malwareworld.js

const request = require('request');
const url = require('url');
const ipRangeCheck = require("ip-range-check");
const net = require('net');
const geoip = require('geoip-lite');
const sha1 = require('node-sha1');


var blcklsts_list = require(__dirname+'/blacklists_list.js');

var blacklists_list = blcklsts_list.blacklist_list;
var types_blacklist = blcklsts_list.types;
var modes_blacklist = blcklsts_list.modes;
var submodes_blacklist = blcklsts_list.submodes;
var titles_blacklist = blcklsts_list.titles;
var private_ranges = blcklsts_list.private_ranges;

var debug = 0;
var debugv2 = 0;
var use_sha1 = true;
var statistics = {}
/*
statistics = {
    "REFERENCE": {
        "matches": NUM,
        "sha1": SHA1
    }
}
*/

var malicious_ips = {};
var blacklists_not_responding = [];
var malicious_domains = {};
var malicious_ranges = {};
/*
malicious_* = "IP/DOMAIN/RANGE": { 
                    title: "",
                    type: [],
                    urls: [],
                    location : {lat: "", lng: ""},
                    references: []
}
*/


// Get the list and start processing it
function getBlackList(blacklist_component){
    if (debug > 0) console.log("Getting "+blacklist_component.reference);
    var options = {
        method: 'GET',
        url: blacklist_component.reference,
        gzip: true,
        timeout: 5*60*1000, //5 minutes
        headers: { 'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:59.0) Gecko/20100101 Firefox/59.0' }
      };
    request(options, function (error, response, body) {
        if (error){ 
            if (debug > 0) console.log('Error with '+blacklist_component.reference+' -- ', error); 
            blacklists_not_responding.push(blacklist_component);
        }
        if (body){
            statistics[blacklist_component.reference] = {};
            if(use_sha1) statistics[blacklist_component.reference]["sha1"] = sha1(body);
            parser(blacklist_component, body);
        }
    });
}

//Split the list and delete the comments
function splitDeleteComments(body, comment){
    var list = [];
    var lines = body.split(/\n/);
    lines.forEach(function(line){
        if (line.substring(0,comment.length) != comment) list.push(line) //If no comment push it
    })
    return list;
}

// Extract the info of the list
// Only the http, urls, ips, domains and titules, the rest is dropped
function parser(blacklist_component, body){
    var list = [];
    if (blacklist_component.comment != "" ) list = splitDeleteComments(body, blacklist_component.comment);
    else list = body.split(/\n/); //Regular list

    if (blacklist_component.limit > 0) list = list.slice(0, blacklist_component.limit)

    var matches_check = [];
    var matches = [];
    var titles = [];
    switch (blacklist_component.submode){
        case submodes_blacklist.each_line:
            list.forEach(function(line){
                mtch = line.match(blacklist_component.mode.regex);
                if (mtch != null){
                    var w = 0;
                    while(blacklist_component.mode == modes_blacklist.domain_list && checkType(mtch[w]).is_ip){ //For lists where we want to extract a Domain but first comes an IP
                        ++w; 
                        if (w >= mtch.length) return; 
                    } 
                    matches_check.push(mtch[w]);
                    if (typeof(blacklist_component.title) != typeof("String")){ //If title regex is declared, extrac the title
                        mtch = line.match(blacklist_component.title);
                        if (mtch != null) {
                            mtch[1] = mtch[1].replace(" pasted_text", ""); //Replace things that could appear in the title but not wanted
                            if (! mtch[1][0].match(/[\da-z]/i)) mtch[1] = mtch[1].slice(1); // If first is not a letter or a number, slice
                            titles.push(mtch[1].charAt(0).toUpperCase() + mtch[1].slice(1)); //Is 1 and no 0 to pick the data inside the () of the regexp
                        }    
                    }
                }
            })
            break;

        case submodes_blacklist.extract_all:
            list.forEach(function(line){
                mtch = line.match(blacklist_component.mode.regex);
                if (mtch != null) matches_check = matches_check.concat(mtch);
            })
            break;

