old_contents: import urllib2
  import re
  from Malcom.model.datatypes import Hostname, Evil
  from feed import Feed
  import Malcom.auxiliary.toolbox as toolbox
  
  class MalwareDomains(Feed):
  	def __init__(self, name):
  		super(MalwareDomains, self).__init__(name)
  		self.source = "http://mirror1.malwaredomains.com/files/domains.txt"
  		self.description = "Malware domains blocklist"
  		self.confidence = 50
  		self.name = "MalwareDomains"
  
  	def update(self):
  		self.update_lines()
  
  	def analyze(self, line):
  		if line.startswith('#') or line.startswith('\n'):
  			return
  
  		splitted_mdl = line.split('\t')
  		# 	20151201	agasi-story.info	malicious	blog.dynamoo.com	20131130	20121201	20120521	20110217
  
  		# Create the new hostname and store it in the DB
  		hostname = Hostname(hostname=splitted_mdl[2])
  		if hostname['value'] == None: return # hostname not found
  		evil = Evil()
  		evil['value'] = "Malware domain blocklist (%s)" % hostname['value']
  		evil['tags'] = ['malwaredomains', splitted_mdl[3]]
  		evil['reference'] = splitted_mdl[4]
  
  		return hostname, evil
  		
  
  
  
new_contents: import urllib2
  import re
  from Malcom.model.datatypes import Hostname, Evil
  from feed import Feed
  import Malcom.auxiliary.toolbox as toolbox
  
  class MalwareDomains(Feed):
  	def __init__(self, name):
  		super(MalwareDomains, self).__init__(name)
  		self.source = "http://mirror1.malwaredomains.com/files/domains.txt"
  		self.description = "Malware domains blocklist"
  		self.confidence = 50
  		self.name = "MalwareDomains"
  
  	def update(self):
  		self.update_lines()
  
  	def analyze(self, line):
  		if line.startswith('#') or line.startswith('\n'):
  			return
  
  		splitted_mdl = line.split('\t')
  		# 	20151201	agasi-story.info	malicious	blog.dynamoo.com	20131130	20121201	20120521	20110217
  
  		# Create the new hostname and store it in the DB
  		hostname = Hostname(hostname=splitted_mdl[2])
  		if hostname['value'] == None: return # hostname not found
  		evil = Evil()
  		evil['value'] = "Malware domain blocklist (%s)" % hostname['value']
  		evil['tags'] = ['malwaredomains', re.sub(r'[^\w]', '', splitted_mdl[3])]
  		evil['reference'] = splitted_mdl[4]
  
  		return hostname, evil
  		
  
  
  
subject: Deal with MalwareDomains non-ASCII characters