From 42d786b0a25495908b4865be2279bbd5de5e31ac Mon Sep 17 00:00:00 2001
From: zwitschi <zwitschi82@gmail.com>
Date: Mon, 3 Aug 2026 16:39:11 +0200
Subject: [PATCH] Move WHOIS cache to data directory and update .gitignore to
 ignore report directories

---
 .gitignore                         |  4 ++--
 data/README.md                     |  1 +
 {reports => data}/whois_cache.json |  0
 utils.py                           | 17 +++++++++--------
 4 files changed, 12 insertions(+), 10 deletions(-)
 rename {reports => data}/whois_cache.json (100%)

diff --git a/.gitignore b/.gitignore
index 7aa6b66..7b0dff5 100644
--- a/.gitignore
+++ b/.gitignore
@@ -10,5 +10,5 @@ __pycache__/
 # reports data
 reports/copyparty/data/
 reports/npm/data/
-reports/copyparty/**/*.txt
-reports/npm/**/*.txt
\ No newline at end of file
+reports/copyparty/
+reports/npm/
\ No newline at end of file
diff --git a/data/README.md b/data/README.md
index 56a1108..41da502 100644
--- a/data/README.md
+++ b/data/README.md
@@ -4,6 +4,7 @@ This directory contains data files used by the `allucanget-ids` Intrusion Detect
 
 ## Data files
 
+- [whois cache](./whois_cache.json): Local cache of WHOIS queries to reduce network requests and improve performance. The cache is automatically updated when new IP addresses are queried.
 - [Openfactory Geofeed](./openfactory/geofeed.csv): Contains Openfactory IP addresses and associated geolocation data from `https://openfactory.net/geofeed.csv`. Used for identifying and whitelisting traffic from known Openfactory sources.
 - [Cloudflare IPv4 list](./cloudflare/ips-v4.txt): Contains a list of Cloudflare IPv4 addresses from `https://www.cloudflare.com/ips-v4`, used for whitelisting traffic from Cloudflare services.
 - [Cloudflare IPv6 list](./cloudflare/ips-v6.txt): Contains a list of Cloudflare IPv6 addresses from `https://www.cloudflare.com/ips-v6`, used for whitelisting traffic from Cloudflare services.
diff --git a/reports/whois_cache.json b/data/whois_cache.json
similarity index 100%
rename from reports/whois_cache.json
rename to data/whois_cache.json
diff --git a/utils.py b/utils.py
index 9e37bb3..fc4895e 100644
--- a/utils.py
+++ b/utils.py
@@ -13,6 +13,12 @@ MikroTik RouterOS export -- lives in this module.
 """
 
 from __future__ import annotations
+import bad_patterns
+from whitelists import (
+    WHITELISTS,
+    WHITELIST_NETS as _WHITELIST_NETS,
+    refresh_whitelists,
+)
 
 import argparse
 import csv
@@ -33,14 +39,8 @@ from typing import Any, Callable, Iterable, Iterator, Sequence
 ANSI_RE = re.compile(r"\x1b\[[0-9;]*m")
 
 # Whitelists (imported from dedicated module)
-from whitelists import (
-    WHITELISTS,
-    WHITELIST_NETS as _WHITELIST_NETS,
-    refresh_whitelists,
-)
 
 # Malicious pattern detection
-import bad_patterns
 
 #: (header, getter) pair used for CSV + console tables
 Column = tuple[str, Callable[[Any], Any]]
@@ -95,7 +95,7 @@ def is_whitelisted(value: str) -> bool:
 
 # WHOIS Cache file path
 WHOIS_CACHE_PATH = os.path.join(
-    os.path.dirname(os.path.abspath(__file__)), "reports", "whois_cache.json"
+    os.path.dirname(os.path.abspath(__file__)), "data", "whois_cache.json"
 )
 
 _whois_cache: dict[str, str] = {}
@@ -365,7 +365,8 @@ def aggregate(requests: Iterable[Request]) -> dict[str, IPStats]:
         if r.path and bad_patterns.is_malicious(r.path):
             s.malicious_hits += 1
             for p in bad_patterns.classify_path(r.path):
-                s.malicious_patterns[p.name] = s.malicious_patterns.get(p.name, 0) + 1
+                s.malicious_patterns[p.name] = s.malicious_patterns.get(
+                    p.name, 0) + 1
     return stats