        case submodes_blacklist.custom_Query_for_Suspicious:
            list.forEach(function(line){
                if ( line.indexOf("DNS Query ") != -1 ){
                    mtch = line.match(/[a-zA-Z0-9-_]*\.[a-zA-Z0-9-_\.]+/g);
                    if (mtch != null){ 
                        if (mtch[0][0] == ".") mtch[0] = mtch[0].slice(1) // Remove the initial "."
                        matches_check.push(mtch[0]);
                    }
                }
            })
            break;
        
        case submodes_blacklist.malc0de:
            list.forEach(function(line){
                mtch = line.match(/URL: ([-a-zA-Z0-9@:%_\+.~#?&//=]{2,256}\.[a-z]{2,4}\b(\/[-a-zA-Z0-9@:%_\+.~#?&//=]*)?)/i);
                if (mtch != null && mtch.length > 2){ 
                    matches_check.push(mtch[1]);
                }
            })
            break;

        default: if (debug > 0) console.log("Error: Unknown submode");
    }
    // Delete repeated if no titles
    if (titles == []){
        var matches = matches_check.filter(function(elem, index, self) {
            return index === self.indexOf(elem);
        })
    } else matches = matches_check;
    var max_matchs = 200000; //Max matches from a blacklist
    if (matches.length > max_matchs) matches = matches.slice(0, max_matchs);
    if (debug > 0) console.log("From "+blacklist_component.reference+" were extracted "+list.length+" lines with "+matches_check.length+" tokens and deleting repetitions the final number is "+ matches.length+". Titles recovered: "+titles.length);
    statistics[blacklist_component.reference]["matches"] = matches.length;
    checker(blacklist_component, matches, titles); // Process new info (http, url, ip or domain)
}

// As in a list there could be IPs and domains, and both match the domain regexp, here we figure out what we have
function checkType(malicious){
    check = { is_http: false, is_url: false, is_ip: false, is_range: false, is_domain: false };

    if (malicious.match(modes_blacklist.ip_list.regex_check)) check.is_ip = true;
    else if (malicious.match(modes_blacklist.domain_list.regex_check)) check.is_domain = true;
    else if (malicious.match(modes_blacklist.http_list.regex_check)) check.is_http = true;
    else if (malicious.match(modes_blacklist.url_list.regex_check)) check.is_url = true;
    else if (malicious.match(modes_blacklist.range_list.regex_check)) check.is_range = true;
    return check;
}

// Check if each malicious host is like it should
function checker(blacklist_component, mal_list, titles){ //Hay que checkear si es dominio o ip
    mal_list.forEach(function(malicious){
        var title = "";
        if (titles != []) title = titles[mal_list.indexOf(malicious)]; // titles an mal_list should be same length
        var check = checkType(malicious);
        if (check.is_http){
            hostname = url.parse(malicious).hostname;
            check = checkType(hostname); //Recheck to see if it is an IP or a domain
            if (check.is_ip) {
                ip = hostname;
                addElement(blacklist_component, ip, "", title, malicious);
            } else addElement(blacklist_component, "", hostname, title, malicious);  
        }
        else if (check.is_url){
            hostname = url.parse("http://"+malicious).hostname;
            check = checkType(hostname); //Recheck to see if it is an IP or a domain
            if (check.is_ip) {
                ip = hostname;
                addElement(blacklist_component, ip, "", title, malicious);
            } else addElement(blacklist_component, "", hostname, title, malicious);
        }
        else if (check.is_ip){
            ip = malicious;
            addElement(blacklist_component, ip, "", title, malicious);
        }
        else if (check.is_range){
            ip = malicious;
            addElement(blacklist_component, ip, "", title, malicious);
        }
        else if (check.is_domain){
            domain = malicious;
            addElement(blacklist_component, "", domain, title, malicious);
        }
        else 
            if (debug > 0) console.log("Lose: "+malicious)
    })
}

// Create or update the malicious component
function addElement(blacklist_component, ip, domain, title, malicious){
    if (ip=="" && domain=="") { if (debug > 0) console.log("Not IP or Domain: "+malicious); }
    // Check if DOMAIN
    else if (typeof(domain) == typeof("String") && domain.length > 2){ // Update if the where already recorded
        if (malicious_domains[domain] != undefined) updateTitleTypeUrlReference(blacklist_component, malicious_domains[domain], title, malicious);
        // If not update, then create a new one
        else saveNew(blacklist_component, malicious_domains, domain, title, malicious);
    }

