know_your_ip/examples/example.ipynb

{
 "cells": [
  {
   "cell_type": "code",
   "execution_count": 1,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": [
    "from pprint import pprint\n",
    "from know_your_ip import (load_config,\n",
    "                          maxmind_geocode_ip,\n",
    "                          geonames_timezone,\n",
    "                          tzwhere_timezone,\n",
    "                          ipvoid_scan,\n",
    "                          abuseipdb_web,\n",
    "                          abuseipdb_api,\n",
    "                          censys_api,\n",
    "                          shodan_api,\n",
    "                          virustotal_api,\n",
    "                          ping,\n",
    "                          traceroute\n",
    "                          )"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 2,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": [
    "args = load_config()"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 3,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": [
    "ip = '222.186.30.49'"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 4,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Maxmind...\n",
      "{'maxmind.city.geoname_id': 1799962,\n",
      " 'maxmind.city.names.de': 'Nanjing',\n",
      " 'maxmind.city.names.en': 'Nanjing',\n",
      " 'maxmind.city.names.es': 'Nankín',\n",
      " 'maxmind.city.names.fr': 'Nankin',\n",
      " 'maxmind.city.names.ja': '南京市',\n",
      " 'maxmind.city.names.pt-BR': 'Nanquim',\n",
      " 'maxmind.city.names.ru': 'Нанкин',\n",
      " 'maxmind.city.names.zh-CN': '南京',\n",
      " 'maxmind.continent.code': 'AS',\n",
      " 'maxmind.continent.geoname_id': 6255147,\n",
      " 'maxmind.continent.names.de': 'Asien',\n",
      " 'maxmind.continent.names.en': 'Asia',\n",
      " 'maxmind.continent.names.es': 'Asia',\n",
      " 'maxmind.continent.names.fr': 'Asie',\n",
      " 'maxmind.continent.names.ja': 'アジア',\n",
      " 'maxmind.continent.names.pt-BR': 'Ásia',\n",
      " 'maxmind.continent.names.ru': 'Азия',\n",
      " 'maxmind.continent.names.zh-CN': '亚洲',\n",
      " 'maxmind.country.geoname_id': 1814991,\n",
      " 'maxmind.country.iso_code': 'CN',\n",
      " 'maxmind.country.names.de': 'China',\n",
      " 'maxmind.country.names.en': 'China',\n",
      " 'maxmind.country.names.es': 'China',\n",
      " 'maxmind.country.names.fr': 'Chine',\n",
      " 'maxmind.country.names.ja': '中国',\n",
      " 'maxmind.country.names.pt-BR': 'China',\n",
      " 'maxmind.country.names.ru': 'Китай',\n",
      " 'maxmind.country.names.zh-CN': '中国',\n",
      " 'maxmind.location.latitude': 32.0617,\n",
      " 'maxmind.location.longitude': 118.7778,\n",
      " 'maxmind.location.time_zone': 'Asia/Shanghai',\n",
      " 'maxmind.registered_country.geoname_id': 1814991,\n",
      " 'maxmind.registered_country.iso_code': 'CN',\n",
      " 'maxmind.registered_country.names.de': 'China',\n",
      " 'maxmind.registered_country.names.en': 'China',\n",
      " 'maxmind.registered_country.names.es': 'China',\n",
      " 'maxmind.registered_country.names.fr': 'Chine',\n",
      " 'maxmind.registered_country.names.ja': '中国',\n",
      " 'maxmind.registered_country.names.pt-BR': 'China',\n",
      " 'maxmind.registered_country.names.ru': 'Китай',\n",
      " 'maxmind.registered_country.names.zh-CN': '中国',\n",
      " 'maxmind.subdivisions': [{'geoname_id': 1806260,\n",
      "                           'iso_code': '32',\n",
      "                           'names': {'en': 'Jiangsu Sheng', 'zh-CN': '江苏省'}}],\n",
