Move WHOIS cache to data directory and update .gitignore to ignore report directories

.gitignore

@@ -10,5 +10,5 @@ __pycache__/
 # reports data
 reports/copyparty/data/
 reports/npm/data/
-reports/copyparty/**/*.txt
-reports/npm/**/*.txt
+reports/copyparty/
+reports/npm/

data/README.md

@@ -4,6 +4,7 @@ This directory contains data files used by the `allucanget-ids` Intrusion Detect
 
 ## Data files
 
+- [whois cache](./whois_cache.json): Local cache of WHOIS queries to reduce network requests and improve performance. The cache is automatically updated when new IP addresses are queried.
 - [Openfactory Geofeed](./openfactory/geofeed.csv): Contains Openfactory IP addresses and associated geolocation data from `https://openfactory.net/geofeed.csv`. Used for identifying and whitelisting traffic from known Openfactory sources.
 - [Cloudflare IPv4 list](./cloudflare/ips-v4.txt): Contains a list of Cloudflare IPv4 addresses from `https://www.cloudflare.com/ips-v4`, used for whitelisting traffic from Cloudflare services.
 - [Cloudflare IPv6 list](./cloudflare/ips-v6.txt): Contains a list of Cloudflare IPv6 addresses from `https://www.cloudflare.com/ips-v6`, used for whitelisting traffic from Cloudflare services.

utils.py

@@ -13,6 +13,12 @@ MikroTik RouterOS export -- lives in this module.
 """
 
 from __future__ import annotations
+import bad_patterns
+from whitelists import (
+    WHITELISTS,
+    WHITELIST_NETS as _WHITELIST_NETS,
+    refresh_whitelists,
+)
 
 import argparse
 import csv
@@ -33,14 +39,8 @@ from typing import Any, Callable, Iterable, Iterator, Sequence
 ANSI_RE = re.compile(r"\x1b\[[0-9;]*m")
 
 # Whitelists (imported from dedicated module)
-from whitelists import (
-    WHITELISTS,
-    WHITELIST_NETS as _WHITELIST_NETS,
-    refresh_whitelists,
-)
 
 # Malicious pattern detection
-import bad_patterns
 
 #: (header, getter) pair used for CSV + console tables
 Column = tuple[str, Callable[[Any], Any]]
@@ -95,7 +95,7 @@ def is_whitelisted(value: str) -> bool:
 
 # WHOIS Cache file path
 WHOIS_CACHE_PATH = os.path.join(
-    os.path.dirname(os.path.abspath(__file__)), "reports", "whois_cache.json"
+    os.path.dirname(os.path.abspath(__file__)), "data", "whois_cache.json"
 )
 
 _whois_cache: dict[str, str] = {}
@@ -365,7 +365,8 @@ def aggregate(requests: Iterable[Request]) -> dict[str, IPStats]:
         if r.path and bad_patterns.is_malicious(r.path):
             s.malicious_hits += 1
             for p in bad_patterns.classify_path(r.path):
-                s.malicious_patterns[p.name] = s.malicious_patterns.get(p.name, 0) + 1
+                s.malicious_patterns[p.name] = s.malicious_patterns.get(
+                    p.name, 0) + 1
     return stats