Update url_analyzer.py

url_analyzer.py

@@ -2,38 +2,25 @@ import requests
 import os
 
 SAFE_BROWSING_API_KEY = os.getenv("SAFE_BROWSING_API_KEY")
+ALIENVAULT_API_KEY = os.getenv("ALIENVAULT_API_KEY")
 
 def analyze_urls(urls):
     findings = []
 
     for url in urls:
-        # --- 1. PhishTank ---
-        try:
-            res = requests.post(
-                "https://checkurl.phishtank.com/checkurl/",
-                data={"url": url, "format": "json"},
-                headers={"Content-Type": "application/x-www-form-urlencoded"}
-            )
-            data = res.json()
-            if data.get("results", {}).get("in_database"):
-                findings.append(f"URL: {url} is flagged as phishing (PhishTank)")
-            else:
-                findings.append(f"URL: {url} not flagged (PhishTank)")
-        except Exception as e:
-            findings.append(f"URL: {url} check failed (PhishTank) - {e}")
 
-        # --- 2. URLHaus ---
+        # --- 1. URLHaus ---
         try:
             res = requests.post("https://urlhaus-api.abuse.ch/v1/url/", data={"url": url})
             data = res.json()
             if data.get("query_status") == "ok":
-                findings.append(f"URL: {url} is flagged as {data['url_status']} (URLHaus)")
+                findings.append(f"URL: {url} flagged as {data['url_status']} (URLHaus)")
             else:
                 findings.append(f"URL: {url} not found in URLHaus")
         except Exception as e:
             findings.append(f"URL: {url} check failed (URLHaus) - {e}")
 
-        # --- 3. Google Safe Browsing ---
+        # --- 2. Google Safe Browsing ---
         if SAFE_BROWSING_API_KEY:
             try:
                 payload = {
@@ -59,4 +46,23 @@ def analyze_urls(urls):
         else:
             findings.append("Google Safe Browsing API key not set.")
 
+        # --- 3. AlienVault OTX ---
+        if ALIENVAULT_API_KEY:
+            try:
+                headers = {"X-OTX-API-KEY": ALIENVAULT_API_KEY}
+                res = requests.get(f"https://otx.alienvault.com/api/v1/indicators/url/{url}/general", headers=headers)
+                if res.status_code == 200:
+                    data = res.json()
+                    pulses = data.get("pulse_info", {}).get("count", 0)
+                    if pulses > 0:
+                        findings.append(f"URL: {url} found in {pulses} AlienVault OTX pulses")
+                    else:
+                        findings.append(f"URL: {url} not flagged in AlienVault OTX")
+                else:
+                    findings.append(f"URL: {url} AlienVault OTX query failed (HTTP {res.status_code})")
+            except Exception as e:
+                findings.append(f"URL: {url} check failed (AlienVault OTX) - {e}")
+        else:
+            findings.append("AlienVault OTX API key not set.")
+
     return findings