    //Check if RANGE
    else if (blacklist_component.mode == modes_blacklist.range_list){ // Update if the range where already recorded
        if (malicious_ranges[ip] != undefined) updateTitleTypeUrlReference(blacklist_component, malicious_ranges[ip], title, malicious);
        // If not update, then create a new one
        else saveNew(blacklist_component, malicious_ranges, ip, title, malicious);
    }

    // Else = IP
    else{
        if (malicious_ips[ip] != undefined) updateTitleTypeUrlReference(blacklist_component, malicious_ips[ip], title, malicious)
        // If no update, then create
        else{
            for(var range in private_ranges){ //Private IPs dont wanted
                if (ipRangeCheck(ip, range)){ if (debug > 0) console.log("Private IP: "+ip); return; }
            }
            saveNew(blacklist_component, malicious_ips, ip, title, malicious);
        } 
    }
}

// Update the component (complete with ip, or a domain)
function updateTitleTypeUrlReference(blacklist_component, component, title, malicious){
    if (typeof(title) == typeof("String") && title.length > 1){ // Change/Update the title if there is new one
        for(var key in titles_blacklist) { // If it was a default title, put the malware name as title
            if (component.title == titles_blacklist.key) component.title = title; break;
        }
        if (component.title != title) component.title = component.title+"/"+title; // If it was other malware, put both
    }
    // TYPE
    if (component.type.indexOf(blacklist_component.type) == -1) component.type.push(blacklist_component.type); // Set type if new

    // URLS
    if (blacklist_component.mode == modes_blacklist.http_list && component.urls.indexOf(malicious) == -1 ) component.urls.push(malicious);
    else if (blacklist_component.mode == modes_blacklist.url_list && component.urls.indexOf("http://"+malicious) == -1 ) component.urls.push("http://"+malicious);
        
    // REFERENCES
    // Link mode if (component.references.indexOf(blacklists_list.indexOf(blacklist_component)) == -1) component.references.push(blacklists_list.indexOf(blacklist_component)); // Set reference if new
    if (component.references.indexOf(blacklist_component.reference) == -1) component.references.push(blacklist_component.reference); // Set reference if new
}

// Save new element in its list
function saveNew(blacklist_component, list_to_save, component, title, malicious){
    var geo = geoip.lookup(component);
    new_element = {
        title: (typeof(title) == typeof("String") && title.length > 1) ? title : blacklist_component.title,
        type: [blacklist_component.type],
        urls: [(blacklist_component.mode == modes_blacklist.http_list) ? malicious : ""],
        location: { lat: (geo == undefined || geo == null || geo.ll == undefined || geo.ll.length != 2) ? "" : geo.ll[0] + Math.random()/7 ,lng: (geo == undefined || geo == null || geo.ll == undefined || geo.ll.length != 2) ? "" : geo.ll[1] + Math.random()/7 },
        references: [blacklist_component.reference]
    }
    if ( blacklist_component.mode == modes_blacklist.url_list ) new_element.urls = ["http://"+malicious];
    list_to_save[component] = new_element;
}



// MAIN and Exports
function getData(lists){
    if (useBlacklists){
        lists.forEach(function(blacklist){
            getBlackList(blacklist);
        })
    }
}

function renewData(lists){
    malicious_ips = {};
    blacklists_not_responding = [];
    malicious_domains = {};
    malicious_ranges = {};
    if (useBlacklists) getData(lists);
}

// EXECUTE on require
var useBlacklists = true;
setTimeout(function(){ getData(blacklists_list); }, 3000); // 3 sec to start, time to configure and download more lists
setTimeout(function(){ getData(blacklists_not_responding); blacklists_not_responding = [];}, 9*60*1000); // 9min to retry with not responding lists


// Export funtions
// Renew data or set Interval to renew it periodically
// When data is renew it is deleted and then downloaded again
exports.deactivateBlacklists = function() { useBlacklists = false; }
exports.renewAllData = function(){ renewData(blacklists_list); }
exports.renewNotRespondingData = function(){ getData(blacklists_not_responding); }

exports.renewtAllDataInterval = function(mins){ setInterval(function(){ renewData(blacklists_list); }, mins*60*1000) }
exports.renewNotRespondingDataInterval = function(mins){ setInterval(function(){ getData(blacklists_not_responding); blacklists_not_responding = [];}, mins*60*1000) }

