Integrate with WAYSCloud IP Intelligence

Reporter Types and Trust Scores:

Before Verification:
  - Automated (fail2ban, IDS):  0.4
  - Hybrid (semi-automated):    0.6
  - Manual (human verified):    0.8

After Domain Verification:
  - ALL verified reporters:     1.0 (maximum trust)

Example Impact:
  Unverified report: IP gets +4 points  (0.4 × 10)
  Verified report:   IP gets +10 points (1.0 × 10)

Verified reports have 2.5x more impact on threat scoring!

// Node.js / Express - Registration endpoint with IP check
app.post('/api/register', async (req, res) => {
    const userIP = req.headers['x-forwarded-for']?.split(',')[0] || req.ip;

    try {
        // Check IP reputation with WAYSCloud
        const response = await fetch(
            `https://api.ip.wayscloud.services/api/search/${userIP}`
        );
        const ipData = await response.json();

        const abuseScore = ipData.intelligence_data?.abuse_score || 0;
        const totalReports = ipData.intelligence_data?.total_reports || 0;

        // Risk-based decision
        if (abuseScore >= 8.0) {
            // High risk - block immediately
            return res.status(403).json({
                error: "Registration denied",
                reason: "High-risk IP address detected"
            });
        } else if (abuseScore >= 5.0 || totalReports > 10) {
            // Medium risk - require additional verification
            return res.json({
                status: "verification_required",
                message: "Please complete email verification",
                verification_type: "email_and_phone"
            });
        }

        // Low risk - proceed normally
        // ... your registration logic here ...

        res.json({
            status: "success",
            message: "Account created successfully"
        });

    } catch (error) {
        console.error("IP check failed:", error);
        // Fail open - don't block registration on API errors
        // ... proceed with normal registration ...
    }
});

/* Example response from WAYSCloud:
{
  "ip": "185.220.101.45",
  "intelligence_data": {
    "total_reports": 142,
    "abuse_score": 8.5,
    "threat_level": "high",
    "categories": ["ssh_bruteforce", "port_scan"],
    "first_seen": "2025-09-10T08:00:00Z",
    "last_seen": "2025-10-16T04:00:00Z"
  }
}
*/

#!/usr/bin/env python3
"""
Monitor your infrastructure IPs for abuse reports.
Run this script via cron every hour to get alerts.
"""
import requests
import json
from datetime import datetime

# Your server IPs to monitor
SERVER_IPS = [
    "203.0.113.10",  # Web server
    "203.0.113.11",  # Mail server
    "203.0.113.12",  # API server
]

# Slack webhook for alerts (optional)
SLACK_WEBHOOK = "https://hooks.slack.com/services/YOUR/WEBHOOK/URL"

def check_ip_reputation(ip):
    """Check IP reputation with WAYSCloud"""
    url = f"https://api.ip.wayscloud.services/api/search/{ip}"
    response = requests.get(url, timeout=10)
    return response.json()

def send_slack_alert(message):
    """Send alert to Slack"""
    if SLACK_WEBHOOK:
        requests.post(SLACK_WEBHOOK, json={"text": message})

def main():
    print(f"IP Reputation Monitor - {datetime.now()}")
    print("=" * 60)

    alerts = []

    for ip in SERVER_IPS:
        data = check_ip_reputation(ip)
        intel = data.get('intelligence_data', {})

        if not intel:
            print(f"\n{ip}: Clean (no reports)")
            continue

        reports = intel.get('total_reports', 0)
        abuse_score = intel.get('abuse_score', 0)
        threat_level = intel.get('threat_level', 'low')

        print(f"\n{ip}")
        print(f"   Reports: {reports}")
        print(f"   Abuse Score: {abuse_score}/10")
        print(f"   Threat Level: {threat_level}")

        # Alert on any reports
        if reports > 0:
            categories = intel.get('categories', [])
            alert = (
                f"IP REPUTATION ALERT!\n"
                f"IP: {ip}\n"
                f"Reports: {reports}\n"
                f"Abuse Score: {abuse_score}/10\n"
                f"Threat Level: {threat_level}\n"
                f"Categories: {', '.join(categories)}\n"
                f"Action: Investigate immediately!"
            )
            alerts.append(alert)
            print(f"   ALERT: {reports} abuse reports found!")

