mrtolino / malware-geolocator

A web application designed to visualize information on blacklisted malware domains, including geolocations.

Malware Geolocator

by Shant Simonian

---

Summary:

This is a web application that is meant to visualize a data feed containing information on malicious domains. The data feed used for this application is from Malware Domain List (http://www.malwaredomainlist.com/). This data feed provides several columns of information per malicious domain, one of which is the IP address that is associated with the domain. The application uses an IP lookup API (currently using, https://extreme-ip-lookup.com), in order to retrieve the latitude and longitude coordinates that represent the approximate geo-location of each IP address. The geo-locations are visualized using an embedded Google Map, and the data is visualized in a table underneath the map.

The user is able to search through the data via a search input field, as well as sort the data in ascending or descending order of any of the columns in the data grid. The user may also select/deselect individual rows from the data grid, which will cause the map to show only the selected locations.

Directories:

1. malware_data_geolocations contains the front-end web application
2. api_service contains the back-end api service

Instructions to run the application locally (these instructions assume npm is installed):

1. Install Docker (https://www.docker.com/community-edition).
2. Clone the repository.
3. Open a terminal window and cd into the repository folder.
4. Run the command: ./start.sh (it should take about 20 seconds for all of the dependencies to install).
5. Open your browser and go to http://localhost:8080.

Usage:

Click on a table header to sort the data in order of the data in that column - click once to sort in ascending order, click again on a selected header to sort in descending order. Clicking on the same header will toggle between ascending and descending order of the data in that column.

Type in the search bar to search the data. The data is automatically searched across all data columns, and the search is case insensitive.

Click on a page to show a new page of data.

The map is automatically updated with the geolocations associated with the IP addresses shown in the data grid.
Click on a marker on the map to show an info window containing location info.
Click on rows in the data grid to select those rows - the map will be updated to show only the selected rows.
Click again on a selected row to de-select it.

Technologies used in building the application:

Front-end application: React, Apollo Client
Back-end API service: Node/Express, GraphQL, Sequelize
Database: Postgres
Docker used for containerization of API and database
Jest and Enzyme used for unit testing and integration testing
ESLint (with AirBnb config) used for linting front-end code
Travis CI used for continuous integration and build testing