// Get lists
exports.getMalIpsList = function(){ return malicious_ips; }
exports.getMalDomainsList = function(){ return malicious_domains; }
exports.getMalRangesList = function(){ return malicious_ranges; }
exports.getNotRespondingLists = function(){ return blacklists_not_responding; }

// Get all elements of a type
// Types: Bad Reputation, Malware, Known Attacker, Spammer, Phishing, CryptoCurrencies, Hide source, Adware, DGA
exports.getMalHostsOf = function(type){
    var all = {};
    for (var key in malicious_ips){
        if (malicious_ips[key].type.indexOf(type) != -1) all[key] = malicious_ips[key];
    }
    for (var key in malicious_domains){
        if (malicious_domains[key].type.indexOf(type) != -1) all[key] = malicious_domains[key];
    }
    for (var key in malicious_ranges){
        if (malicious_ranges[key].type.indexOf(type) != -1) all[key] = malicious_ranges[key];
    }
    return all;
}

// Get statistics or set debug or quit sha1
exports.setDebug = function(){ debug = 1; }
exports.setDebugv2 = function(){ debugv2 = 1; }
exports.quitSha1 = function(){ use_sha1 = false; }
exports.getStatistics = function(){ return statistics; }
exports.getGeneralStatistics = function(){
    var num_ips = Object.keys(malicious_ips).length;
    var num_domains = Object.keys(malicious_domains).length;
    var num_ranges = Object.keys(malicious_ranges).length;
    var all_total = 0;
    for(var blacklist in statistics){
        all_total = all_total + statistics[blacklist]["matches"];
    }
    var general_statistics = {
        num_ips: num_ips,
        num_domains: num_domains,
        num_ranges: num_ranges,
        num_blacklists: blacklists_list.length,
        num_notResponding_blacklists: blacklists_not_responding.length,
        total_unique: num_ips + num_domains + num_ranges,
        repeated: all_total - (num_ips + num_domains + num_ranges),
        external_sources: { fraudguard: fdUserB && fdPassB,
                            fortiguard: fgB,
                            projecthoneypot: phB,
                            simplespamcop: scB,
                            wot: wotB }
    }
    return general_statistics;
}

// Chech if a Ipv4, domain or url is malicious. The type is autodetected
// A promise with the info is returned
function isMalicious(input){
    check = checkType(input);
    if (check.is_http){
        domain = url.parse(input).hostname;
        if (checkType(domain).is_ip) return isIp4Malicious(input);
        else return isDomainMalicious(domain);
    }
    else if (check.is_url){
        domain = url.parse("http://"+input).hostname;
        if (checkType(domain).is_ip) return isIp4Malicious(input);
        else return isDomainMalicious(domain);
    }
    else if (check.is_ip){
        return isIp4Malicious(input);
    }
    else if (check.is_domain){
        return isDomainMalicious(input);
    }
    else{
        return new Promise(function(resolve, reject) { resolve({malicious: false});});
    }
}

exports.isMalicious = isMalicious;

/* Malicious check
RESPONSE FORMAT:
{
    malicious: true,
    HOST: {
        ...details...
    }
}
*/

//Check if an IPv4 is malicious
function isIp4Malicious(ip){
    var response = {malicious: false}; response[ip] = {};

    return new Promise(function(resolve, reject) {
        var apis_response = checkApis(ip, true); // V2
        var list_response = (malicious_ips[ip] != undefined) ? malicious_ips[ip]: {};
        if (debugv2 > 0) console.log(" --> Respuesta lista(ips): "+JSON.stringify(list_response));
        var list_range_response = checkMaliciousIpInRanges(ip);
        if (debugv2 > 0) console.log(" --> Respuesta lista rangos: "+JSON.stringify(list_range_response));
        apis_response.then(function(apis_resp){
            if (debugv2 > 0) console.log(" ---> Estoy mergeando las listas <--- ")
            response[ip] = combComponents([apis_resp, list_response, list_range_response]);
            if (response[ip].title != "" && response[ip].type.length > 0 && response[ip].references !=[]) response.malicious = true;
            resolve(response);
        });
    });
}

