Skip to content

Firewall endpoint added and IP_REP implemented #76

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
21tmccauley merged 3 commits into from
Mar 10, 2026
Merged

Firewall endpoint added and IP_REP implemented #76

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
dc2cf39
Firewall endpoint added and IP_REP implemented
cgedris Feb 18, 2026
f511310
Merge branch 'main' into engine_work
aCaboose Mar 4, 2026
2435e3c
WHOIS: registrar scoring
cgedris Mar 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 14 additions & 0 deletions Scoring Engine/config.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -70,3 +70,17 @@
"support","tel", "to", "today", "top", "tr", "tv", "ua",
"us", "vip", "wiki", "world", "ws", "xn--q9jyb4c", "xyz"
]

MAL_REGISTRARS = [
"StanCo", "Istanco", "Hangzhou Yunji", "FlokiNET", "NauNet", "OPENPROV-RU", "DomainDelights", "Navicosoft Pty", "Shock Hosting",
"nicenic.net", "DropCatch.com 1422", "Dynu Systems Incorporated", "RegRU", "Hello Internet Corp", "PortlandNames.com", "Dynadot",
"Sav.com", "Gname", "WebNic.cc", "Mat Bao Corporation", "Immaterialism Limited", "MAXNAME-RU", "FE-RU", "温州市中网计算机技术服务有限公司",
"Namecheap", "Registrar R01.ru", "SPRINTNAMES-RU", "RegRU", "NIC.UA", "Namecheap", "NameSilo", "WebNic.cc", "Name SRS AB", "XServer",
"PDR", "OwnRegistrar", "Trunkoz", "Hostinger", "GMO", "Tucows", "Sav.com", "Realtime Register", "RU-Center", "Name.com", "Openprovider",
"Dominet", "GoDaddy", "Ultahost", "WebNic.cc", "河北识道网络科技有限公司", "MainReg Inc.", "Todaynic", "Eranet International" "长春市智绘网络科技有限公司",
"厦门三五互联信息有限公司", "南昌知乐远科技有限公司", "长沙小豆网络科技有限公司", "西部数码国际有限公司", "GKG NET", "成都垦派科技有限公司",
"四川域趣网络科技有限公司", "海口智慧康网络科技有限公司", "Global Domain Group", "Beijing Dongfang Ruipeng Digital Information Technology Co.",
"武汉物与伦比科技有限公司", "厦门纳网科技股份有限公司", "成都西维数码科技有限公司", "west263.com", "rocket"
]


16 changes: 15 additions & 1 deletion Scoring Engine/scoring_logic.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -541,7 +541,21 @@ def score_whois_pattern(rdap_data:dict, scan_date: datetime, scores:dict): #TODO
if app_config.VERBOSE:
print("WHO_IS Score: Registrar name is ", registrar_name, file=sys.stderr)

#TODO: put registrar scoring here
# 2. Check for registrary matches from MAL_REGISTRARS list (case-insensitive substring match)
found_matches = False
for reg in app_config.MAL_REGISTRARS:
# We convert BOTH to lowercase to ensure "NameSilo" matches "namesilo"
if reg.lower() in registrar_name.lower():
found_matches = True
break

if found_matches:
scores['WHOIS_Pattern'] -= 10
if app_config.VERBOSE:
print("WHO_IS Score: Suspicious Registrar found: ", registrar_name, file=sys.stderr)
else:
if app_config.VERBOSE:
print("WHO_IS Score: Trustworthy Registrar found: ", registrar_name, file=sys.stderr)

def calculate_final_score(weights, scores): #CHANGE
"""
Expand Down