old_contents: from intelmq.lib import utils
  from intelmq.lib.bot import Bot, sys
  from intelmq.lib.message import Event
  from intelmq.lib.harmonization import DateTime
  
  
  class MalwareGroupIPsParserBot(Bot):
  
      def process(self):
          report = self.receive_message()
  
          if not report.contains("raw"):
              self.acknowledge_message()
  
          raw_report = utils.base64_decode(report.value("raw"))
  
          raw_report = raw_report.split("<tbody>")[1]
          raw_report = raw_report.split("</tbody>")[0]
          raw_report_splitted = raw_report.split("<tr>")
  
          for row in raw_report_splitted:
              row = row.strip()
  
              if row == "":
                  continue
  
              row_splitted = row.split("<td>")
              ip = spl[1].split('">')[1].split("<")[0].strip()
              time_source = spl[6].replace("</td></tr>", "").strip()
  
              event = Event()
  
              time_observation = DateTime().generate_datetime_now()
              event.add('time.observation', time_observation, sanitize=True)
              event.add('time.source', time_source, sanitize=True)
              event.add('classification.type', u'malware')
              event.add('feed.name', report.value("feed.name"))
              event.add('feed.url', report.value("feed.url"))
              event.add('source.ip', ip, sanitize=True)
              event.add('raw', row, sanitize=True)
  
              self.send_message(event)
          self.acknowledge_message()
  
  if __name__ == "__main__":
      bot = MalwareGroupIPsParserBot(sys.argv[1])
      bot.start()
  
new_contents: from intelmq.lib import utils
  from intelmq.lib.bot import Bot, sys
  from intelmq.lib.message import Event
  from intelmq.lib.harmonization import DateTime
  
  
  class MalwareGroupIPsParserBot(Bot):
  
      def process(self):
          report = self.receive_message()
  
          if not report.contains("raw"):
              self.acknowledge_message()
  
          raw_report = utils.base64_decode(report.value("raw"))
  
          raw_report = raw_report.split("<tbody>")[1]
          raw_report = raw_report.split("</tbody>")[0]
          raw_report_splitted = raw_report.split("<tr>")
  
          for row in raw_report_splitted:
              row = row.strip()
  
              if row == "":
                  continue
  
              row_splitted = row.split("<td>")
              ip = row_splitted[1].split('">')[1].split("<")[0].strip()
              time_source = row_splitted[6].replace("</td></tr>", "").strip()
  
              event = Event()
  
              time_observation = DateTime().generate_datetime_now()
              event.add('time.observation', time_observation, sanitize=True)
              event.add('time.source', time_source, sanitize=True)
              event.add('classification.type', u'malware')
              event.add('feed.name', report.value("feed.name"))
              event.add('feed.url', report.value("feed.url"))
              event.add('source.ip', ip, sanitize=True)
              event.add('raw', row, sanitize=True)
  
              self.send_message(event)
          self.acknowledge_message()
  
  if __name__ == "__main__":
      bot = MalwareGroupIPsParserBot(sys.argv[1])
      bot.start()
  
subject: Update parser_ips.py