//Check if a domain is malicious
function isDomainMalicious(domain){
    var response = {malicious: false}; response[domain] = {};

    return new Promise(function(resolve, reject) {
        var apis_response = checkApis(domain, false); // V2
        var list_response = (malicious_domains[domain] != undefined) ? malicious_domains[domain]: {};
        if (list_response == {}){ // Check if subdomain
            for (var mal_domain in malicious_domains){
                var dom_splt = domain.split(mal_domain);
                if(dom_splt.length == 2 && dom_splt[1] == ""){
                    list_response = malicious_domains[mal_domain];
                }
            }
        }
        if (debugv2 > 0) console.log(" --> Respuesta lista(dominios): "+JSON.stringify(list_response));
        apis_response.then(function(apis_resp){
            if (apis_resp == {} && list_response == {} ) resolve(response);
            else{
                if (debugv2 > 0) console.log(" ---> Estoy mergenado las listas (dominios) <---")
                response[domain] = combComponents([apis_resp, list_response]);
                if (response[domain].title != "" && response[domain].type.length > 0 && response[domain].references != [] && response[domain].type.indexOf(types_blacklist.whitelist) == -1 ) response.malicious = true;
                resolve(response);
            }
        });
    });
}

// Check if an IP is inside the IP rangues gathered
function checkMaliciousIpInRanges(ip){
    var response = {};
    for(var range in malicious_ranges){
        if (ipRangeCheck(ip, range)){
            response = malicious_ranges[range];
            return response;
        }
    }
    return response;
}


// Expose the main function isMaliciuos to a port
exports.listenInPort = function(port){
    var server = net.createServer(function (socket) {
        socket.setEncoding('utf8');
        socket.on('data', function(data) {
            isMalicious(data.replace("\n", "")).then(function(info_mal){
                socket.write(JSON.stringify(info_mal));
            });
        })
        socket.on('end', function() {
            socket.destroy();
        });
    }).listen(port);
}


/*
Flow:
    --> Loop all the blacklists (Func: getBlackList)
    (For each blacklist)
        --> Get all the info of each line of the blacklist (Func: parser)
        (For each info)
            --> Check the selected info (Func: checker)
            --> Save or update the information (Func: addElement, updateTitleTypeUrlReference)
    (In 10 min) 
        Start looking for domain locations
    (In 5 min)
        Try to connect agais with the error lists
*/



/////////////////
////// V2 ///////
//// APIs: 5 ////
// No Creds: 2 //
// DGADetective /
/////////////////

/* 
    Use of external APIs
    All has to return a promise 
    If malicuous:
        - A common object must be returned (see genComponent())
    If not malicious, then:
        - obj.malicious == false
        - obj.error EXISTS
*/


function getLoc(ip){
    var loc = {lat: '', lng: ''};
    var geo = geoip.lookup(ip);
    if (geo != null && geo.ll != undefined && geo.ll.length > 0){
       loc = { lat: geo.ll[0], lng: geo.ll[1] }
    };
    return loc
}

// Given de data generates a new component
function genComponent(elem, title, type, urls, loc, ref){
    var comp = {}
    comp[elem] = {
        title: title,
        type: type,
        urls: urls,
        location: loc,
        references: ref
    }
    return comp;
}

// Combines objects
// Does not combine locs, last wins
// Do not mix data from different IPs!!
function combComponents(comps){
    if (debugv2 > 0) console.log(" --> Me han llegado comps para mezclar: "+JSON.stringify(comps));
    if (comps == []) return comps;

    final = { title: "", type: [], urls: [], location: {}, references: [] }

    comps.forEach(function(comp){
        if (comp && comp.title && comp.urls && comp.location && comp.type.length > 0 && comp.references.length > 0){
            if ( comp.title != undefined && comp.title != "" && final.title.indexOf(comp.title) == -1 ){
                if (final.title == "") final.title += comp.title;
                else final.title += '/'+comp.title;
            }

            comp.type.forEach(function(type){
                if ( final.type.indexOf(type) == -1 ) final.type.push(type);
            })

            comp.urls.forEach(function(url){
                if ( final.urls.indexOf(url) == -1 ) final.urls.push(url);
            })
            
            if ( comp.location.lat ) final.location = comp.location;
            
            comp.references.forEach(function(ref){
                if ( final.references.indexOf(ref) == -1 ) final.references.push(ref);
            })
        }
    })
    return final;
}

