From dc2cf390c04d3011c389e0a7e0afbf7bd53de908 Mon Sep 17 00:00:00 2001 From: cgedris Date: Wed, 18 Feb 2026 09:20:29 -0700 Subject: [PATCH 1/2] Firewall endpoint added and IP_REP implemented --- Scoring Engine/.gitignore | 3 +++ Scoring Engine/config.py | 13 +++++++------ Scoring Engine/scoring_logic.py | 17 ++++++++++++++--- 3 files changed, 24 insertions(+), 9 deletions(-) diff --git a/Scoring Engine/.gitignore b/Scoring Engine/.gitignore index c7e1059..b677159 100644 --- a/Scoring Engine/.gitignore +++ b/Scoring Engine/.gitignore @@ -4,3 +4,6 @@ __pycache__/ batch_run.py url_batch.txt all_scores.txt +bad_ips.txt +radix_test.py +.venv diff --git a/Scoring Engine/config.py b/Scoring Engine/config.py index 923f903..77243f7 100644 --- a/Scoring Engine/config.py +++ b/Scoring Engine/config.py @@ -19,12 +19,12 @@ # Weights for each component in the final score calculation WEIGHTS = { 'Connection_Security': 18, - 'Certificate_Health': 16, - 'DNS_Record_Health': 15, - 'Domain_Reputation': 23, + 'Certificate_Health': 15, + 'DNS_Record_Health': 14, + 'Domain_Reputation': 24, 'WHOIS_Pattern': 10, #unused currently - 'IP_Reputation': 0, #unused currently (probably won't be used) - 'Credential_Safety': 18 + 'IP_Reputation': 2, #unused currently (probably won't be used) + 'Credential_Safety': 17 } @@ -35,7 +35,8 @@ 'hval', 'mail', 'method', - 'rdap' + 'rdap', + 'firewall' ] # Default target hostname used if no argument is provided diff --git a/Scoring Engine/scoring_logic.py b/Scoring Engine/scoring_logic.py index 74d9541..ecc6689 100644 --- a/Scoring Engine/scoring_logic.py +++ b/Scoring Engine/scoring_logic.py @@ -377,12 +377,18 @@ def score_cred_safety(cert_data:dict, hval_data:dict, scores:dict): #TODO: IMPLE if app_config.VERBOSE: print("Cred Safety Score: Significant Deduction - HSTS header missing. (CRED_SAFETY)", file=sys.stderr) -def score_ip_rep(dns_data:dict, hval_data:dict, scores:dict): #PAUSED: Further investigation needed to determine if helpful +def score_ip_rep(firewall_data:dict, scores:dict): #PAUSED: Further investigation needed to determine if helpful """Placeholder for IP Reputation scoring function. Currently unused, but can be implemented in the future. """ - - pass + blocked = firewall_data.get("Block", False) + if blocked: + scores['IP_Reputation'] -= 100 + if app_config.VERBOSE: + print("IP Reputation Score: CRITICAL - IP is listed on a firewall blocklist. (IP_REP)", file=sys.stderr) + else: + if app_config.VERBOSE: + print("IP Reputation Score: No deduction - IP is not listed on firewall blocklist. (IP_REP)", file=sys.stderr) def score_whois_pattern(rdap_data:dict, scan_date: datetime, scores:dict): #TODO: IMPLEMENT """Placeholder for WHOIS Pattern scoring function. @@ -595,6 +601,11 @@ def calculate_security_score(all_scans: dict, scan_date: datetime) -> dict: #CHA except Exception as e: print(f"Error in whois_pattern scan: {e}", file=sys.stderr) + try: + score_ip_rep(all_scans['firewall_scan'], scores) + except