      " 'maxmind.traits.ip_address': '222.186.30.49'}\n"
     ]
    }
   ],
   "source": [
    "# Maxmind API\n",
    "print(\"Maxmind...\")\n",
    "result = maxmind_geocode_ip(args, ip)\n",
    "pprint(result)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 5,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "32.0617\n"
     ]
    }
   ],
   "source": [
    "# Get lat/long\n",
    "lat = result['maxmind.location.latitude']\n",
    "lng = result['maxmind.location.longitude']\n",
    "pprint(lat)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 6,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Geonames...\n",
      "{'geonames.countryCode': 'CN',\n",
      " 'geonames.countryName': 'China',\n",
      " 'geonames.dstOffset': 8,\n",
      " 'geonames.gmtOffset': 8,\n",
      " 'geonames.lat': 32.0617,\n",
      " 'geonames.lng': 118.7778,\n",
      " 'geonames.rawOffset': 8,\n",
      " 'geonames.sunrise': '2018-01-25 07:03',\n",
      " 'geonames.sunset': '2018-01-25 17:31',\n",
      " 'geonames.time': '2018-01-26 00:39',\n",
      " 'geonames.timezoneId': 'Asia/Shanghai'}\n"
     ]
    }
   ],
   "source": [
    "# Timezone from lat/lng\n",
    "print(\"Geonames...\")\n",
    "result = geonames_timezone(args, lat, lng)\n",
    "pprint(result)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 7,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Tzwhere...\n",
      "'Asia/Shanghai'\n"
     ]
    }
   ],
   "source": [
    "# Timezone from lat/lng (offline)\n",
    "print(\"Tzwhere...\")\n",
    "result = tzwhere_timezone(args, lat, lng)\n",
    "pprint(result)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 8,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "AbuseIPDB (Web)...\n",
      "{'abuseipdb.city': '\\nZhenjiang, Jiangsu\\n',\n",
      " 'abuseipdb.country': '\\n\\nChina\\n',\n",
      " 'abuseipdb.domain_name': '\\nchinatelecom.com.cn\\n',\n",
      " 'abuseipdb.found': 1,\n",
      " 'abuseipdb.history': ' Reporter | Date | Comment | Categories \\n'\n",
      "                      '\\n'\n",
      "                      '\\n'\n",
      "                      'Anonymous\\n'\n",
      "                      '| 03 Sep 2015 |\\n'\n",
      "                      '\\n'\n",
      "                      'fk hack\\n'\n",
      "                      '\\n'\n",
      "                      '|\\n'\n",
      "                      'Hacking\\n'\n",
      "                      '\\n'\n",
      "                      '\\n'\n",
      "                      '\\n'\n",
      "                      ' www.blocklist.de \\n'\n",
      "                      '| 10 Mar 2015 |\\n'\n",
      "                      '\\n'\n",
      "                      'Mar 10 15:19:02 www sshd[10172]: SSH: Server;Ltype: '\n",
      "                      'Version;Remote: 222.186.30.49-4118;Protocol: 2.0 ... '\n",
      "                      'show moreMar 10 15:19:02 www sshd[10172]: SSH: '\n",
      "                      'Server;Ltype: Version;Remote: '\n",
      "                      '222.186.30.49-4118;Protocol: 2.0;Client: libssh2_1.4.3\\n'\n",
      "                      'Mar 10 15:19:03 www sshd[10172]: SSH: Server;Ltype: '\n",
      "                      'Kex;Remote: 222.186.30.49-4118;Enc: '\n",
      "                      'aexxxxxxx28-ctr;MAC: hmac-sha1;Comp: none [preauth]\\n'\n",
      "                      'Mar 10 15:19:07 www sshd[10172]: SSH: Server;Ltype: '\n",
      "                      'Authname;Remote: 222.186.30.49-4118;Name: ubnt '\n",