// Function to check all the apis
function checkApis(host, isIP){
    var cdga = check_dgadetective(host, isIP);
    var cfd = check_fraudguard(host, isIP);
    var cfg = check_fortiguard(host, isIP);
    var cphp = check_projecthoneypot(host, isIP);
    var csc = check_spamcop(host, isIP);
    var cwot = check_wot(host, isIP);
    var otxa = check_otxalientvault(host, isIP);

    return new Promise(function(resolve, reject) {
        Promise.all([
            cdga.catch(error => { return error }) // Then if rejected it will continue
            ,cfd.catch(error => { return error })
            ,cfg.catch(error => { return error })
            ,cphp.catch(error => { return error })
            ,csc.catch(error => { return error })
            ,cwot.catch(error => { return error })
            ,otxa.catch(error => { return error })
            ]).then(responses => { 
            var final_comp = {};
            var comps = []
            responses.forEach(function(res){
                if (debugv2 > 0) console.log(" --> Resp API: "+JSON.stringify(res))
                if ( res != undefined && !res.error && (res.malicious == undefined || res.malicious) && res[host].title ){ // Then correct object
                    comps.push(res[host]);
                }
            });
            if (comps != []) final_comp = combComponents(comps);
            if (debugv2 > 0) console.log(" --> Respuesta de checkear apis: "+JSON.stringify(final_comp));
            resolve(final_comp);
        });
    });
}

// DGADETECTIVE (https://github.com/carlospolop-node-apis/dgadetective)
const dgadetective = require('dgadetective');

function check_dgadetective(host, isIP){
    if (!isIP){
        var promise = new Promise(function(resolve, reject) {
            dgadetective.checkDGA(host).then(function(result){
                if (result > 100) resolve(genComponent(host, titles_blacklist.default, [types_blacklist.dga], [], { lat: '', lng: ''}, ["https://www.npmjs.com/package/dgadetective"]));
                else resolve({malicious: false}); 
            }, function(error) {
                reject({error: "Error with dgadetective: "+error});
            });
        });
        return promise;
    }
    else
        return new Promise(function(resolve, reject) { resolve({malicious: false});});
}

// FRAUDGUARD (https://app.fraudguard.io/)
const fraudguard = require('fraudguard');
var fdUserB = false;
var fdPassB = false;
exports.setFraudguardUser = function(user){ 
    fraudguard.setUser(user);
    fdUserB = true;
}
exports.setFraudguardPass = function(password){ 
    fraudguard.setPassword(password);
    fdPassB = true;
}

// Pass suspicious IP or domain and check it with fraudguard
function check_fraudguard(host, isIP){
    if (isIP && fdUserB && fdPassB){
        var ip = host;
        var promise = new Promise(function(resolve, reject) {
            fraudguard.checkIP(ip).then(function(result) {
                if (!result.threat) reject({error: "Error with fraudguard: "+error});
                if (result.risk_level == "1") resolve({malicious: false}); //If not malicious                
                resolve(genComponent(ip, result.threat, [types_blacklist.default], [], getLoc(ip), ["https://fraudguard.io/"]));
            }, function(err) {
                reject({error: "Error with fraudguard: "+error});
            });
        });
        return promise;
    }
    else
        return new Promise(function(resolve, reject) { resolve({malicious: false});});
}




// FORTIGUARD (https://fortiguard.com)
// Creds no needed
const fortiguard = require('fortiguard');
var fgB = true;

exports.deactivateFortiguard = function(){ fgB=false; };

// Check an IP of a domain with fortiguard
function check_fortiguard(host, isIP){
    if (isIP && fgB){
        var ip = host
        var promise = new Promise(function(resolve, reject) {
            fortiguard.checkIP(ip).then(function(result) {
                if (!result.title) reject({error: "Error with fortiguard (No title)"});
                if (result.isBlacklisted){
                    resolve(genComponent(ip, result.title, [types_blacklist.default], [], getLoc(ip), ["https://fortiguard.com/search?q="+ip+"&engine=8"]));
                }
                else resolve({malicious: false}); //If not malicious

