From 831ec2a42dae76bc8ddfbc3a89d0f24d36d8d2cc Mon Sep 17 00:00:00 2001 From: Andrew Chiles Date: Wed, 1 Mar 2017 12:17:15 +0100 Subject: [PATCH] First public release --- README.md | 102 ++++++++++++ domainhunter.py | 400 +++++++++++++++++++++++++++++++++++++++++++++ examplereport.html | 15 ++ requirements.txt | 4 + 4 files changed, 521 insertions(+) create mode 100644 README.md create mode 100644 domainhunter.py create mode 100644 examplereport.html create mode 100644 requirements.txt diff --git a/README.md b/README.md new file mode 100644 index 0000000..7cfcba6 --- /dev/null +++ b/README.md @@ -0,0 +1,102 @@ +# Domain Hunter + +Authors Joe Vest (@joevest) & Andrew Chiles (@andrewchiles) + +Domain name selection is an important aspect of preparation for penetration tests and especially Red Team engagements. Commonly, domains that were used previously for benign purposes and were properly categorized can be purchased for only a few dollars. Such domains can allow a team to bypass reputation based web filters and network egress restrictions for phishing and C2 related tasks. + +This Python based tool was written to quickly query the Expireddomains.net search engine for expired/available domains with a previous history of use. It then optionally queries for domain reptutation against services like BlueCoat and IBM X-Force. The primary tool output is a timestamped HTML table style report. + +## Features + +- Retrieves specified number of recently expired and deleted domains (.com, .net, .org primarily) +- Retrieves available domains based on keyword search +- Performs reputation checks against the Blue Coat Site Review service +- Sorts results by domain age (if known) +- Text-based table and HTML report output with links to reputation sources and Archive.org entry + +## Use + +Install Requirements + + pip install -r requirements.txt + or + pip install requests texttable beautifulsoup4 lxml + +List DomainHunter options + + python ./domainhunter.py + usage: domainhunter.py [-h] [-q QUERY] [-c] [-r MAXRESULTS] [-w MAXWIDTH] + + Checks expired domains, bluecoat categorization, and Archive.org history to + determine good candidates for C2 and phishing domains + + optional arguments: + -h, --help show this help message and exit + -q QUERY, --query QUERY + Optional keyword used to refine search results + -c, --check Perform slow reputation checks + -r MAXRESULTS, --maxresults MAXRESULTS + Number of results to return when querying latest + expired/deleted domains (min. 100) + +Use defaults to check for most recent 100 domains and check reputation + + python ./domainhunter.py + +Search for 1000 most recently expired/deleted domains, but don't check reputation aganist Bluecoat or IBM xForce + + python ./domainhunter.py -r 1000 -n + +Search for available domains with search term of "dog" and max results of 100 + + ./domainhunter.py -q dog -r 100 -c + ____ ___ __ __ _ ___ _ _ _ _ _ _ _ _ _____ _____ ____ + | _ \ / _ \| \/ | / \ |_ _| \ | | | | | | | | | \ | |_ _| ____| _ \ + | | | | | | | |\/| | / _ \ | || \| | | |_| | | | | \| | | | | _| | |_) | + | |_| | |_| | | | |/ ___ \ | || |\ | | _ | |_| | |\ | | | | |___| _ < + |____/ \___/|_| |_/_/ \_\___|_| \_| |_| |_|\___/|_| \_| |_| |_____|_| \_\ + + Expired Domains Reptutation Checker + + DISCLAIMER: + This is for educational purposes only! + It is designed to promote education and the improvement of computer/cyber security. + The authors or employers are not liable for any illegal act or misuse performed by any user of this tool. + If you plan to use this content for illegal purpose, don't. Have a nice day :) + + ******************************************** + Start Time: 20170301_113226 + TextTable Column Width: 400 + Checking Reputation: True + Number Domains Checked: 100 + ******************************************** + Estimated Max Run Time: 33 minutes + + [*] Downloading malware domain list from http://mirror1.malwaredomains.com/files/justdomains + [*] Fetching expired or deleted domains containing "dog"... + [*] https://www.expireddomains.net/domain-name-search/?q=dog + [*] BlueCoat Check: Dog.org.au + [+] Dog.org.au is categorized as: Uncategorized + [*] IBM xForce Check: Dog.org.au + [+] Dog.org.au is categorized as: Not found. + [*] BlueCoat Check: Dog.asia + [+] Dog.asia is categorized as: Uncategorized + [*] IBM xForce Check: Dog.asia + [+] Dog.asia is categorized as: Not found. + [*] BlueCoat Check: HomeDog.net + [+] HomeDog.net is categorized as: Uncategorized + [*] IBM xForce Check: HomeDog.net + [+] HomeDog.net is categorized as: Not found. + [*] BlueCoat Check: PolyDogs.com + [+] PolyDogs.com is categorized as: Uncategorized + [*] IBM xForce Check: PolyDogs.com + [+] PolyDogs.com is categorized as: Not found. + [*] BlueCoat Check: SaltyDog.it + [+] SaltyDog.it is categorized as: Uncategorized + [*] IBM xForce Check: SaltyDog.it + [+] SaltyDog.it is categorized as: Not found. + [*] https://www.expireddomains.net/domain-name-search/?start=25&q=dog + [*] BlueCoat Check: FetchDoggieStore.com + [+] FetchDoggieStore.com is categorized as: Society/Daily Living + [*] IBM xForce Check: FetchDoggieStore.com + [+] FetchDoggieStore.com is categorized as: {u'General Business': True} \ No newline at end of file diff --git a/domainhunter.py b/domainhunter.py new file mode 100644 index 0000000..4056c1c --- /dev/null +++ b/domainhunter.py @@ -0,0 +1,400 @@ +#!/usr/bin/env python + +## Title: domainhunter.py +## Author: Joe Vest and Andrew Chiles +## Description: Checks expired domains, bluecoat categorization, and Archive.org history to determine +## good candidates for phishing and C2 domain names + +# To-do: +# Add reputation categorizations to identify desireable vs undesireable domains +# Code cleanup/optimization +# Read in list of desired domain names + +import time +import random +import argparse +import json + +## Functions + +def checkBluecoat(domain): + try: + url = 'https://sitereview.bluecoat.com/rest/categorization' + postData = {"url":domain} # HTTP POST Parameters + headers = {'User-Agent':useragent, + 'X-Requested-With':'XMLHttpRequest', + 'Referer':'https://sitereview.bluecoat.com/sitereview.jsp'} + + print('[*] BlueCoat Check: {}'.format(domain)) + response = s.post(url,headers=headers,data=postData,verify=False) + + responseJson = json.loads(response.text) + + if 'errorType' in responseJson: + a = responseJson['errorType'] + else: + soupA = BeautifulSoup(responseJson['categorization'], 'lxml') + a = soupA.find("a").text + + return a + except: + print('[-] Error retrieving Bluecoat reputation!') + return "-" + +def checkIBMxForce(domain): + try: + url = 'https://exchange.xforce.ibmcloud.com/url/{}'.format(domain) + headers = {'User-Agent':useragent, + 'Accept':'application/json, text/plain, */*', + 'x-ui':'XFE', + 'Origin':url, + 'Referer':url} + + print('[*] IBM xForce Check: {}'.format(domain)) + + url = 'https://api.xforce.ibmcloud.com/url/{}'.format(domain) + response = s.get(url,headers=headers,verify=False) + + responseJson = json.loads(response.text) + + if 'error' in responseJson: + a = responseJson['error'] + else: + a = responseJson["result"]['cats'] + + return a + + except: + print('[-] Error retrieving IBM x-Force reputation!') + return "-" + +def downloadMalwareDomains(): + url = malwaredomains + response = s.get(url,headers=headers,verify=False) + responseText = response.text + if response.status_code == 200: + return responseText + else: + print("Error reaching:{} Status: {}").format(url, response.status_code) + +## MAIN +if __name__ == "__main__": + + try: + import requests + from bs4 import BeautifulSoup + from texttable import Texttable + + except Exception as e: + print "Expired Domains Reputation Check" + print "[-] Missing dependencies: {}".format(str(e)) + print "[*] Install required dependencies by running `pip install -r requirements.txt`" + quit(0) + + parser = argparse.ArgumentParser(description='Checks expired domains, bluecoat categorization, and Archive.org history to determine good candidates for C2 and phishing domains') + parser.add_argument('-q','--query', help='Optional keyword used to refine search results', required=False, type=str) + parser.add_argument('-c','--check', help='Perform slow reputation checks', required=False, default=False, action='store_true') + parser.add_argument('-r','--maxresults', help='Number of results to return when querying latest expired/deleted domains (min. 100)', required=False, type=int, default=100) + parser.add_argument('-w','--maxwidth', help='Width of text table', required=False, type=int, default=400) + + args = parser.parse_args() + +## Variables + query = False + if args.query: + query = args.query + + check = args.check + maxresults = args.maxresults + + if maxresults < 100: + maxresults = 100 + + maxwidth=args.maxwidth + + t = Texttable(max_width=maxwidth) + malwaredomains = 'http://mirror1.malwaredomains.com/files/justdomains' + expireddomainsqueryurl = 'https://www.expireddomains.net/domain-name-search' + + timestamp = time.strftime("%Y%m%d_%H%M%S") + + useragent = 'Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)' + headers = {'User-Agent':useragent} + + requests.packages.urllib3.disable_warnings() + + # HTTP Session container, used to manage cookies, session tokens and other session information + s = requests.Session() + + data = [] + + title = ''' + ____ ___ __ __ _ ___ _ _ _ _ _ _ _ _ _____ _____ ____ +| _ \ / _ \| \/ | / \ |_ _| \ | | | | | | | | | \ | |_ _| ____| _ \ +| | | | | | | |\/| | / _ \ | || \| | | |_| | | | | \| | | | | _| | |_) | +| |_| | |_| | | | |/ ___ \ | || |\ | | _ | |_| | |\ | | | | |___| _ < +|____/ \___/|_| |_/_/ \_\___|_| \_| |_| |_|\___/|_| \_| |_| |_____|_| \_\ ''' + + print(title) + print("") + print("Expired Domains Reptutation Checker") + print("") + print("DISCLAIMER:") + print("This is for educational purposes only!") + disclaimer = '''It is designed to promote education and the improvement of computer/cyber security. +The authors or employers are not liable for any illegal act or misuse performed by any user of this tool. +If you plan to use this content for illegal purpose, don't. Have a nice day :)''' + print(disclaimer) + print("") + print("********************************************") + print("Start Time: {}").format(timestamp) + print("TextTable Column Width: {}").format(str(maxwidth)) + print("Checking Reputation: {}").format(str(check)) + print("Number Domains Checked: {}").format(maxresults) + print("********************************************") + + runtime = 0 + if check: + runtime = (maxresults * 20) / 60 + + else: + runtime = maxresults * .15 / 60 + + print("Estimated Max Run Time: {} minutes").format(int(runtime)) + print("") + + print('[*] Downloading malware domain list from {}'.format(malwaredomains)) + maldomains = downloadMalwareDomains() + + maldomains_list = maldomains.split("\n") + + # Use the keyword string to narrow domain search if provided + # Need to modify this to pull more than the first 25 results + if query: + print('[*] Fetching expired or deleted domains containing "{}"...').format(query) + + for i in range (0,maxresults,25): + if i == 0: + url = "{}/?q={}".format(expireddomainsqueryurl,query) + headers['Referer'] ='https://www.expireddomains.net/domain-name-search/?q={}&searchinit=1'.format(query) + else: + url = "{}/?start={}&q={}".format(expireddomainsqueryurl,i,query) + headers['Referer'] ='https://www.expireddomains.net/domain-name-search/?start={}&q={}'.format((i-25),query) + print("[*] {}".format(url)) + + # Annoyingly when querying specific keywords the expireddomains.net site requires additional cookies which + # are set in JavaScript and not recognized by Requests so we add them here manually + jar = requests.cookies.RequestsCookieJar() + jar.set('_pk_id.10.dd0a', '*', domain='expireddomains.net', path='/') + jar.set('_pk_ses.10.dd0a', '*', domain='expireddomains.net', path='/') + + domains = s.get(url,headers=headers,verify=False,cookies=jar).text + + # Turn the HTML into a Beautiful Soup object + soup = BeautifulSoup(domains, 'lxml') + table = soup.find("table") + + for row in table.findAll('tr')[1:]: + + # Alternative way to extract domain name + # domain = row.find('td').find('a').text + + cells = row.findAll("td") + if len(cells) >= 1: + output = "" + c0 = row.find('td').find('a').text # domain + c1 = cells[1].find(text=True) # bl + c2 = cells[2].find(text=True) # domainpop + c3 = cells[3].find(text=True) # birth + c4 = cells[4].find(text=True) # entries + c5 = cells[5].find(text=True) # similarweb + c6 = cells[6].find(text=True) # similarweb country code + c7 = cells[7].find(text=True) # moz + c8 = cells[8].find(text=True) # status com + c9 = cells[9].find(text=True) # status net + c10 = cells[10].find(text=True) # status org + c11 = cells[11].find(text=True) # status de + c12 = cells[12].find(text=True) # tld registered + c13 = cells[13].find(text=True) # monthly searches + c14 = cells[14].find(text=True) # adwords competition + c15 = cells[15].find(text=True) # list + c16 = cells[16].find(text=True) # status + c17 = cells[17].find(text=True) # related links + + available = '' + if c8 == "available": + available += ".com " + + if c9 == "available": + available += ".net " + + if c10 == "available": + available += ".org " + + if c11 == "available": + available += ".de " + + # Skip additional reputation checks if this domain is already categorized as malicious + if c0 in maldomains_list: + print("[-] Skipping {} - Identified as known malware domain").format(c0) + else: + bluecoat = '' + ibmxforce = '' + if c3 == '-': + bluecoat = 'ignored' + ibmxforce = 'ignored' + elif check == True: + bluecoat = checkBluecoat(c0) + print "[+] {} is categorized as: {}".format(c0, bluecoat) + ibmxforce = checkIBMxForce(c0) + print "[+] {} is categorized as: {}".format(c0, ibmxforce) + # Sleep to avoid captchas + time.sleep(random.randrange(10,20)) + else: + bluecoat = "skipped" + ibmxforce = "skipped" + # Append parsed domain data to list + data.append([c0,c3,c4,available,bluecoat,ibmxforce]) + + # Retrieve the most recent expired/deleted domain results + else: + + print('[*] Fetching {} expired or deleted domains...').format(query) + + # Generate list of URLs to query for expired/deleted domains, queries return 25 results per page + urls = [] + + for i in range (0,(maxresults/4),25): + urls.append('https://www.expireddomains.net/backorder-expired-domains?start={}'.format(i)) + urls.append('https://www.expireddomains.net/deleted-com-domains/?start={}o=changes&r=d'.format(i)) + urls.append('https://www.expireddomains.net/deleted-net-domains/?start={}o=changes&r=d'.format(i)) + urls.append('https://www.expireddomains.net/deleted-org-domains/?start={}o=changes&r=d'.format(i)) + + for url in urls: + + print("[*] {}".format(url)) + expireddomains = s.get(url,headers=headers,verify=False).text + + # Turn the HTML into a Beautiful Soup object + soup = BeautifulSoup(expireddomains, 'lxml') + table = soup.find("table") + + for row in table.findAll('tr')[1:]: + + #print(row) + #domain = row.find('td').find('a').text + cells = row.findAll("td") + if len(cells) >= 1: + output = "" + c0 = cells[0].find(text=True) # domain + c1 = cells[1].find(text=True) # bl + c2 = cells[2].find(text=True) # domainpop + c3 = cells[3].find(text=True) # birth + c4 = cells[4].find(text=True) # entries + c5 = cells[5].find(text=True) # similarweb + c6 = cells[6].find(text=True) # similarweb country code + c7 = cells[7].find(text=True) # moz + c8 = cells[8].find(text=True) # status com + c9 = cells[9].find(text=True) # status net + c10 = cells[10].find(text=True) # status org + c11 = cells[11].find(text=True) # status de + c12 = cells[12].find(text=True) # tld registered + c13 = cells[13].find(text=True) # changes + c14 = cells[14].find(text=True) # whois + # Expired Domains results have an additional 'Availability' column that breaks parsing "deleted" domains + #c15 = cells[15].find(text=True) # related links + + available = '' + if c8 == "available": + available += ".com " + + if c9 == "available": + available += ".net " + + if c10 == "available": + available += ".org " + + if c11 == "available": + available += ".de " + + # Skip additional reputation checks if this domain is already categorized as malicious + if c0 in maldomains_list: + print("[-] Skipping {} - Identified as known malware domain").format(c0) + else: + bluecoat = '' + ibmxforce = '' + if c3 == '-': + bluecoat = 'ignored' + ibmxforce = 'ignored' + elif check == True: + bluecoat = checkBluecoat(c0) + print "[+] {} is categorized as: {}".format(c0, bluecoat) + ibmxforce = checkIBMxForce(c0) + print "[+] {} is categorized as: {}".format(c0, ibmxforce) + # Sleep to avoid captchas + time.sleep(random.randrange(10,20)) + else: + bluecoat = "skipped" + ibmxforce = "skipped" + # Append parsed domain data to list + data.append([c0,c3,c4,available,bluecoat,ibmxforce]) + + # Sort domain list by column 2 (Birth Year) + sortedData = sorted(data, key=lambda x: x[1], reverse=True) + + t.add_rows(sortedData) + header = ['Domain', 'Birth', '#', 'TLDs', 'BC', 'IBM'] + t.header(header) + + # Build HTML Table + html = '' + htmlHeader = 'Expired Domain List' + htmlBody = '

The following available domains report was generated at {}

'.format(timestamp) + htmlTableHeader = ''' + + + + + + + + + + + + + + ''' + + htmlTableBody = '' + htmlTableFooter = '
DomainBirthEntriesTLDs AvailableBluecoatCategorizationIBM-xForceCategorizationWatchGuardNamecheapArchive.org
' + htmlFooter = '' + + # Build HTML table contents + for i in sortedData: + htmlTableBody += '' + htmlTableBody += '{}'.format(i[0]) # Domain + htmlTableBody += '{}'.format(i[1]) # Birth + htmlTableBody += '{}'.format(i[2]) # Entries + htmlTableBody += '{}'.format(i[3]) # TLDs + htmlTableBody += 'Bluecoat'.format(i[0]) # Bluecoat + htmlTableBody += '{}'.format(i[4]) # Bluecoat Categorization + htmlTableBody += 'IBM-xForce'.format(i[0]) # IBM xForce + htmlTableBody += '{}'.format(i[5]) # IBM x-Force Categorization + htmlTableBody += 'WatchGuard'.format(i[0]) # Borderware WatchGuard + htmlTableBody += 'Namecheap'.format(i[0]) # Namecheap + htmlTableBody += 'Archive.org'.format(i[0]) # Archive.org + htmlTableBody += '' + + html = htmlHeader + htmlBody + htmlTableHeader + htmlTableBody + htmlTableFooter + htmlFooter + + logfilename = "{}_domainreport.html".format(timestamp) + log = open(logfilename,'w') + log.write(html) + log.close + + print("\n[*] Search complete") + print("[*] Log written to {}\n").format(logfilename) + + + print(t.draw()) diff --git a/examplereport.html b/examplereport.html new file mode 100644 index 0000000..aeb4327 --- /dev/null +++ b/examplereport.html @@ -0,0 +1,15 @@ +Expired Domain List

The following available domains report was generated at 20170301_114032

+ + + + + + + + + + + + + +
DomainBirthEntriesTLDs AvailableBluecoatCategorizationIBM-xForceCategorizationWatchGuardNamecheapArchive.org
BankSecure.no20162BluecoatUncategorizedIBM-xForceNot found.WatchGuardNamecheapArchive.org
Bank.city20153BluecoatUncategorizedIBM-xForceNot found.WatchGuardNamecheapArchive.org
Bank.domains20155BluecoatUncategorizedIBM-xForceNot found.WatchGuardNamecheapArchive.org
TheBank.ng201512BluecoatUncategorizedIBM-xForceNot found.WatchGuardNamecheapArchive.org
BankGovtJobs.com2015110.net .org .de BluecoatPlaceholdersIBM-xForce{u'Job Search': True}WatchGuardNamecheapArchive.org
kwamanmanbank.com20155.net .org .de BluecoatSearch Engines/PortalsIBM-xForceNot found.WatchGuardNamecheapArchive.org
vabank.cc20141BluecoatUncategorizedIBM-xForceNot found.WatchGuardNamecheapArchive.org
RiverbankFernVale.net201416.de BluecoatUncategorizedIBM-xForceNot found.WatchGuardNamecheapArchive.org
bankocuiddaa.com20147.net .org .de BluecoatUncategorizedIBM-xForceNot found.WatchGuardNamecheapArchive.org
banksapi.com20146.net .org BluecoatUncategorizedIBM-xForceNot found.WatchGuardNamecheapArchive.org
BestBank.info201311BluecoatUncategorizedIBM-xForceNot found.WatchGuardNamecheapArchive.org
BankOnOptimum.com201313.net .org .de BluecoatUncategorizedIBM-xForceNot found.WatchGuardNamecheapArchive.org
bizbank.pt20136BluecoatUncategorizedIBM-xForceNot found.WatchGuardNamecheapArchive.org
ebanking.pt201311BluecoatUncategorizedIBM-xForceNot found.WatchGuardNamecheapArchive.org
esibank.pt20134.com .net .org .de BluecoatUncategorizedIBM-xForceNot found.WatchGuardNamecheapArchive.org
IronBank.pt20136.org .de Bluecoat-IBM-xForceNot found.WatchGuardNamecheapArchive.org
migbank.pt20136BluecoatUncategorizedIBM-xForceNot found.WatchGuardNamecheapArchive.org
BankoFlaw.com20137.net .org .de BluecoatWeb Ads/AnalyticsIBM-xForceNot found.WatchGuardNamecheapArchive.org
wordpresskennisbank.nl201325.com .net .org .de BluecoatTechnology/InternetIBM-xForceNot found.WatchGuardNamecheapArchive.org
bankrupcyattorneys.org201311.net .de BluecoatUncategorizedIBM-xForceNot found.WatchGuardNamecheapArchive.org
BanksFindYou.com201210.net .org .de BluecoatPlaceholdersIBM-xForce{u'Auctions / Classified Ads': True}WatchGuardNamecheapArchive.org
BankruptcyColorado.biz20128.net .org .de BluecoatUncategorizedIBM-xForceNot found.WatchGuardNamecheapArchive.org
BankTogo.com20117.net .org BluecoatSuspiciousIBM-xForceNot found.WatchGuardNamecheapArchive.org
btcbank.org20118BluecoatSearch Engines/PortalsIBM-xForceNot found.WatchGuardNamecheapArchive.org
BankingCourse.com20117.net .org .de BluecoatUncategorizedIBM-xForceNot found.WatchGuardNamecheapArchive.org
Bank.gen.in20105BluecoatPlaceholdersIBM-xForceNot found.WatchGuardNamecheapArchive.org
BankShot.fi201012BluecoatUncategorizedIBM-xForceNot found.WatchGuardNamecheapArchive.org
fbank.in201015BluecoatUncategorizedIBM-xForceNot found.WatchGuardNamecheapArchive.org