      "                      '[preauth]\\n'\n",
      "                      'Mar 10 15:19:07 www sshd[10172]: Invalid user ubnt from '\n",
      "                      '222.186.30.49\\n'\n",
      "                      'Mar 10 15:19:07 www sshd[10174]: SSH: Server;Ltype: '\n",
      "                      'Version;Remote: 222.186.30.49-1245;Protocol: '\n",
      "                      '2.0;Client: libssh2_1.4.3\\n'\n",
      "                      'Mar 10 15:19:08 www sshd[10174]: SSH: Server;Ltype: '\n",
      "                      'Kex;Remote: 222.186.30.49-1245;Enc: '\n",
      "                      'aexxxxxxx28-ctr;MAC: hmac-sha1;Comp: none [preauth]\\n'\n",
      "                      'Mar 10 15:19:15 www sshd[10174]: SSH: Server;Ltype: '\n",
      "                      'Authname;Remote: 222.186.30.49-1245;Name: ubnt '\n",
      "                      '[preauth]\\n'\n",
      "                      'Mar 10 15:19:15 www sshd[10174]: Invalid user ubnt from '\n",
      "                      '222.186.30.49\\n'\n",
      "                      'Mar 10 15:19:15 www sshd[10178]: SSH: Server;Ltype: '\n",
      "                      'Version;Remote: 222.186.30.49-1674;Protocol: '\n",
      "                      '2.0........\\n'\n",
      "                      '-----------------------------------------------\\n'\n",
      "                      'http://www.blocklist.de/en/view.html?ip=222.186.30.49 '\n",
      "                      'show less\\n'\n",
      "                      '\\n'\n",
      "                      '|\\n'\n",
      "                      'FTP Brute-Force\\n'\n",
      "                      'Hacking\\n',\n",
      " 'abuseipdb.isp': '\\nChinaNet Jiangsu Province Network\\n',\n",
      " 'abuseipdb.usage_type': '\\nUnknown\\n'}\n"
     ]
    }
   ],
   "source": [
    "# abuseipdb web search\n",
    "print(\"AbuseIPDB (Web)...\")\n",
    "result = abuseipdb_web(args, ip)\n",
    "pprint(result)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 9,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "IPvoid...\n",
      "{'ipvoid.alerts': 'Barracuda_Reputation_B...|JustSpam_org',\n",
      " 'ipvoid.analysis_date': '2018-01-25 11:39:36',\n",
      " 'ipvoid.asn': 'AS23650',\n",
      " 'ipvoid.asn_owner': 'AS Number for CHINANET jiangsu province backbone',\n",
      " 'ipvoid.blacklist_status': 'BLACKLISTED 2/96',\n",
      " 'ipvoid.city': 'Nanjing',\n",
      " 'ipvoid.continent': 'Asia',\n",
      " 'ipvoid.country_code': ' (CN) China',\n",
      " 'ipvoid.elapsed_time': '1 seconds',\n",
      " 'ipvoid.ip_address': '222.186.30.49 Find Sites | IP Whois',\n",
      " 'ipvoid.isp': 'China Telecom jiangsu',\n",
      " 'ipvoid.latitude_longitude': '32.0617 / 118.7778 Google Map',\n",
      " 'ipvoid.region': 'Jiangsu ',\n",
      " 'ipvoid.reverse_dns': 'Unknown'}\n"
     ]
    }
   ],
   "source": [
    "# ipvoid.com\n",
    "print(\"IPvoid...\")\n",
    "result = ipvoid_scan(args, ip)\n",
    "pprint(result)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 10,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Census API...\n",
      "{'censys.ip': '222.186.30.49',\n",
      " 'censys.location.city': 'Nanjing',\n",
      " 'censys.location.continent': 'Asia',\n",
      " 'censys.location.country': 'China',\n",
      " 'censys.location.country_code': 'CN',\n",
      " 'censys.location.latitude': 32.0617,\n",
      " 'censys.location.longitude': 118.7778,\n",
      " 'censys.location.province': 'Jiangsu Sheng',\n",
      " 'censys.location.registered_country': 'China',\n",