    # Send consolidated alert
    if alerts:
        send_slack_alert("\n\n".join(alerts))
        print("\nAlerts sent to Slack!")
    else:
        print("\nAll IPs clean - no abuse reports")

if __name__ == "__main__":
    main()

# Add to crontab for hourly monitoring:
# 0 * * * * /usr/local/bin/monitor-ip-reputation.py >> /var/log/ip-monitor.log 2>&1

# nginx configuration with threat intelligence blocking

# 1. Create blocking script at /usr/local/bin/check-ip-threat
# ===================================================
#!/bin/bash
# Returns exit code 0 for clean IPs, 1 for threats

IP="$1"
THRESHOLD=${2:-7}  # Risk score threshold

# Query WAYSCloud API
RESPONSE=$(curl -4 -s "https://api.ip.wayscloud.services/api/search/$IP")
RISK_SCORE=$(echo "$RESPONSE" | jq -r '.intelligence_data.abuse_score // 0')

# Block if risk score exceeds threshold
if [ "$RISK_SCORE" -ge "$THRESHOLD" ]; then
    echo "BLOCKED: Risk score $RISK_SCORE" >&2
    exit 1
fi

exit 0

# 2. Make it executable
# chmod +x /usr/local/bin/check-ip-threat

# 3. nginx configuration
# ===================================================
# In your server block:

server {
    listen 80;
    server_name example.com;

    # Protect login and admin pages
    location ~ ^/(login|admin|wp-admin) {
        # Check IP threat level
        access_by_lua_block {
            local ip = ngx.var.remote_addr
            local handle = io.popen("/usr/local/bin/check-ip-threat " .. ip .. " 70")
            local exit_code = handle:close()

            if exit_code ~= 0 then
                ngx.status = 403
                ngx.say("Access denied - High risk IP")
                ngx.exit(403)
            end
        }

        proxy_pass http://backend;
    }

    # Normal pages - no blocking
    location / {
        proxy_pass http://backend;
    }
}

# Result: High-risk IPs get 403 Forbidden before reaching your app!

#!/usr/bin/env python3
"""
Enrich security logs with WAYSCloud threat intelligence.
Reads logs, enriches IPs, outputs enriched JSON for SIEM ingestion.
"""
import requests
import json
import re
from datetime import datetime

def enrich_ip(ip):
    """Get full IP intelligence from WAYSCloud"""
    try:
        response = requests.get(
            f"https://api.ip.wayscloud.services/api/search/{ip}",
            timeout=5
        )
        return response.json()
    except Exception as e:
        print(f"Error enriching {ip}: {e}")
        return None

def parse_log_line(line):
    """Extract IP from common log formats"""
    # Apache/nginx combined log format
    match = re.match(r'^(\S+)', line)
    if match:
        return match.group(1)
    return None

def enrich_log_file(input_file, output_file):
    """Enrich all IPs in log file"""
    seen_ips = set()
    ip_cache = {}

    with open(input_file, 'r') as infile, \
         open(output_file, 'w') as outfile:

        for line_num, line in enumerate(infile, 1):
            ip = parse_log_line(line)

            if not ip or ip in ['127.0.0.1', '::1']:
                continue

            # Cache lookups
            if ip not in ip_cache:
                ip_cache[ip] = enrich_ip(ip)
                seen_ips.add(ip)

            intel = ip_cache[ip]
            if not intel:
                continue

            # Create enriched log entry
            enriched = {
                'timestamp': datetime.now().isoformat(),
                'line_number': line_num,
                'ip': ip,
                'country': intel.get('country'),
                'city': intel.get('city'),
                'isp': intel.get('isp'),
                'asn': intel.get('asn'),
                'threat': {
                    'reports': intel.get('intelligence_data', {}).get('total_reports', 0),
                    'abuse_score': intel.get('intelligence_data', {}).get('abuse_score', 0),
                    'severity': intel.get('intelligence_data', {}).get('threat_level', 'low'),
                    'categories': intel.get('intelligence_data', {}).get('categories', [])
                },
                'original_log': line.strip()
            }

