source_search.py

import requests
import re
from colorama import init, Fore

init()


def check_domain_in_blocklist(source_url, target_domain):
    try:
        response = requests.get(source_url)
        response.raise_for_status()

        lines = [
            line.strip()
            for line in response.text.split("\n")
            if line.strip() and not line.startswith(("#", "!"))
        ]

        pattern = rf"(?:^|\s|\.|\|){re.escape(target_domain)}(?:\^|\#|\!|\s|$)"
        matches = [re.search(pattern, line, flags=re.MULTILINE) for line in lines]
        return any(matches)

    except requests.exceptions.RequestException as e:
        print(f"Error checking {source_url}: {e}")
        return False


def find_blocking_blocklists(
    target_domain, tick_sources, std_sources, cross_sources, search_sources
):
    blocking_tick_blocklists = {category: [] for category in tick_sources}
    blocking_std_blocklists = {category: [] for category in std_sources}
    blocking_cross_blocklists = {category: [] for category in cross_sources}

    if search_sources in ("t", "tick", "tick sources", "a", "all", "all sources"):
        for category, sources in tick_sources.items():
            for name, source in sources.items():
                if check_domain_in_blocklist(source, target_domain):
                    blocking_tick_blocklists[category].append(name)

    if search_sources in ("s", "std", "std sources", "a", "all", "all sources"):
        for category, sources in std_sources.items():
            for name, source in sources.items():
                if check_domain_in_blocklist(source, target_domain):
                    blocking_std_blocklists[category].append(name)

    if search_sources in ("c", "cross", "cross sources", "a", "all", "all sources"):
        for category, sources in cross_sources.items():
            for name, source in sources.items():
                if check_domain_in_blocklist(source, target_domain):
                    blocking_cross_blocklists[category].append(name)

    if any(blocking_tick_blocklists.values()):
        print(
            Fore.GREEN
            + f"Domain '{target_domain}' found in the following Tick sources:\n"
        )
        for category, blocklists in blocking_tick_blocklists.items():
            if blocklists:
                print(Fore.RESET + f"{category}:\n")
                for blocklist in blocklists:
                    print(Fore.GREEN + f" - {blocklist}\n")

    if any(blocking_std_blocklists.values()):
        print(
            Fore.BLUE
            + f"Domain '{target_domain}' found in the following Std sources:\n"
        )
        for category, blocklists in blocking_std_blocklists.items():
            if blocklists:
                print(Fore.RESET + f"{category}:\n")
                for blocklist in blocklists:
                    print(Fore.BLUE + f" - {blocklist}\n")

    if any(blocking_cross_blocklists.values()):
        print(
            Fore.CYAN
            + f"Domain '{target_domain}' found in the following Cross sources:\n"
        )
        for category, blocklists in blocking_cross_blocklists.items():
            if blocklists:
                print(Fore.RESET + f"{category}:\n")
                for blocklist in blocklists:
                    print(Fore.CYAN + f" - {blocklist}\n")

    if (
        not any(blocking_tick_blocklists.values())
        and not any(blocking_std_blocklists.values())
        and not any(blocking_cross_blocklists.values())
    ):
        print(Fore.RED + f"Domain '{target_domain}' not found in any sources.\n")

    print(Fore.RESET, end="")


if __name__ == "__main__":
    tick_blocklist_sources = {
        "Suspicious": {
            "Add.Spam": "https://raw.githubusercontent.com/FadeMind/hosts.extras/master/add.Spam/hosts",
            "KADhosts": "https://raw.githubusercontent.com/FiltersHeroes/KADhosts/master/KADomains.txt",
            "WaLLy3K List": "https://v.firebog.net/hosts/static/w3kbl.txt",
        },
        "Advertising": {
            "Adaway": "https://adaway.org/hosts.txt",
            "Adguard DNS Filter": "https://v.firebog.net/hosts/AdguardDNS.txt",
            "anudeepND List": "https://raw.githubusercontent.com/anudeepND/blacklist/master/adservers.txt",
            "Easylist": "https://v.firebog.net/hosts/Easylist.txt",
            "GetAdmiral Domains": "https://raw.githubusercontent.com/LanikSJ/ubo-filters/main/filters/getadmiral-domains.txt",
            "hostsVN": "https://raw.githubusercontent.com/bigdargon/hostsVN/master/hosts",
            "Peter Lowe List": "https://pgl.yoyo.org/adservers/serverlist.php?hostformat=adblockplus&showintro=1&mimetype=plaintext",
            "Unchecky": "https://raw.githubusercontent.com/FadeMind/hosts.extras/master/UncheckyAds/hosts",
        },
        "Tracking": {
            "Add.2o7Net": "https://raw.githubusercontent.com/FadeMind/hosts.extras/master/add.2o7Net/hosts",
            "Easyprivacy": "https://v.firebog.net/hosts/Easyprivacy.txt",
            "Geoffrey Frogeye First-Party Trackers": "https://hostfiles.frogeye.fr/firstparty-trackers-hosts.txt",
            "UT Capitole Publicite": "https://v.firebog.net/hosts/Prigent-Ads.txt",
            "Windows Spy List": "https://raw.githubusercontent.com/crazy-max/WindowsSpyBlocker/master/data/hosts/spy.txt",
        },
        "Malicious": {
            "Add.Risk": "https://raw.githubusercontent.com/FadeMind/hosts.extras/master/add.Risk/hosts",
            "CyberHost.uk": "https://lists.cyberhost.uk/malware.txt",
            "DandelionSprout AntiMalware": "https://raw.githubusercontent.com/DandelionSprout/adfilt/master/Alternate%20versions%20Anti-Malware%20List/AntiMalwareHosts.txt",
            "Mandiant APT1 Report": "https://bitbucket.org/ethanr/dns-blacklists/raw/8575c9f96e5b4a1308f2f12394abd86d0927a4a0/bad_lists/Mandiant_APT1_Report_Appendix_D.txt",
            "Phishing Army": "https://phishing.army/download/phishing_army_blocklist_extended.txt",
            "UT Capitole Crypto": "https://v.firebog.net/hosts/Prigent-Crypto.txt",
            "Quidsup Malware": "https://gitlab.com/quidsup/notrack-blocklists/-/raw/master/malware.hosts",
            "RPiList Malware": "https://raw.githubusercontent.com/RPiList/specials/master/Blocklisten/malware",
            "RPiList Phishing": "https://raw.githubusercontent.com/RPiList/specials/master/Blocklisten/Phishing-Angriffe",
            "Spam404": "https://raw.githubusercontent.com/Spam404/lists/master/main-blacklist.txt",
            "Stalkerware Indicators": "https://raw.githubusercontent.com/AssoEchap/stalkerware-indicators/master/generated/hosts_full",
            "URLHaus": "https://urlhaus.abuse.ch/downloads/hostfile/",
            "URLHaus Extended": "https://malware-filter.gitlab.io/malware-filter/urlhaus-filter-hosts.txt",
        },
    }