      " 'censys.location.registered_country_code': 'CN',\n",
      " 'censys.location.timezone': 'Asia/Shanghai',\n",
      " 'censys.protocols': '443/https'}\n"
     ]
    }
   ],
   "source": [
    "# censys API\n",
    "print(\"Census API...\")\n",
    "result = censys_api(args, ip)\n",
    "pprint(result)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 11,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Shodan API...\n",
      "{'shodan.area_code': None,\n",
      " 'shodan.asn': 'AS23650',\n",
      " 'shodan.city': 'Nanjing',\n",
      " 'shodan.country_code': 'CN',\n",
      " 'shodan.country_code3': 'CHN',\n",
      " 'shodan.country_name': 'China',\n",
      " 'shodan.data': \"{'_shodan': {'options': {}, 'id': \"\n",
      "                \"'5930eae4-b76e-4e7c-bf10-2f7044bfd730', 'module': 'rdp', \"\n",
      "                \"'crawler': '70752434fdf0dcec35df6ae02b9703eaae035f7d'}, \"\n",
      "                \"'hash': 849922560, 'os': None, 'opts': {'raw': \"\n",
      "                \"'0300000b06d00000123400'}, 'ip': 3736739377, 'isp': 'China \"\n",
      "                \"Telecom jiangsu', 'port': 3389, 'ssl': {'dhparams': None, \"\n",
      "                \"'tlsext': [{'id': 65281, 'name': 'renegotiation_info'}], \"\n",
      "                \"'versions': ['TLSv1', '-SSLv2', '-SSLv3', '-TLSv1.1', \"\n",
      "                \"'-TLSv1.2'], 'acceptable_cas': [], 'cert': {'sig_alg': \"\n",
      "                \"'sha1WithRSAEncryption', 'issued': '20171015030120Z', \"\n",
      "                \"'expires': '20180416030120Z', 'expired': False, 'version': 2, \"\n",
      "                \"'extensions': [{'data': \"\n",
      "                \"'0\\\\\\\\n\\\\\\\\x06\\\\\\\\x08+\\\\\\\\x06\\\\\\\\x01\\\\\\\\x05\\\\\\\\x05\\\\\\\\x07\\\\\\\\x03\\\\\\\\x01', \"\n",
      "                \"'name': 'extendedKeyUsage'}, {'data': \"\n",
      "                \"'\\\\\\\\x03\\\\\\\\x02\\\\\\\\x040', 'name': 'keyUsage'}], \"\n",
      "                \"'fingerprint': {'sha256': \"\n",
      "                \"'a05fb71ef979699056ac4a425d3176fb6eb225cc726f884292985a1034a0dfc2', \"\n",
      "                \"'sha1': '250c43a13227ed61308976a5fb510d53ec9765e6'}, \"\n",
      "                \"'serial': 29620694171984408427532741725440911841, 'subject': \"\n",
      "                \"{'CN': 'WIN-O225QB2F16M'}, 'pubkey': {'type': 'rsa', 'bits': \"\n",
      "                \"2048}, 'issuer': {'CN': 'WIN-O225QB2F16M'}}, 'cipher': \"\n",
      "                \"{'version': 'TLSv1/SSLv3', 'bits': 128, 'name': \"\n",
      "                \"'AES128-SHA'}, 'chain': ['-----BEGIN \"\n",
      "                'CERTIFICATE-----\\\\nMIIC4jCCAcqgAwIBAgIQFki8+eJz9bhOojLtKLsp4TANBgkqhkiG9w0BAQUFADAa\\\\nMRgwFgYDVQQDEw9XSU4tTzIyNVFCMkYxNk0wHhcNMTcxMDE1MDMwMTIwWhcNMTgw\\\\nNDE2MDMwMTIwWjAaMRgwFgYDVQQDEw9XSU4tTzIyNVFCMkYxNk0wggEiMA0GCSqG\\\\nSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCt3v0kAzrwPegZvGcPmR6urg3gcxtYDURJ\\\\nn6RJVlevvkkKqqlkpbGlvJ41PU0oSUBoRd3LVHH0CnPrXmEqsY5mqbbjE1sWXbpU\\\\nbrBlCXavERu7UzNblRaTTLgGXddPUjn1vRj+DIfgBHKEx9vkpjChhaIzfBqu5LOP\\\\nsTYTwotN1eG02SuDAijCiUwcWGJnPoZQwJJwfB4y+2EOCX6Z9Xot3StWcpOw8m0X\\\\nLlKTr7ToILctFuZm7zGzOYAEpGth49MzL/HJsEDtu07rNcjLkOlPG1JtfW02IJU4\\\\nRUCq/Whbqeu5QtYXldO/DuFT6EUygFvt9j8CveiYJeELIlTFg8YbAgMBAAGjJDAi\\\\nMBMGA1UdJQQMMAoGCCsGAQUFBwMBMAsGA1UdDwQEAwIEMDANBgkqhkiG9w0BAQUF\\\\nAAOCAQEAR6+iyhXsx31ndcE1mpzQ+HELIo4AAGa6bzureqeDi1+eLqF/WI2j+obH\\\\nsScNPWOURiLhUBxbSmy5v9UwgvUXK04OEVs29i1bX3tBdbqmvHSnpcJU4BFKSakQ\\\\nliMp27Cptmz/p67OJGkq7NF1pHSdM00RmAgrk4KMRS4HFmEkDfHTIGzPE4YBG22J\\\\nqzTvQVl8Yec1VKiz69s/N06Y2laCPXVNnhKYpsE463EED9FtHArG858QDw92lGaQ\\\\n2DmHoBifaG+eSXRp2GGCcGPbr/fJecFWjPXI0yJikkE/Y1Hrwa1RxBuA0oDq4jHo\\\\nXns4qqUVav0ZKY6Zji0+9H8dXzGqYg==\\\\n-----END '\n",