            # Write enriched JSON (one per line for easy SIEM ingestion)
            outfile.write(json.dumps(enriched) + '\n')

            # Alert on threats
            if enriched['threat']['reports'] > 0:
                print(f"Line {line_num}: Threat detected from {ip}")
                print(f"   {enriched['threat']['reports']} reports, "
                      f"risk score {enriched['threat']['abuse_score']}")

    print(f"\nProcessed {len(seen_ips)} unique IPs")
    print(f"Enriched logs written to {output_file}")

# Usage:
# enrich_log_file('/var/log/nginx/access.log', '/var/log/enriched/access.json')

# Example enriched output:
"""
{
  "timestamp": "2025-10-15T10:30:00",
  "line_number": 1234,
  "ip": "185.220.101.45",
  "country": "Germany",
  "city": "Frankfurt",
  "isp": "Hetzner Online GmbH",
  "asn": "AS24940",
  "threat": {
    "reports": 142,
    "abuse_score": 85,
    "severity": "high",
    "categories": ["ssh_bruteforce", "port_scan"]
  },
  "original_log": "185.220.101.45 - - [15/Oct/2025:10:30:00] ..."
}
"""

#!/usr/bin/env python3
"""
Bulk IP analysis tool.
Reads IPs from file, checks each against WAYSCloud, generates report.
"""
import requests
import csv
from collections import defaultdict
from datetime import datetime

def analyze_ip_list(ip_file, output_csv):
    """Analyze list of IPs and generate security report"""

    stats = {
        'total': 0,
        'clean': 0,
        'low_risk': 0,
        'medium_risk': 0,
        'high_risk': 0,
        'critical': 0
    }

    countries = defaultdict(int)
    threats_by_category = defaultdict(int)
    results = []

    with open(ip_file, 'r') as f:
        ips = [line.strip() for line in f if line.strip()]

    print(f"Analyzing {len(ips)} IP addresses...")

    for ip in ips:
        stats['total'] += 1

        # Query WAYSCloud
        response = requests.get(
            f"https://api.ip.wayscloud.services/api/search/{ip}",
            timeout=10
        )
        data = response.json()

        threat = data.get('intelligence_data', {})
        abuse_score = threat.get('abuse_score', 0)

        # Classify risk (0-10 scale)
        if abuse_score == 0:
            risk_level = 'clean'
            stats['clean'] += 1
        elif abuse_score < 4.0:
            risk_level = 'low'
            stats['low_risk'] += 1
        elif abuse_score < 6.0:
            risk_level = 'medium'
            stats['medium_risk'] += 1
        elif abuse_score < 8.0:
            risk_level = 'high'
            stats['high_risk'] += 1
        else:
            risk_level = 'critical'
            stats['critical'] += 1

        # Track countries and categories
        country = data.get('country', 'Unknown')
        countries[country] += 1

        for category in threat.get('categories', []):
            threats_by_category[category] += 1

        # Store result
        results.append({
            'ip': ip,
            'country': country,
            'isp': data.get('isp', 'Unknown'),
            'risk_level': risk_level,
            'abuse_score': abuse_score,
            'reports': threat.get('total_reports', 0),
            'categories': ', '.join(threat.get('categories', []))
        })

    # Write CSV report
    with open(output_csv, 'w', newline='') as csvfile:
        fieldnames = ['ip', 'country', 'isp', 'risk_level',
                     'abuse_score', 'reports', 'categories']
        writer = csv.DictWriter(csvfile, fieldnames=fieldnames)

        writer.writeheader()
        for result in results:
            writer.writerow(result)