    std_blocklist_sources = {
        "Suspicious": {
            "BarbBlock": "https://raw.githubusercontent.com/paulgb/BarbBlock/main/blocklists/ublock-origin.txt",
            "Dan Pollock Hosts": "https://someonewhocares.org/hosts/zero/hosts",
            "MVPS Hosts": "https://winhelp2002.mvps.org/hosts.txt",
            "neoFelhz neoHosts": "https://v.firebog.net/hosts/neohostsbasic.txt",
            "Referrer Spam": "https://raw.githubusercontent.com/matomo-org/referrer-spam-blacklist/master/spammers.txt",
            "RooneyMcNibNug SNAFU": "https://raw.githubusercontent.com/RooneyMcNibNug/pihole-stuff/master/SNAFU.txt",
            "VeleSila Hosts": "https://raw.githubusercontent.com/VeleSila/yhosts/master/hosts",
        },
        "Tracking": {
            "Geoffrey Frogeye Multi-Party Trackers": "https://hostfiles.frogeye.fr/multiparty-trackers-hosts.txt",
            "Perflyst Android Trackers": "https://raw.githubusercontent.com/Perflyst/PiHoleBlocklist/master/android-tracking.txt",
            "Perflyst SmartTV Domains": "https://raw.githubusercontent.com/Perflyst/PiHoleBlocklist/master/SmartTV.txt",
            "Perflyst Amazon FireTV Domains": "https://raw.githubusercontent.com/Perflyst/PiHoleBlocklist/master/AmazonFireTV.txt",
            "Quidsup Tracker": "https://gitlab.com/quidsup/notrack-blocklists/-/raw/master/trackers.hosts",
        },
        "Malicious": {
            "Jarelllama Scam Blocklist": "https://raw.githubusercontent.com/jarelllama/Scam-Blocklist/main/lists/wildcard_domains/scams.txt",
            "Phishing Blocklist": "https://malware-filter.gitlab.io/malware-filter/phishing-filter-agh.txt",
            "UT Capitole Malware": "https://v.firebog.net/hosts/Prigent-Malware.txt",
        },
        "Misc/Other": {
            "Porn List": "https://raw.githubusercontent.com/jarelllama/Scam-Blocklist/main/lists/adblock/nsfw.txt",
        },
    }

    cross_blocklist_sources = {
        "Tracking": {
            "Developer Dan Ads-Tracking": "https://www.github.developerdan.com/hosts/lists/ads-and-tracking-extended.txt",
            "Kees1958 Top Ads-Trackers": "https://raw.githubusercontent.com/Kees1958/W3C_annual_most_used_survey_blocklist/master/EU_US_MV3_most_common_ad%2Btracking_networks.txt",
        },
    }

    while True:
        target_domain = input("Enter a domain to find (or type 'exit' to close): ")

        if target_domain.lower() == "exit":
            print("Exiting the script.")
            break

        if (
            "." not in target_domain
            or target_domain.startswith(".")
            or target_domain.endswith(".")
            or ".." in target_domain
        ):
            print(Fore.YELLOW + "Invalid domain")
            print(Fore.RESET, end="")
            continue

        while True:
            search_option = input(
                "Search in (t)ick, (s)td, (c)ross, (a)ll sources, (r)eset, or (e)xit: "
            ).lower()

            if search_option == "r" or search_option == "reset":
                break
            elif search_option in (
                "t",
                "tick",
                "tick sources",
                "s",
                "std",
                "std sources",
                "c",
                "cross",
                "cross sources",
                "a",
                "all",
                "all sources",
            ):
                find_blocking_blocklists(
                    target_domain,
                    tick_blocklist_sources,
                    std_blocklist_sources,
                    cross_blocklist_sources,
                    search_option,
                )
                break
            elif search_option == "e" or search_option == "exit":
                print("Exiting the script.")
                exit()
            else:
                print(
                    Fore.YELLOW
                    + "Invalid. Please enter 't', 's', 'c', 'a', 'r', or 'e'."
                )
                print(Fore.RESET, end="")