search

HurricaneLabs / machinae

Machinae Security Intelligence Collector
MIT License
504 stars 101 forks source link

New lines in site output (see ipwhois) #8

Closed mcm closed 6 years ago

mcm commented 9 years ago 
steve > ~ > machinae -s ipwhois 8.8.8.8
********************************************************************************
* Information for 8.8.8.8
* Observable type: ipv4 (Auto-detected: True)
********************************************************************************

[+] IP Whois results
    [-] ASN Information: ('15169', '8.8.8.0/24', '', 'arin', 'US')
    [-] Network Information: ('8.0.0.0/8', 'NET-8-0-0-0-1', 'LVLT-ORG-8-8', '8.0.0.0 - 8.255.255.255')
    [-] Network Information: ('8.8.8.0/24', 'NET-8-8-8-0-1', 'LVLT-GOGL-8-8-8', '8.8.8.0 - 8.8.8.255')
    [-] Registration Info: ('Level 3 Communications, Inc.', '1992-12-01', '2012-02-24')
    [-] Registration Info: ('Google Inc.', '2014-03-14', '2014-03-14')
    [-] Registration Locality: ('Broomfield', 'CO', '80021', 'US')
    [-] Registration Locality: ('Mountain View', 'CA', '94043', 'US')
    [-] Abuse Email: security@level3.com
abuse@level3.com
    [-] Abuse Email: arin-contact@google.com
    [-] Tech Email: ipaddressing@level3.com
    [-] Tech Email: arin-contact@google.com
 steve > ~ >
billford commented 6 years ago

This was a long time ago and I don't know if it's still valid -- also, typing in words and just showing output doesn't help my fragile brain to understand what is needed. I assume the Abuse email is the problem? New Output:

machinae -s ipwhois 8.8.8.8

[+] IP Whois Results [-] ASN Information: ('15169', '8[.]8.8.0/24', '1992-12-01', 'arin', 'US') [-] Network Information: ('8[.]0.0.0/9', 'NET-8-0-0-0-1', 'LVLT-ORG-8-8', '8[.]0.0.0 - 8[.]127.255.255') [-] Network Information: ('8[.]8.8.0/24', 'NET-8-8-8-0-1', 'LVLT-GOGL-8-8-8', '8[.]8.8.0 - 8[.]8.8.255') [-] Registration Info: ('Level 3 Parent, LLC', '1992-12-01', '2018-04-23') [-] Registration Info: ('Google LLC', '2014-03-14', '2014-03-14') [-] Registration Locality: ('Monroe', 'LA', '71203', 'US') [-] Registration Locality: ('Mountain View', 'CA', '94043', 'US') [-] Abuse Email: ipaddressing@level3[.]com [-] Abuse Email: network-abuse@google[.]com [-] Tech Email: ipaddressing@level3[.]com [-] Tech Email: arin-contact@google[.]com

mcm commented 6 years ago

Yes that was the problem.

billford commented 6 years ago

I have been super unable to reproduce this across a bunch of whois queries so maybe it was fixed upstream? I dunno. I'm going to stop looking for the bug now though and close this. If anyone comes across it again, please open another issue and assign it to me.