Added malicious sites from the polish cert. (#2121)

* added handling of parsing errors

Signed-off-by: Toni Uhlig <matzeton@googlemail.com>

1 files changed, 24 insertions, 0 deletions

diff --git a/utils/malicious_sites_download.sh b/utils/malicious_sites_download.sh
new file mode 100755
index 000000000..44fc76fb2
--- /dev/null
+++ b/utils/malicious_sites_download.sh
@@ -0,0 +1,24 @@
+#!/usr/bin/env bash
+
+set -e
+
+cd "$(dirname "${0}")" || exit 1
+. ./common.sh || exit 1
+
+# NDPI_PROTOCOL_CATEGORY_MALWARE = 100
+LIST=../lists/100_malware.list
+
+TMP=/tmp/mal.json
+ORIGIN="https://hole.cert.pl/domains/domains.json"
+
+
+printf '(1) Downloading file... %s\n' "${ORIGIN}"
+http_response=$(curl -s -o ${TMP} -w "%{http_code}" ${ORIGIN})
+check_http_response "${http_response}"
+is_file_empty "${TMP}"
+
+printf '%s\n' "(2) Processing Domains..."
+jq -r '.[] | select(.DeleteDate="")' < ${TMP} | sed -n 's/^[^"]*"DomainAddress": "\([^"]*\)".*$/\1/gp' >${LIST}
+
+rm -f "${TMP}"
+exit 0