#!/bin/bash
#####
# Description: Some information about the source
#
# Name: Malwaredomains.com 
# Frequency: Daily
# Types: domains
#####
# Some Variables
HOME="/tmp/osint"
SOURCES="/tmp/osint/sources"
HEADER="Accept: text/html"
UA21="Mozilla/5.0 Gecko/20100101 Firefox/21.0"
UA22="Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.2.13; ) Gecko/20101203"
TODAY=$(date +"%Y-%m-%d")
if [ ! -d "/tmp/ossint/sources/malwaredomains" ]; then
        mkdir -p /tmp/osint/sources/malwaredomains;
fi
cd $HOME
datadirs=( ipv4 domains hashes rules )
for i in "${datadirs[@]}"; do
        if [ ! -d "$HOME/$i" ]; then
                mkdir -p $HOME/$i
        fi
done
#####################################
cd /$SOURCES/malwaredomains
wget --user-agent="$UA22" "http://mirror2.malwaredomains.com/files/BOOT" -O malwaredomains_domains_zone.txt
#
# Now that this is downlaoded a quick AWK 1-liner to only
# pull the second column, which is our domain information.
#
cat malwaredomains_domains_zone.txt | awk '{print $2}' >> malwaredomains_domains_$TODAY.txt
cp malwaredomains_domains_$TODAY.txt /tmp/osint/domains/malwaredomains_domains_$TODAY.txt
#
# Make some other files
while read i; do
	echo "127.0.0.1     www.$i $i" >> malwaredomains_hosts_$TODAY.txt;
	echo "$i, " >> malwaredomains_siem_domains_$TODAY.csv
	echo "ALL:    .$i" >> malwaredomains_hostsdeny_$TODAY.deny
done < malwaredomains_domains_$TODAY.txt
#
cp malwaredomains_hosts_$TODAY.txt /tmp/osint/rules/malwaredomains_hosts_$TODAY.txt
cp malwaredomains_siem_domains_$TODAY.csv /tmp/osint/rules/malwaredomains_siem_domains_$TODAY.csv
cp malwaredomains_hostsdeny_$TODAY.deny /tmp/osint/rules/malwaredomains_hostsdeny_$TODAY.deny


#
# EOF

