#!/usr/bin/env python
# Coded by Vitali
import urllib
import sqlite3
import re

u1 = urllib.urlopen('http://cybercrime-tracker.net/index.php?search=POSCardStealer.O')

data = u1.read().split('/>')

rdate = re.findall(r'<tr><td>([0-9-]{10})</td>', str(data))

url = re.findall(r'latest-scan/http://(.{8,40})/', str(data))

ip = re.findall(r'/ip-address/([0-9\.]{0,20})/information/', str(data))

rtype = []
for i in range(len(url)):
	i = 'POSCardStealer'
	rtype.append(i) 

u2 = urllib.urlopen('http://cybercrime-tracker.net/index.php?search=Dexter')

data = u2.read().split('/>')

ddate = re.findall(r'<tr><td>([0-9-]{10})</td>', str(data))

durl = re.findall(r'latest-scan/http://(.{8,40})/', str(data))

dip = re.findall(r'/ip-address/([0-9\.]{0,20})/information/', str(data))

dtype = []
for i in range(len(durl)):
	i = 'Dexter'
	dtype.append(i)

u3 = urllib.urlopen('http://cybercrime-tracker.net/index.php?s=0&m=100&search=Alina')

data = u3.read().split('/>')

adate = re.findall(r'<tr><td>([0-9-]{10})</td>', str(data))

aurl = re.findall(r'latest-scan/http://(.{8,40})/', str(data))

aip = re.findall(r'/ip-address/([0-9\.]{0,20})/information/', str(data))

atype = []
for i in range(len(aurl)):
	i = 'Alina'
	atype.append(i)

u4 = urllib.urlopen('http://cybercrime-tracker.net/index.php?search=POSmalware')

data = u4.read().split('/>')

pdate = re.findall(r'<tr><td>([0-9-]{10})</td>', str(data))

purl = re.findall(r'latest-scan/http://(.{8,40})/', str(data))

pip = re.findall(r'/ip-address/([0-9\.]{0,20})/information/', str(data))

ptype = []
for i in range(len(purl)):
	i = 'POSMalware'
	ptype.append(i)

u5 = urllib.urlopen('http://cybercrime-tracker.net/index.php?s=0&m=100&search=JackPos')

data = u5.read().split('/>')

jdate = re.findall(r'<tr><td>([0-9-]{10})</td>', str(data))

jurl = re.findall(r'latest-scan/http://(.{8,40})/', str(data))

jip = re.findall(r'/ip-address/([0-9\.]{0,20})/information/', str(data))

jtype = []
for i in range(len(jurl)):
	i = 'JackPOS'
	jtype.append(i)

u6 = urllib.urlopen('http://cybercrime-tracker.net/index.php?search=BlackPOS')

data = u6.read().split('/>')

bdate = re.findall(r'<tr><td>([0-9-]{10})</td>', str(data))

burl = re.findall(r'latest-scan/http://(.{8,40})/', str(data))

bip = re.findall(r'/ip-address/([0-9\.]{0,20})/information/', str(data))

btype = []
for i in range(len(burl)):
	i = 'BlackPOS'
	btype.append(i)


rdate = rdate + ddate + adate + pdate + jdate + bdate
url = url + durl + aurl + purl + jurl + burl
ip = ip + dip + aip + pip + jip + bip
rtype = rtype + dtype + atype + ptype + jtype + btype
 

rsource = []
for i in range(len(url)):
	i = 'CyberCrimeTracker.net'
	rsource.append(i)
zipped = zip(rdate, url, ip, rtype, rsource)

f = open('ips.txt', 'w+')
for i in ip:
	f.write(i+'\n')
f.close()

conn = sqlite3.connect('POSMalwareAdminTracker.sqlite')
cur = conn.cursor()
conn.text_factory = str
# Make some fresh tables using executescript()
cur.executescript('''
DROP TABLE IF EXISTS POSMalwareAdminTracker;
CREATE TABLE POSMalwareAdminTracker (
    id  INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT UNIQUE,
    rdate 	TEXT,
    url     TEXT,
    ip		TEXT,
    rtype	TEXT,
    rsource TEXT
);
''')

for element in zipped:
	rdate = element[0]
	url = element[1]
	ip = element[2]
	rtype = element[3]
	rsource = element[4]

	cur.execute('''INSERT OR IGNORE INTO POSMalwareAdminTracker (rdate, url, ip, rtype, rsource) VALUES ( ?, ?, ?, ?, ? )''', ( rdate, url, ip, rtype, rsource ) )
    #cur.execute('SELECT id FROM Hosts WHERE name = ? ', ( name, ))

conn.commit()