search

HurricaneLabs / machinae

Machinae Security Intelligence Collector
MIT License
504 stars 101 forks source link

IPVoid missing output #28

Closed Den1al closed 6 years ago

Den1al commented 8 years ago

According to the .yaml file, the IPVoid should return the Blacklist status, but it doesn't. i.e the ip http://www.ipvoid.com/scan/8.8.8.8/ did not return the black list status.

mcm commented 8 years ago

@Den1al it only pulls the black list info if the IP is actually listed.

Den1al commented 8 years ago

Regardless of the blacklisting status, even knowing that it is safe is good practice.

mcm commented 8 years ago

Hmm. Lemme think on that. I agree but I'm not sure how best to visualize that without spitting out a ton of lines for each of their blacklists

Den1al commented 8 years ago

What do you mean by tons of lines? There is just one line to add.

On May 5, 2016, at 9:01 PM, mcm notifications@github.com wrote:

Hmm. Lemme think on that. I agree but I'm not sure how best to visualize that without spitting out a ton of lines for each of their blacklists

— You are receiving this because you were mentioned. Reply to this email directly or view it on GitHub

mcm commented 8 years ago

So currently, if you checked an IP that was listed on any of the lists IPVoid checks, you'd get one line of output for each blacklist they're listed on. The config logic doesn't currently (although maybe this is a feature we'd need for this case) support the "lack" of results - that is, there's no way in a site's configuration to say "If none of these match, say 'Not listed'". Instead, you'd have to list EVERY blacklist, and a status of whether its listed. That list is pretty long.