Monitor incautados

import sys
import os
import time
import json
import hashlib
import random
import re
from datetime import datetime
from pathlib import Path
import dns.resolver
import requests
from rich.console import Console
from rich.padding import Padding

console = Console()


TELEGRAM_BOT_TOKEN = "1452668850:AXX5sfsTdoYUaPM7bwwePGFbh6rpSmPW_oYRA"  # Reemplaza con tu token
TELEGRAM_CHAT_ID = "2045147000"      # Reemplaza con tu chat ID

DOMAINS = [
    "breachforums.ac",
    "darkforums.ac",
    "breachforums.hn",
]

SCAN_INTERVAL = 60
SILENT_CYCLES = 1
DNS_RECORDS = ["A", "AAAA", "NS", "MX", "TXT"]
DNS_SEIZURE_KEYWORDS = [

"fbi",
"doj",
"hsi",
"ice",
"usms",
"seized",
"europol",
"interpol",
"nca",
"ec3",
"eurojust",
"bundeskriminalamt",
"bka.de",
"police",
"cybercrime",
"law-enforcement"

]

STATE_FILE = Path("monitor_state.json")
SCREENSHOT_DIR = Path("screenshots")
SCREENSHOT_DIR.mkdir(exist_ok=True)

USER_AGENTS = [
    "Mozilla/5.0 (Windows NT 10.0; Win64; x64)",
    "Mozilla/5.0 (X11; Linux x86_64)",
]


def send_telegram(text, photo=None):
    try:
        if photo:
            with open(photo, 'rb') as f:
                requests.post(
                    f"https://api.telegram.org/bot{TELEGRAM_BOT_TOKEN}/sendPhoto",
                    data={"chat_id": TELEGRAM_CHAT_ID, "caption": text[:1000]},
                    files={"photo": f},
                    timeout=15
                )
        else:
            requests.post(
                f"https://api.telegram.org/bot{TELEGRAM_BOT_TOKEN}/sendMessage",
                json={"chat_id": TELEGRAM_CHAT_ID, "text": text[:4000]},
                timeout=10
            )
    except Exception as e:
        console.print(f"[red]Error Telegram: {e}[/red]")


def take_screenshot(domain):
    try:
        from playwright.sync_api import sync_playwright

        safe_name = re.sub(r'[^a-zA-Z0-9]', '_', domain)
        path = SCREENSHOT_DIR / f"{safe_name}_{int(time.time())}.png"

        with sync_playwright() as p:
            browser = p.chromium.launch(headless=True)
            page = browser.new_page()

            try:
                page.goto(f"https://{domain}", timeout=15000)
            except:
                page.goto(f"http://{domain}", timeout=15000)

            page.wait_for_timeout(2000)
            page.screenshot(path=str(path))
            browser.close()
            return path

    except Exception as e:
        console.print(f"[red]Error screenshot: {e}[/red]")
        return None


def check_dns(domain):
    results = {}
    for rtype in DNS_RECORDS:
        try:
            answers = dns.resolver.resolve(domain, rtype, lifetime=5)
            results[rtype] = sorted([r.to_text() for r in answers])
        except:
            results[rtype] = []
    return results


def check_http(domain):
    headers = {"User-Agent": random.choice(USER_AGENTS)}

    for scheme in ["https", "http"]:
        try:
            r = requests.get(
                f"{scheme}://{domain}",
                timeout=10,
                headers=headers,
                allow_redirects=True,
                stream=True
            )

            content = b""
            for chunk in r.iter_content(10240):
                content += chunk
                if len(content) > 50000:
                    break

            text = content.decode('utf-8', errors='ignore').lower()
            keywords = [kw for kw in DNS_SEIZURE_KEYWORDS if kw in text]

            title = None
            match = re.search(r'<title>(.*?)</title>', text, re.I)
            if match:
                title = match.group(1)

            return {
                "status": r.status_code,
                "server": r.headers.get("server", ""),
                "title": title,
                "keywords": keywords,
                "hash": hashlib.md5(content).hexdigest()[:8]
            }
        except:
            continue

    return None


def load_state():
    if STATE_FILE.exists():
        try:
            with open(STATE_FILE, 'r') as f:
                return json.load(f)
        except:
            return {}
    return {}


def save_state(state):
    with open(STATE_FILE, 'w') as f:
        json.dump(state, f, indent=2)



def main():
    console.print(Padding("[bold cyan]Monitor iniciado[/bold cyan]", (0, 0, 0, 4)))

    send_telegram(f"✅ Monitor iniciado ({len(DOMAINS)} dominios)")

    state = load_state()
    cycle = 0

    while True:
        cycle += 1
        silent = cycle <= SILENT_CYCLES

        console.print(f"\nCiclo #{cycle}")

        for domain in DOMAINS:
            console.print(f"→ {domain}")

            current_dns = check_dns(domain)
            prev_dns = state.get(domain, {}).get("dns", {})

            current_http = check_http(domain)
            prev_http = state.get(domain, {}).get("http", {})


            is_first_scan = not prev_http
            seizure_detected = False

            # HTTP keywords
            if current_http and current_http.get("keywords"):
                seizure_detected = True

            # DNS robusto
            for ns in current_dns.get("NS", []):
                ns_clean = ns.lower().strip().strip('.')
                if any(k in ns_clean for k in ["seized", "fbi", "justice", "gov"]):
                    seizure_detected = True
                    break

            # DEBUG (puedes quitar luego)
            console.print(f"[dim]NS: {current_dns.get('NS')}[/dim]")



            dns_changes = []
            for rtype in DNS_RECORDS:
                if prev_dns.get(rtype) and current_dns[rtype] != prev_dns[rtype]:
                    dns_changes.append(f"{rtype} cambiado")

            http_changes = []
            if current_http and prev_http:
                if prev_http.get("status") != current_http["status"]:
                    http_changes.append("Status cambiado")
                if prev_http.get("title") != current_http["title"]:
                    http_changes.append("Title cambiado")

            all_changes = dns_changes + http_changes


            if (all_changes and not silent) or (is_first_scan and seizure_detected):

                if is_first_scan and seizure_detected:
                    msg = f"🚨Dominio icautado detectado   (PRIMER ESCANEO)\n{domain}"
                else:
                    msg = f"🔔 Cambios detectados\n{domain}"

                if seizure_detected:
                    screenshot = take_screenshot(domain)
                    if screenshot:
                        send_telegram(msg, screenshot)
                    else:
                        send_telegram(msg)
                else:
                    send_telegram(msg)

            if domain not in state:
                state[domain] = {}

            state[domain]["dns"] = current_dns
            if current_http:
                state[domain]["http"] = current_http

        save_state(state)
        time.sleep(SCAN_INTERVAL)


if __name__ == "__main__":
    main()