StoryBank.in20107.net BluecoatUncategorizedIBM-xForceNot found.WatchGuardNamecheapArchive.org
JpegBank.com20105.net .org .de BluecoatUncategorizedIBM-xForceNot found.WatchGuardNamecheapArchive.org
resimbankasi.net201026.org .de BluecoatPlaceholdersIBM-xForceNot found.WatchGuardNamecheapArchive.org
TransBankAs.com201075.net .org .de BluecoatBusiness/EconomyIBM-xForce{u'General Business': True}WatchGuardNamecheapArchive.org
BurbankMexicanFoodRestaurant.com201028.net .org .de BluecoatRestaurants/Dining/FoodIBM-xForce{u'Restaurants / Entertainment Venues': True}WatchGuardNamecheapArchive.org
targobank.pt201012BluecoatUncategorizedIBM-xForceNot found.WatchGuardNamecheapArchive.org
reobanks.com20099.net .org .de BluecoatUncategorizedIBM-xForceNot found.WatchGuardNamecheapArchive.org
PrivateBanking.com.es200910BluecoatBusiness/EconomyIBM-xForceNot found.WatchGuardNamecheapArchive.org
SocialBusinessBank.com200941.net .org .de BluecoatFinancial ServicesIBM-xForceNot found.WatchGuardNamecheapArchive.org
natinalevacaturebank.nl200915.com .net .org .de BluecoatSuspiciousIBM-xForceNot found.WatchGuardNamecheapArchive.org
eenbankvooruit.be200819.net .de BluecoatFinancial ServicesIBM-xForceNot found.WatchGuardNamecheapArchive.org
MainlineBank.net200831.org .de BluecoatFinancial ServicesIBM-xForceNot found.WatchGuardNamecheapArchive.org
BankCrew.com20078.net .org .de BluecoatUncategorizedIBM-xForceNot found.WatchGuardNamecheapArchive.org
coldwellbanker.pt200733BluecoatUncategorizedIBM-xForceNot found.WatchGuardNamecheapArchive.org
VietComeBank.com200710.net .org .de BluecoatSuspiciousIBM-xForceNot found.WatchGuardNamecheapArchive.org
vrlknowledgebank.com2006141.net .org .de BluecoatFinancial ServicesIBM-xForceNot found.WatchGuardNamecheapArchive.org
Embanks.com200410.net .org .de BluecoatSuspiciousIBM-xForceNot found.WatchGuardNamecheapArchive.org
digbanks.com200412.net .org .de BluecoatUncategorizedIBM-xForceNot found.WatchGuardNamecheapArchive.org
direktbanktest.de200321.com .net .org .de BluecoatUncategorizedIBM-xForceNot found.WatchGuardNamecheapArchive.org
YouBank.org200181BluecoatSuspiciousIBM-xForceNot found.WatchGuardNamecheapArchive.org
CheckBanker.com200144.net .org .de BluecoatUncategorizedIBM-xForceNot found.WatchGuardNamecheapArchive.org
SoftsBank.com200183.net .org .de BluecoatUncategorizedIBM-xForceNot found.WatchGuardNamecheapArchive.org
VikingBankMortgage.com200118.net .org .de BluecoatSearch Engines/PortalsIBM-xForceNot found.WatchGuardNamecheapArchive.org
AlgonquinBank.com200114.net .org .de BluecoatUncategorizedIBM-xForceNot found.WatchGuardNamecheapArchive.org
digbank.com200117.net .org .de BluecoatUncategorizedIBM-xForceNot found.WatchGuardNamecheapArchive.org
UnionBank.org199939BluecoatSuspiciousIBM-xForceNot found.WatchGuardNamecheapArchive.org
Bank.network-0BluecoatignoredIBM-xForceignoredWatchGuardNamecheapArchive.org
Bank.express-0BluecoatignoredIBM-xForceignoredWatchGuardNamecheapArchive.org
Bank.com.co-0BluecoatignoredIBM-xForceignoredWatchGuardNamecheapArchive.org
OnlineBanking.me-0BluecoatignoredIBM-xForceignoredWatchGuardNamecheapArchive.org
BeautyBank.fi-0BluecoatignoredIBM-xForceignoredWatchGuardNamecheapArchive.org
BankOfAmericaCorp.club-0.net .org .de BluecoatignoredIBM-xForceignoredWatchGuardNamecheapArchive.org
gigibank.club-0.com .net .org .de BluecoatignoredIBM-xForceignoredWatchGuardNamecheapArchive.org
BankService.nu-0BluecoatignoredIBM-xForceignoredWatchGuardNamecheapArchive.org
maklarbanken.nu-0.com .net .org .de BluecoatignoredIBM-xForceignoredWatchGuardNamecheapArchive.org