      "                \"CERTIFICATE-----\\\\n'], 'alpn': []}, 'hostnames': [], \"\n",
      "                \"'location': {'city': 'Nanjing', 'region_code': '04', \"\n",
      "                \"'area_code': None, 'longitude': 118.77780000000001, \"\n",
      "                \"'country_code3': 'CHN', 'country_name': 'China', \"\n",
      "                \"'postal_code': None, 'dma_code': None, 'country_code': 'CN', \"\n",
      "                \"'latitude': 32.0617}, 'timestamp': \"\n",
      "                \"'2018-01-25T02:21:03.409737', 'domains': [], 'org': 'China \"\n",
      "                \"Telecom jiangsu province backbone', 'data': 'Remote Desktop \"\n",
      "                \"Protocol\\\\n\\\\\\\\x03\\\\\\\\x00\\\\\\\\x00\\\\\\\\x0b\\\\\\\\x06\\\\\\\\xd0\\\\\\\\x00\\\\\\\\x00\\\\\\\\x124\\\\\\\\x00', \"\n",
      "                \"'asn': 'AS23650', 'transport': 'tcp', 'ip_str': \"\n",
      "                \"'222.186.30.49'}|{'_shodan': {'options': {}, 'id': \"\n",
      "                \"'162cd091-90ff-45d5-bfa7-46d45d4170b8', 'module': 'http', \"\n",
      "                \"'crawler': '62861a86c4e4b71dceed5113ce9593b98431f89a'}, \"\n",
      "                \"'hash': 0, 'os': None, 'timestamp': \"\n",
      "                \"'2018-01-20T16:52:11.180191', 'opts': {}, 'deprecated': \"\n",
      "                \"{'html': {'new': 'http.html', 'eol': '2016-12-31'}, 'title': \"\n",
      "                \"{'new': 'http.title', 'eol': '2016-12-31'}}, 'isp': 'China \"\n",
      "                \"Telecom jiangsu', 'http': {'redirects': [], 'title': None, \"\n",
      "                \"'robots': None, 'server': None, 'host': '222.186.30.49', \"\n",
      "                \"'html': None, 'location': '/', 'sitemap': None, 'html_hash': \"\n",
      "                \"None}, 'port': 80, 'hostnames': [], 'location': {'city': \"\n",
      "                \"'Nanjing', 'region_code': '04', 'area_code': None, \"\n",
      "                \"'longitude': 118.77780000000001, 'country_code3': 'CHN', \"\n",
      "                \"'country_name': 'China', 'postal_code': None, 'dma_code': \"\n",
      "                \"None, 'country_code': 'CN', 'latitude': 32.0617}, 'ip': \"\n",
      "                \"3736739377, 'domains': [], 'org': 'China Telecom jiangsu \"\n",
      "                \"province backbone', 'data': '', 'asn': 'AS23650', \"\n",
      "                \"'transport': 'tcp', 'ip_str': '222.186.30.49'}|{'info': 'Uses \"\n",
      "                \"VNC, SOAP', '_shodan': {'options': {}, 'id': None, 'module': \"\n",
      "                \"'nodata-tcp', 'crawler': \"\n",
      "                \"'d264629436af1b777b3b513ca6ed1404d7395d80'}, 'product': \"\n",
      "                \"'VMware Authentication Daemon', 'hash': -1016726299, \"\n",
      "                \"'version': '1.10', 'opts': {}, 'ip': 3736739377, 'isp': \"\n",
      "                \"'China Telecom jiangsu', 'os': None, 'port': 902, \"\n",
      "                \"'hostnames': [], 'location': {'city': 'Nanjing', \"\n",
      "                \"'region_code': '04', 'area_code': None, 'longitude': \"\n",
      "                \"118.77780000000001, 'country_code3': 'CHN', 'country_name': \"\n",
      "                \"'China', 'postal_code': None, 'dma_code': None, \"\n",