            }, function(error) {
                reject({error: "Error with fortiguard: "+error});
            });
        });
        return promise;
    }
    else if (!isIP && fgB){
        var promise = new Promise(function(resolve, reject) {
            fortiguard.checkDomain(host).then(function(result) {
                if (!result.title) reject({error: "Error with fortiguard (no title)"});
                if (result.isBlacklisted){
                    resolve(genComponent(host, result.title, [types_blacklist.default], [], { lat: '', lng: ''}, ["https://fortiguard.com/search?q="+host+"&engine=8"]));
                }
                else resolve({malicious: false}); //If not malicious

            }, function(error) {
                reject({error: "Error with fortiguard: "+error});
            });
        });
        return promise;
    }
    else
        return new Promise(function(resolve, reject) { resolve({malicious: false});});
}




// PROJECTHONEYPOT (https://www.projecthoneypot.org)
const projecthoneypot = require('nodejs-projecthoneypot');

var phB = false;
exports.setProjecthoneypotKey = function(key){
    projecthoneypot.setApiKey(key);
    phB = true;
}

// Chek the ip with the ProjectHoneypot
function check_projecthoneypot(host, isIP){
    if (isIP && phB){
        var ip = host;
        var promise = new Promise(function(resolve, reject) {
            projecthoneypot.checkIP(ip).then(function(result) {
                if (result.error) reject({error: "Error with projecthoneypot: "+result.error});
                if (!result.malicious) resolve({malicious: false});
                if ( result.days_since_last > '5' || parseInt(result.threat_score) < '2') resolve({malicious: false}); //If not malicious
                resolve(genComponent(ip, result.types.join("/"), [types_blacklist.default], [], getLoc(ip), ["https://www.projecthoneypot.com"]));

            }, function(error) {
                reject({error: "Error with projecthoneypot: "+error});
            });
        });
        return promise;
    }
    else
        return new Promise(function(resolve, reject) { resolve({malicious: false});});
}


// SPAMCOP (http://spamcop.net/)
// TODO: Check for using the real API
// Creds no needed in this version
const simplespamcop = require('simplespamcop');

var scB = true;
exports.deactivateSpamcop = function(){ scB=false; };

function check_spamcop(host, isIP){
    if (isIP && scB){
        var ip = host;
        var promise = new Promise(function(resolve, reject) {
            simplespamcop.checkIP(ip).then(function(result) {
                if (result.error) reject({error: "Error with spamcop: "+result.error});
                if (!result.malicious) resolve({malicious: false});
                resolve(genComponent(ip, titles_blacklist.spammer, [types_blacklist.spammer], [], getLoc(ip), ["https://www.spamcop.net/w3m?action=checkblock&ip="+ip]));
            }, function(err) {
                reject({error: "Error with projecthoneypot: "+error});
            });
        });
        return promise;
    }
    else
        return new Promise(function(resolve, reject) { resolve({malicious: false});});
}

// WEB OF TRUST (https://www.mywot.com)
const wot = require('weboftrust');

var wot_cats = {'101': types_blacklist.malware, "102": types_blacklist.default, "103": types_blacklist.phishing, "104": types_blacklist.phishing, "105": types_blacklist.default, "201": types_blacklist.default, 
                "202": types_blacklist.default, "203": types_blacklist.default, "204": types_blacklist.default, "205": types_blacklist.spammer, "206": types_blacklist.malware, "207": types_blacklist.default}

var wotB = false;
exports.setWOTKey = function(key){
    wot.setApiKey(key);
    wotB = true;
}

function check_wot(host, isIP){
    if (!isIP && wotB){
        var hosts = [host];
        var promise = new Promise(function(resolve, reject) {
            wot.checkDomains(hosts).then(function(result){
                if (result == undefined || result == {} || result[host] == undefined) resolve({malicious: false})
                else{
                    var cat_win = "501";                
                    for(var cat in result[host].categories) {
                        if (result[host].categories[cat] > cat_win) cat_win = result[host].categories[cat]
                    }
                    if (wot_cats[cat_win])
                        resolve(genComponent(host, wot_cats[cat_win], [wot_cats[cat_win]], [], { lat: '', lng: ''}, ["https://www.mywot.com/"]));
                    