gigibank.cc-0.com .net .org .de BluecoatignoredIBM-xForceignoredWatchGuardNamecheapArchive.org
privacykennisbank.be-0.com .net .org .de BluecoatignoredIBM-xForceignoredWatchGuardNamecheapArchive.org
NashvilleBankruptcy.co-0.org .de BluecoatignoredIBM-xForceignoredWatchGuardNamecheapArchive.org
sygmabank.co-0.de BluecoatignoredIBM-xForceignoredWatchGuardNamecheapArchive.org
sorubankasi.co-0.de BluecoatignoredIBM-xForceignoredWatchGuardNamecheapArchive.org
trennbankensystem.eu-0.com .net .org BluecoatignoredIBM-xForceignoredWatchGuardNamecheapArchive.org
intelektbank.eu-0.net .org .de BluecoatignoredIBM-xForceignoredWatchGuardNamecheapArchive.org
privacykennisbank.eu-0.com .net .org .de BluecoatignoredIBM-xForceignoredWatchGuardNamecheapArchive.org
ProjectEnergyBank.co.uk-0.net .org .de BluecoatignoredIBM-xForceignoredWatchGuardNamecheapArchive.org
MagicValleyBank.mobi-0.net .org .de BluecoatignoredIBM-xForceignoredWatchGuardNamecheapArchive.org
IntermountainBank.mobi-0.de BluecoatignoredIBM-xForceignoredWatchGuardNamecheapArchive.org
PanhandleBank.mobi-0.de BluecoatignoredIBM-xForceignoredWatchGuardNamecheapArchive.org
AfricaBankingJobs.co.uk-0.net .org .de BluecoatignoredIBM-xForceignoredWatchGuardNamecheapArchive.org
BankTonMainsBowling.uk-0.com .net .org .de BluecoatignoredIBM-xForceignoredWatchGuardNamecheapArchive.org
PromoPowerBank.co.uk-0.net .org .de BluecoatignoredIBM-xForceignoredWatchGuardNamecheapArchive.org
zbank.in-0BluecoatignoredIBM-xForceignoredWatchGuardNamecheapArchive.org
kbank.in-0BluecoatignoredIBM-xForceignoredWatchGuardNamecheapArchive.org
ClicksBank.co.in-0.net .org .de BluecoatignoredIBM-xForceignoredWatchGuardNamecheapArchive.org
BankersAdvise.com-0.net .org .de BluecoatignoredIBM-xForceignoredWatchGuardNamecheapArchive.org
lepowerbank.fr-0.com .net .org .de BluecoatignoredIBM-xForceignoredWatchGuardNamecheapArchive.org
ArtBanking.fr-0.com BluecoatignoredIBM-xForceignoredWatchGuardNamecheapArchive.org
LaskArisBank.fr-0.de BluecoatignoredIBM-xForceignoredWatchGuardNamecheapArchive.org
lascarisbank.fr-0.de BluecoatignoredIBM-xForceignoredWatchGuardNamecheapArchive.org
bankeebankee.fr-0.net .org .de BluecoatignoredIBM-xForceignoredWatchGuardNamecheapArchive.org
besibank.pt-0.net .org .de BluecoatignoredIBM-xForceignoredWatchGuardNamecheapArchive.org
urbankings.pt-0.org BluecoatignoredIBM-xForceignoredWatchGuardNamecheapArchive.org
PowerBanks.pt-0BluecoatignoredIBM-xForceignoredWatchGuardNamecheapArchive.org
bifibank.net-0.org .de BluecoatignoredIBM-xForceignoredWatchGuardNamecheapArchive.org
bankieren.club-0.de BluecoatignoredIBM-xForceignoredWatchGuardNamecheapArchive.org
digitaalbankieren.club-0.com .net .org .de BluecoatignoredIBM-xForceignoredWatchGuardNamecheapArchive.org
mijnbank.club-0.net .de BluecoatignoredIBM-xForceignoredWatchGuardNamecheapArchive.org
tmworldbank.in-0.de BluecoatignoredIBM-xForceignoredWatchGuardNamecheapArchive.org
colartimagebank.nl-0.net .org .de BluecoatignoredIBM-xForceignoredWatchGuardNamecheapArchive.org
gratisvacaturebanken.nl-0.com .net .org .de BluecoatignoredIBM-xForceignoredWatchGuardNamecheapArchive.org
NoorBank.nl-0.de BluecoatignoredIBM-xForceignoredWatchGuardNamecheapArchive.org
BankruptcyLawyer.pro-0BluecoatignoredIBM-xForceignoredWatchGuardNamecheapArchive.org
decemberactievoedselbank.nl-0.com .net .org .de BluecoatignoredIBM-xForceignoredWatchGuardNamecheapArchive.org
\ No newline at end of file diff --git a/requirements.txt b/requirements.txt new file mode 100644 index 0000000..6192bbf --- /dev/null +++ b/requirements.txt @@ -0,0 +1,4 @@ +requests==2.13.0 +texttable==0.8.7 +beautifulsoup4==4.5.3 +lxml