      "                \"'country_code': 'CN', 'latitude': 32.0617}, 'timestamp': \"\n",
      "                \"'2018-01-14T07:35:13.504773', 'domains': [], 'org': 'China \"\n",
      "                \"Telecom jiangsu province backbone', 'data': '220 VMware \"\n",
      "                'Authentication Daemon Version 1.10: SSL Required, '\n",
      "                'ServerDaemonProtocol:SOAP, MKSDisplayProtocol:VNC , , NFCSSL '\n",
      "                \"supported/t\\\\r\\\\n', 'asn': 'AS23650', 'transport': 'tcp', \"\n",
      "                \"'ip_str': '222.186.30.49'}\",\n",
      " 'shodan.dma_code': None,\n",
      " 'shodan.hostnames': '',\n",
      " 'shodan.ip': 3736739377,\n",
      " 'shodan.ip_str': '222.186.30.49',\n",
      " 'shodan.isp': 'China Telecom jiangsu',\n",
      " 'shodan.last_update': '2018-01-25T02:21:03.409737',\n",
      " 'shodan.latitude': 32.0617,\n",
      " 'shodan.longitude': 118.77780000000001,\n",
      " 'shodan.org': 'China Telecom jiangsu province backbone',\n",
      " 'shodan.os': None,\n",
      " 'shodan.ports': '3389|80|902|443',\n",
      " 'shodan.postal_code': None,\n",
      " 'shodan.region_code': '04',\n",
      " 'shodan.tags': '',\n",
      " 'shodan.vulns': '!CVE-2014-0160'}\n"
     ]
    }
   ],
   "source": [
    "# shodan API\n",
    "print(\"Shodan API...\")\n",
    "result = shodan_api(args, ip)\n",
    "pprint(result)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 12,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Virustotal API...\n",
      "{'virustotal.as_owner': 'AS Number for CHINANET jiangsu province backbone',\n",
      " 'virustotal.asn': '23650',\n",
      " 'virustotal.country': 'CN',\n",
      " 'virustotal.detected_communicating_samples': \"{'date': '2015-06-30 11:43:28', \"\n",
      "                                              \"'positives': 49, 'total': 56, \"\n",
      "                                              \"'sha256': \"\n",
      "                                              \"'462aa5192818e7e9de17a8445f5ffb919c135ecea2fd62a439d43e4d98b5695c'}|{'date': \"\n",
      "                                              \"'2015-05-08 18:49:33', \"\n",
      "                                              \"'positives': 35, 'total': 56, \"\n",
      "                                              \"'sha256': \"\n",
      "                                              \"'9929f2fddf86bfb34d8eccea15395bfc839d642cf2051942988f6bcc767cbfe3'}|{'date': \"\n",
      "                                              \"'2015-05-08 03:15:54', \"\n",
      "                                              \"'positives': 43, 'total': 56, \"\n",
      "                                              \"'sha256': \"\n",
      "                                              \"'8cde2aa1638254837aca483be0912caa57129c9b35fbd4efdf807ab0cadb9b07'}|{'date': \"\n",
      "                                              \"'2015-05-07 17:12:43', \"\n",
      "                                              \"'positives': 37, 'total': 56, \"\n",
      "                                              \"'sha256': \"\n",
      "                                              \"'afa24ffba503d9ca3145de5f66256ded82c3b3788d1753d9d95079fc7cf9fda1'}\",\n",
      " 'virustotal.detected_downloaded_samples': \"{'date': '2015-05-08 18:32:08', \"\n",
      "                                           \"'positives': 37, 'total': 56, \"\n",
      "                                           \"'sha256': \"\n",
      "                                           \"'afa24ffba503d9ca3145de5f66256ded82c3b3788d1753d9d95079fc7cf9fda1'}|{'date': \"\n",
