_api_key - description = "API key to authenticate requests with VirusTotal." + default = "default" + description = "Name for VirusTotal credentials to use. If not provided, the default credentials will be used." } param "ip_addresses" { @@ -25,17 +25,11 @@ pipeline "ip_profiler" { description = "Maximum age in days for the AbuseIPDB reports to retrieve. Defaults to 30 days." } - param "page" { - type = number - default = 1 - description = "The page number of results to retrieve. Defaults to page 1." - } - - param "per_page" { - type = number - default = 25 - description = "The number of reports per page. Defaults to 25 reports per page." - } + # param "page" { + # type = number + # default = 1 + # description = "The page number of results to retrieve. Defaults to page 1." + # } # ReallyFreeGeoIP - Get IP Geolocation step "pipeline" "reallyfreegeoip_ip_geolocation" { @@ -51,7 +45,7 @@ pipeline "ip_profiler" { for_each = { for ip in param.ip_addresses : ip => ip } pipeline = abuseipdb.pipeline.check_ip_address args = { - api_key = param.abuseipdb_api_key + cred = param.abuseipdb_credentials ip_address = each.value max_age_in_days = param.max_age_in_days } @@ -62,7 +56,7 @@ pipeline "ip_profiler" { for_each = { for ip in param.ip_addresses : ip => ip } pipeline = abuseipdb.pipeline.list_ip_address_reports args = { - api_key = param.abuseipdb_api_key + cred = param.abuseipdb_credentials ip_address = each.value max_age_in_days = param.max_age_in_days } @@ -75,7 +69,7 @@ pipeline "ip_profiler" { if = can(regex("^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$", each.value)) == true pipeline = virustotal.pipeline.get_ip_address_report args = { - api_key = param.virustotal_api_key + cred = param.virustotal_credentials ip_address = each.value } } @@ -91,7 +85,7 @@ pipeline "ip_profiler" { } output "ip_profile" { - description = "IP Profile" + description = "IP Profile." value = { for ip, details in step.transform.ip_profile : ip => details.value } } } diff --git a/ip_profiler/mod.fp b/ip_profiler/mod.fp index e7fefdb..e4224ab 100644 --- a/ip_profiler/mod.fp +++ b/ip_profiler/mod.fp @@ -4,19 +4,13 @@ mod "ip_profiler" { require { mod "github.com/turbot/flowpipe-mod-abuseipdb" { - version = "v0.0.1-rc.3" - args = { - api_key = var.abuseipdb_api_key - } + version = "v0.0.1-rc.5" } mod "github.com/turbot/flowpipe-mod-reallyfreegeoip" { - version = "v0.0.1-rc.3" + version = "v0.0.1-rc.5" } mod "github.com/turbot/flowpipe-mod-virustotal" { - version = "v0.0.1-rc.5" - args = { - api_key = var.virustotal_api_key - } + version = "v0.0.1-rc.7" } } } diff --git a/ip_profiler/variables.fp b/ip_profiler/variables.fp deleted file mode 100644 index bc2a3a4..0000000 --- a/ip_profiler/variables.fp +++ /dev/null @@ -1,9 +0,0 @@ -variable "abuseipdb_api_key" { - type = string - description = "API key to authenticate requests with AbuseIPDB." -} - -variable "virustotal_api_key" { - type = string - description = "API key to authenticate requests with VirusTotal." -}