check

Documentation

Overview

Package check contains functions that can Check an IP address.

Index

• Variables
• func AbuseIPDB(ipaddr net.IP) (checkip.Result, error)
• func BlockList(ipddr net.IP) (checkip.Result, error)
• func CinsScore(ipaddr net.IP) (checkip.Result, error)
• func DBip(ip net.IP) (checkip.Result, error)
• func DnsMX(ipaddr net.IP) (checkip.Result, error)
• func DnsName(ipaddr net.IP) (checkip.Result, error)
• func IPSum(ipaddr net.IP) (checkip.Result, error)
• func IPtoASN(ipaddr net.IP) (checkip.Result, error)
• func MaxMind(ip net.IP) (checkip.Result, error)
• func OTX(ipaddr net.IP) (checkip.Result, error)
• func Ping(ipaddr net.IP) (checkip.Result, error)
• func Shodan(ipaddr net.IP) (checkip.Result, error)
• func TcpPorts(ipaddr net.IP) (checkip.Result, error)
• func ThreadCrowd(ipaddr net.IP) (checkip.Result, error)
• func UrlScan(ipaddr net.IP) (checkip.Result, error)
• func VirusTotal(ipaddr net.IP) (checkip.Result, error)
• type AutonomousSystem
  • func (a AutonomousSystem) Json() ([]byte, error)
  • func (a AutonomousSystem) Summary() string
• type MX
  • func (mx MX) Json() ([]byte, error)
  • func (mx MX) Summary() string
• type Names
  • func (n Names) Json() ([]byte, error)
  • func (n Names) Summary() string
• type OpenTcpPorts
  • func (t OpenTcpPorts) Json() ([]byte, error)
  • func (t OpenTcpPorts) Summary() string
• type TcpPort

Variables

var Active = []checkip.Check{
	Ping,
	TcpPorts,
}

Active checks interact with the target IP address.

var Passive = []checkip.Check{
	AbuseIPDB,
	BlockList,
	CinsScore,
	DBip,
	DnsMX,
	DnsName,
	IPSum,
	IPtoASN,
	MaxMind,
	OTX,
	Shodan,
	ThreadCrowd,
	UrlScan,
	VirusTotal,
}

Passive checks don't interact directly with the target IP address.

Functions

func AbuseIPDB

func AbuseIPDB(ipaddr net.IP) (checkip.Result, error)

AbuseIPDB uses https://api.abuseipdb.com/ to get generic information about ipaddr and see if the ipaddr has been reported as malicious.

func BlockList

func BlockList(ipddr net.IP) (checkip.Result, error)

BlockList searches the ipaddr in http://api.blocklist.de.

func CinsScore

func CinsScore(ipaddr net.IP) (checkip.Result, error)

CinsScore searches ipaddr in https://cinsscore.com/list/ci-badguys.txt.

func DBip

func DBip(ip net.IP) (checkip.Result, error)

DBip gets geolocation data from https://db-ip.com/db/download/ip-to-city-lite

func DnsMX

func DnsMX(ipaddr net.IP) (checkip.Result, error)

DnsMX performs reverse lookup and consults AbuseIPDB to get domain names fo the ipaddr. Then it looks up MX records (mail servers) for the given domain names.

func DnsName

func DnsName(ipaddr net.IP) (checkip.Result, error)

DnsName does a reverse lookup for a given IP address to get its names.

func IPSum

func IPSum(ipaddr net.IP) (checkip.Result, error)

IPSum checks how many blacklists the ipaddr is found on.

func IPtoASN

func IPtoASN(ipaddr net.IP) (checkip.Result, error)

IPtoASN gets info about autonomous system (IPtoASN) of the ipaddr. The data is taken from a TSV file ip2asn-combined downloaded from iptoasn.com.

func MaxMind

func MaxMind(ip net.IP) (checkip.Result, error)

MaxMind gets geolocation data from maxmind.com's GeoLite2-City.mmdb.

func OTX

func OTX(ipaddr net.IP) (checkip.Result, error)

OTX counts pulses on otx.alienvault.com to find out whether the ipaddr is malicious.

func Ping

func Ping(ipaddr net.IP) (checkip.Result, error)

Ping sends five pings (ICMP echo request packets) to the ippaddr and returns the statistics.

func Shodan

func Shodan(ipaddr net.IP) (checkip.Result, error)

Shodan gets generic information from https://api.shodan.io.

func TcpPorts

func TcpPorts(ipaddr net.IP) (checkip.Result, error)

TcpPorts tries to connect to the 1000 TCP ports that are most often found open on Internet hosts. Then it reports which of those ports are open on the given IP address.

func ThreadCrowd

func ThreadCrowd(ipaddr net.IP) (checkip.Result, error)

ThreadCrowd threatcrowd.org to find out whether the ipaddr was voted malicious.

func UrlScan

func UrlScan(ipaddr net.IP) (checkip.Result, error)

UrlScan gets data from urlscan.io. When a URL is submitted to urlscan.io, an automated process will browse to the URL like a regular user and record the activity that this page navigation creates.

func VirusTotal

func VirusTotal(ipaddr net.IP) (checkip.Result, error)

VirusTotal gets generic information and security reputation about the ippaddr from https://www.virustotal.com/api.

Types

type AutonomousSystem

type AutonomousSystem struct {
	Number      int    `json:"-"`
	FirstIP     net.IP `json:"-"`
	LastIP      net.IP `json:"-"`
	Description string `json:"description"`
	CountryCode string `json:"-"`
}

func (AutonomousSystem) Json

func (a AutonomousSystem) Json() ([]byte, error)

func (AutonomousSystem) Summary

func (a AutonomousSystem) Summary() string

type MX

type MX struct {
	Records map[string][]string `json:"records"` // domain => MX records
}

MX maps MX records to domain names.

func (MX) Json

func (mx MX) Json() ([]byte, error)

func (MX) Summary

func (mx MX) Summary() string

type Names

type Names []string

Names are the DNS names of the given IP address.

func (Names) Json

func (n Names) Json() ([]byte, error)

func (Names) Summary

func (n Names) Summary() string

type OpenTcpPorts

type OpenTcpPorts []TcpPort

OpenTcpPorts are the TCP ports that were found open on the given IP address.

func (OpenTcpPorts) Json

func (t OpenTcpPorts) Json() ([]byte, error)

func (OpenTcpPorts) Summary

func (t OpenTcpPorts) Summary() string

type TcpPort

type TcpPort struct {
	Name   string // service name like ssh
	Number int16
}

TcpPorts represents a TCP ports.