      "                                           \"'2015-05-06 07:30:50', \"\n",
      "                                           \"'positives': 20, 'total': 57, \"\n",
      "                                           \"'sha256': \"\n",
      "                                           \"'07fc745c29db1e2db61089d8d46299078794d7127120d04c07e0a1ea6933a6df'}\",\n",
      " 'virustotal.detected_urls': \"{'url': 'http://222.186.30.49/', 'positives': 2, \"\n",
      "                             \"'total': 65, 'scan_date': '2017-11-19 \"\n",
      "                             \"20:27:17'}|{'url': \"\n",
      "                             \"'http://222.186.30.49/GetPass.exe', 'positives': \"\n",
      "                             \"6, 'total': 64, 'scan_date': '2017-03-01 \"\n",
      "                             \"05:24:23'}|{'url': \"\n",
      "                             \"'http://222.186.30.49:5454/sb360.exe', \"\n",
      "                             \"'positives': 5, 'total': 64, 'scan_date': \"\n",
      "                             \"'2017-02-08 11:40:07'}|{'url': \"\n",
      "                             \"'http://222.186.30.49:5454/%E7%BB%9D%E5%AF%B9%E6%9C%89%E5%90%8E%E9%97%A8.rar', \"\n",
      "                             \"'positives': 5, 'total': 64, 'scan_date': \"\n",
      "                             \"'2017-02-06 21:28:50'}|{'url': \"\n",
      "                             \"'http://222.186.30.49:5454/Autoexec.exe', \"\n",
      "                             \"'positives': 6, 'total': 64, 'scan_date': \"\n",
      "                             \"'2017-02-05 22:52:55'}|{'url': \"\n",
      "                             \"'http://222.186.30.49:5454/GetPass.exe', \"\n",
      "                             \"'positives': 6, 'total': 64, 'scan_date': \"\n",
      "                             \"'2017-02-05 12:08:40'}|{'url': \"\n",
      "                             \"'http://jjjj.baijian775.com/', 'positives': 2, \"\n",
      "                             \"'total': 65, 'scan_date': '2015-10-08 \"\n",
      "                             \"10:47:12'}|{'url': \"\n",
      "                             \"'http://222.186.30.49:5234/GetPass.exe', \"\n",
      "                             \"'positives': 3, 'total': 63, 'scan_date': \"\n",
      "                             \"'2015-05-13 21:04:15'}|{'url': \"\n",
      "                             \"'http://222.186.30.49:5553/%E7%BB%9D%E5%AF%B9%E6%9C%89%E5%90%8E%E9%97%A8.rar', \"\n",
      "                             \"'positives': 2, 'total': 63, 'scan_date': \"\n",
      "                             \"'2015-05-13 02:15:12'}|{'url': \"\n",
      "                             \"'http://222.186.30.49:8080/GetPass.exe', \"\n",
      "                             \"'positives': 3, 'total': 63, 'scan_date': \"\n",
      "                             \"'2015-05-13 02:15:13'}|{'url': \"\n",
      "                             \"'http://222.186.30.49:5454/http%E6%9C%8D%E5%8A%A1%E5%99%A8%E7%AE%80%E5%8D%95%E6%9E%B6%E8%AE%BE.rar', \"\n",
      "                             \"'positives': 3, 'total': 63, 'scan_date': \"\n",
      "                             \"'2015-05-13 00:05:15'}|{'url': \"\n",
      "                             \"'http://222.186.30.49:5454/', 'positives': 2, \"\n",
      "                             \"'total': 63, 'scan_date': '2015-05-12 \"\n",
      "                             \"01:28:09'}|{'url': \"\n",
      "                             \"'http://222.186.30.49:5553/GetPass.exe', \"\n",