Exception as e: + print(f"Error in ip_rep scan: {e}", file=sys.stderr) + # 3. Clamp scores between 1 and 100 after all deductions for key in scores: scores[key] = max(1, min(100, scores[key])) From 2435e3cbad839ab2c5565dbd36f18b5d3c14713b Mon Sep 17 00:00:00 2001 From: cgedris Date: Thu, 5 Mar 2026 09:00:17 -0700 Subject: [PATCH 2/2] WHOIS: registrar scoring --- Scoring Engine/config.py | 14 ++++++++++++++ Scoring Engine/scoring_logic.py | 16 +++++++++++++++- 2 files changed, 29 insertions(+), 1 deletion(-) diff --git a/Scoring Engine/config.py b/Scoring Engine/config.py index 77243f7..ec7b791 100644 --- a/Scoring Engine/config.py +++ b/Scoring Engine/config.py @@ -70,3 +70,17 @@ "support","tel", "to", "today", "top", "tr", "tv", "ua", "us", "vip", "wiki", "world", "ws", "xn--q9jyb4c", "xyz" ] + +MAL_REGISTRARS = [ + "StanCo", "Istanco", "Hangzhou Yunji", "FlokiNET", "NauNet", "OPENPROV-RU", "DomainDelights", "Navicosoft Pty", "Shock Hosting", + "nicenic.net", "DropCatch.com 1422", "Dynu Systems Incorporated", "RegRU", "Hello Internet Corp", "PortlandNames.com", "Dynadot", + "Sav.com", "Gname", "WebNic.cc", "Mat Bao Corporation", "Immaterialism Limited", "MAXNAME-RU", "FE-RU", "温州市中网计算机技术服务有限公司", + "Namecheap", "Registrar R01.ru", "SPRINTNAMES-RU", "RegRU", "NIC.UA", "Namecheap", "NameSilo", "WebNic.cc", "Name SRS AB", "XServer", + "PDR", "OwnRegistrar", "Trunkoz", "Hostinger", "GMO", "Tucows", "Sav.com", "Realtime Register", "RU-Center", "Name.com", "Openprovider", + "Dominet", "GoDaddy", "Ultahost", "WebNic.cc", "河北识道网络科技有限公司", "MainReg Inc.", "Todaynic", "Eranet International" "长春市智绘网络科技有限公司", + "厦门三五互联信息有限公司", "南昌知乐远科技有限公司", "长沙小豆网络科技有限公司", "西部数码国际有限公司", "GKG NET", "成都垦派科技有限公司", + "四川域趣网络科技有限公司", "海口智慧康网络科技有限公司", "Global Domain Group", "Beijing Dongfang Ruipeng Digital Information Technology Co.", + "武汉物与伦比科技有限公司", "厦门纳网科技股份有限公司", "成都西维数码科技有限公司", "west263.com", "rocket" +] + + diff --git a/Scoring Engine/scoring_logic.py b/Scoring Engine/scoring_logic.py index 82bfaaa..f6e9572 100644 --- a/Scoring Engine/scoring_logic.py +++ b/Scoring Engine/scoring_logic.py @@ -541,7 +541,21 @@ def score_whois_pattern(rdap_data:dict, scan_date: datetime, scores:dict): #TODO if app_config.VERBOSE: print("WHO_IS Score: Registrar name is ", registrar_name, file=sys.stderr) - #TODO: put registrar scoring here + # 2. Check for registrary matches from MAL_REGISTRARS list (case-insensitive substring match) + found_matches = False + for reg in app_config.MAL_REGISTRARS: + # We convert BOTH to lowercase to ensure "NameSilo" matches "namesilo" + if reg.lower() in registrar_name.lower(): + found_matches = True + break + + if found_matches: + scores['WHOIS_Pattern'] -= 10 + if app_config.VERBOSE: + print("WHO_IS Score: Suspicious Registrar found: ", registrar_name, file=sys.stderr) + else: + if app_config.VERBOSE: + print("WHO_IS Score: Trustworthy Registrar found: ", registrar_name, file=sys.stderr) def calculate_final_score(weights, scores): #CHANGE """