    # Print summary report
    print("\n" + "="*60)
    print("SECURITY ANALYSIS REPORT")
    print("="*60)
    print(f"\nTotal IPs Analyzed: {stats['total']}")
    print(f"\nRisk Distribution:")
    print(f"  Clean:    {stats['clean']:4d} ({stats['clean']/stats['total']*100:.1f}%)")
    print(f"  Low:      {stats['low_risk']:4d} ({stats['low_risk']/stats['total']*100:.1f}%)")
    print(f"  Medium:   {stats['medium_risk']:4d} ({stats['medium_risk']/stats['total']*100:.1f}%)")
    print(f"  High:     {stats['high_risk']:4d} ({stats['high_risk']/stats['total']*100:.1f}%)")
    print(f"  Critical: {stats['critical']:4d} ({stats['critical']/stats['total']*100:.1f}%)")

    print(f"\nTop 5 Countries:")
    for country, count in sorted(countries.items(),
                                 key=lambda x: x[1],
                                 reverse=True)[:5]:
        print(f"  {country}: {count}")

    print(f"\nTop Threat Categories:")
    for category, count in sorted(threats_by_category.items(),
                                  key=lambda x: x[1],
                                  reverse=True)[:5]:
        print(f"  {category}: {count}")

    print(f"\nDetailed report saved to: {output_csv}")

# Usage:
# analyze_ip_list('ips.txt', 'security_report.csv')

# Get your IP
curl https://ip.wayscloud.services/ip

# Get IP details (JSON)
curl https://api.ip.wayscloud.services/api/search/8.8.8.8

# Get geolocation
curl https://ip.wayscloud.services/geo/1.1.1.1

# Get country code
curl https://ip.wayscloud.services/country/8.8.8.8

# Search IP for threats
curl https://ip.wayscloud.services/api/search/192.0.2.1

# Get live threat feed
curl https://ip.wayscloud.services/api/threats/live?time_range=1h

#!/bin/bash
# Quick IP lookup script

ip="${1:-$(curl -4 -s https://ip.wayscloud.services/ip)}"
curl -4 -s "https://api.ip.wayscloud.services/api/search/$ip" | jq .

import requests

class WAYSCloudClient:
    def __init__(self, api_token=None):
        self.base_url = "https://ip.wayscloud.services"
        self.api_token = api_token

    def lookup_ip(self, ip):
        response = requests.get(f"{self.base_url}/json/{ip}")
        return response.json()

    def report_threat(self, ip, category, comment="", severity="medium"):
        headers = {"Authorization": f"Bearer {self.api_token}"}
        data = {
            "ip": ip,
            "category": category,
            "comment": comment,
            "severity": severity,
            "confidence": 0.9
        }
        response = requests.post(f"{self.base_url}/report",
                                headers=headers, json=data)
        return response.json()

# Usage
client = WAYSCloudClient(api_token="wayscloud_...")
info = client.lookup_ip("8.8.8.8")
print(f"Country: {info['country']}")
print(f"Abuse Score: {info['intelligence_data']['abuse_score']}")

const axios = require('axios');

// Express middleware to check visitor IPs
async function checkThreatIntel(req, res, next) {
    const ip = req.headers['x-forwarded-for']?.split(',')[0] || req.ip;

    try {
        const response = await axios.get(
            `https://api.ip.wayscloud.services/api/search/${ip}`
        );

        const riskScore = response.data.intelligence_data?.abuse_score || 0;

        if (riskScore > 7.0) {
            return res.status(403).json({
                error: "Access denied - High risk IP"
            });
        }

        req.threatIntel = response.data.intelligence_data;
        next();
    } catch (error) {
        console.error("Threat check failed:", error);
        next(); // Continue on error
    }
}

// Usage in Express
app.use(checkThreatIntel);
app.get('/api/secure', (req, res) => {
    res.json({ threat: req.threatIntel });
});

# Use nginx auth_request module
location /api/ {
    auth_request /threat-check;
    # ... your config
}

location = /threat-check {
    internal;
    proxy_pass https://api.ip.wayscloud.services/api/search/$remote_addr;
    proxy_pass_request_body off;
    proxy_set_header Content-Length "";
}