      "                             \"'positives': 1, 'total': 63, 'scan_date': \"\n",
      "                             \"'2015-05-03 18:00:23'}\",\n",
      " 'virustotal.resolutions': \"{'last_resolved': '2016-04-19 00:00:00', \"\n",
      "                           \"'hostname': 'game7668.com'}|{'last_resolved': \"\n",
      "                           \"'2015-09-27 00:00:00', 'hostname': \"\n",
      "                           \"'jjjj.baijian775.com'}|{'last_resolved': \"\n",
      "                           \"'2016-04-25 00:00:00', 'hostname': \"\n",
      "                           \"'www.game7668.com'}\",\n",
      " 'virustotal.response_code': 1,\n",
      " 'virustotal.verbose_msg': 'IP address in dataset'}\n"
     ]
    }
   ],
   "source": [
    "# virustotal API\n",
    "print(\"Virustotal API...\")\n",
    "result = virustotal_api(args, ip)\n",
    "pprint(result)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 13,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Ping...\n",
      "{'ping.avg': 311.31535802469125,\n",
      " 'ping.count': 3,\n",
      " 'ping.max': 319.17195061728523,\n",
      " 'ping.min': 305.901037037037,\n",
      " 'ping.percent_loss': 0.0,\n",
      " 'ping.timeout': 3000}\n"
     ]
    }
   ],
   "source": [
    "# ping\n",
    "print(\"Ping...\")\n",
    "result = ping(args, ip)\n",
    "pprint(result)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 14,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Traceroute...\n",
      "{'traceroute.hops': b'\\r\\nTracing route to 222.186.30.49 over a maximum of 3'\n",
      "                    b'0 hops\\r\\n\\r\\n  1     2 ms     2 ms     3 ms  10.113.104'\n",
      "                    b'.1 \\r\\n  2     3 ms     4 ms     4 ms  65.207.79.73 \\r\\n'\n",
      "                    b'  3    61 ms    61 ms    62 ms  140.222.227.75 \\r\\n  4'\n",
      "                    b'    61 ms    60 ms    61 ms  152.63.4.193 \\r\\n  5    6'\n",
      "                    b'5 ms    62 ms    65 ms  157.130.230.26 \\r\\n  6    60 m'\n",
      "                    b's    64 ms    64 ms  202.97.50.29 \\r\\n  7   296 ms   2'\n",
      "                    b'97 ms   271 ms  202.97.51.177 \\r\\n  8   283 ms   291 m'\n",
      "                    b's   292 ms  202.97.35.109 \\r\\n  9   328 ms   303 ms   '\n",
      "                    b'278 ms  202.97.50.149 \\r\\n 10   295 ms   266 ms   280 '\n",
      "                    b'ms  202.97.92.14 \\r\\n 11   308 ms   277 ms   284 ms  6'\n",
      "                    b'1.160.134.22 \\r\\n 12     *        *      271 ms  58.21'\n",
      "                    b'7.20.66 \\r\\n 13     *        *        *     Request ti'\n",
      "                    b'med out.\\r\\n 14     *        *        *     Request ti'\n",
      "                    b'med out.\\r\\n 15     *        *        *     Request ti'\n",
      "                    b'med out.\\r\\n 16     *        *        *     Request ti'\n",
      "                    b'med out.\\r\\n 17   308 ms   319 ms   307 ms  222.186.30'\n",
      "                    b'.49 \\r\\n\\r\\nTrace complete.\\r\\n',\n",
      " 'traceroute.max_hops': 30}\n"
     ]
    }
   ],
   "source": [
    "# traceroute\n",
    "print(\"Traceroute...\")\n",
    "result = traceroute(args, ip)\n",
    "pprint(result)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {
    "collapsed": true
   },
   "outputs": [],
   "source": []
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.6.3"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 2
}