                        else resolve({malicious: false}); //If not malicious
                }
            }, function(err) {
                reject({error: "Error with Web Of Trust: "+error});
            });
        });
        return promise;
    }
    else
        return new Promise(function(resolve, reject) { resolve({malicious: false});});
}


// OTX AlientVault (hhttps://otx.alienvault.com/api)
const otxalient = require('otx_alientvautl_checkip_and_domain');

var otxaB = false;
exports.setOTXAlientvaultKey = function(key){
    otxalient.setApiKey(key);
    otxaB = true;
}

// Chek the ip with the ProjectHoneypot
function check_otxalientvault(host, isIP){
    if (isIP && otxaB){
        var ip = host;
        var promise = new Promise(function(resolve, reject) {
            otxalient.checkIP(ip).then(function(result) {
                if (result.error) reject({error: "Error with otx alientvault: "+result.error});
                if (result.pulse_info.count <= 0) resolve({malicious: false});
                // Check if timestamp in first resut
                if ("modified" in result.pulse_info.pulses[0]){ check_time = "modified"; }
                else if ("created" in result.pulse_info.pulses[0]){ check_time = "created"; }
                else { resolve({malicious: false}); }
                // Check if more than a week
                if (new Date().getTime() - Date.parse(result.pulse_info.pulses[0][check_time]) > 7 * 24 * 60 * 60 *1000){
                    resolve({malicious: false});
                }
                else{
                    resolve(genComponent(ip, titles_blacklist.default, [types_blacklist.default], [], getLoc(ip), ["https://otx.alienvault.com/"]));
                }
            }, function(error) {
                reject({error: "Error with projecthoneypot: "+error});
            });
        });
        return promise;
    }
    else if (!isIP && otxaB){
        var domain = host;
        var promise = new Promise(function(resolve, reject) {
            otxalient.checkDomain(domain).then(function(result) {
                if (result.error) reject({error: "Error with otx alientvault: "+result.error});
                if (result.pulse_info.count <= 0) resolve({malicious: false});
                // Check if timestamp in first resut
                if ("modified" in result.pulse_info.pulses[0]){ check_time = "modified"; }
                else if ("created" in result.pulse_info.pulses[0]){ check_time = "created"; }
                else { resolve({malicious: false}); }
                // Check if more than a week
                if (new Date().getTime() - Date.parse(result.pulse_info.pulses[0][check_time]) > 7 * 24 * 60 * 60 *1000){
                    resolve({malicious: false});
                }
                else{
                    resolve(genComponent(ip, titles_blacklist.default, [types_blacklist.default], [], getLoc(ip), ["https://otx.alienvault.com/"]));
                }
            }, function(error) {
                reject({error: "Error with projecthoneypot: "+error});
            });
        });
        return promise;
    }
    else
        return new Promise(function(resolve, reject) { resolve({malicious: false});});
}

// PhisAI returns an ID and some minutes after you can check the report, this is too slow in this case
// const phisai = require('phisai');
// phisai.setApiKey("41a0181687ade697141a387e41819f4911cd3855818f494ff545b59619fdd1af22f86e1a926d84659c8d8bfdf11b02cf")


/*
var vt = require("node-virustotal");
var con = vt.MakePublicConnection();
con.setKey("e7d7ea300a19733b637cb69a5d1ca320c9a487134c1300068851df8b4697aa64");
con.setDelay(15000);

function check_virustotal(host, isIP){
    if (isIP){
        var ip = host
        var promise = new Promise(function(resolve, reject) {
            con.checkIPv4(ip,function(data){
                resolve(data);
              }, function(err){
                reject(err);
              });
        });
        return promise;
    }
    else{
        var promise = new Promise(function(resolve, reject) {
            con.getDomainReport(host,function(data){
                resolve(data);
              }, function(err){
                reject(err);
              });
        });
        return promise;
    }
}


ip = "google.es";
check_virustotal(ip, false).then(function(result){ 
        console.log(result);
    }, function(err) {
        console.log(err);
});
*/