Update README.md

FraudCapturer/Configuration/BlockConfig.cs

@@ -1,42 +0,0 @@
-namespace FraudCapturer.Configuration;
-
-internal class BlockConfig
-{
-    public BlockConfigSet LowRiskSet { get; set; } = new BlockConfigSet(false, true, false);
-    public BlockConfigSet MeduimRiskSet { get; set; } = new BlockConfigSet(false, true, true);
-    public BlockConfigSet HighRiskSet { get; set; } = new BlockConfigSet(true, true, true);
-
-    public bool CheckIfBlock(IpInfo ipInfo)
-    {
-        if (ipInfo.Risk <= 33)
-        {
-            return CheckIfBlockSet(ipInfo, LowRiskSet);
-        }
-        else if (ipInfo.Risk >= 67)
-        {
-            return CheckIfBlockSet(ipInfo, HighRiskSet);
-        }
-        else
-        {
-            return CheckIfBlockSet(ipInfo, MeduimRiskSet);
-        }
-    }
-
-    public static bool CheckIfBlockSet(IpInfo ipInfo, BlockConfigSet blockConfigSet)
-    {
-        if (ipInfo.Type == "VPN" && blockConfigSet.BlockIfVpn)
-        {
-            return true;
-        }
-        else if (ipInfo.IsProxy && blockConfigSet.BlockIfProxy)
-        {
-            return true;
-        }
-        else if (!ipInfo.IsProxy && blockConfigSet.BlockIfNotProxy)
-        {
-            return true;
-        }
-
-        return false;
-    }
-}

FraudCapturer/Configuration/BlockConfigSet.cs

@@ -1,19 +0,0 @@
-namespace FraudCapturer.Configuration;
-
-internal class BlockConfigSet
-{
-    public BlockConfigSet(bool blockIfNotProxy, bool blockIfProxy, bool blockIfVpn)
-    {
-        BlockIfNotProxy = blockIfNotProxy;
-        BlockIfProxy = blockIfProxy;
-        BlockIfVpn = blockIfVpn;
-    }
-
-    public BlockConfigSet()
-    {
-    }
-
-    public bool BlockIfNotProxy { get; set; }
-    public bool BlockIfProxy { get; set; }
-    public bool BlockIfVpn { get; set; }
-}

FraudCapturer/Configuration/Configurator.cs

@@ -1,63 +0,0 @@
-namespace FraudCapturer.Configuration;
-
-internal static class Configurator
-{
-    public static BlockConfig GetConfig()
-    {
-        BlockConfig blockConfig = new BlockConfig();
-
-        Console.WriteLine("Configuration:");
-        Console.WriteLine();
-
-        Console.WriteLine("High risk rules (>=66%):");
-        Console.WriteLine("----------------------------------------------------");
-        blockConfig.HighRiskSet = GetBlockConfigSetFromConsole(true, true, true);
-
-        Console.WriteLine("High medium rules (>33% & <66%):");
-        Console.WriteLine("----------------------------------------------------");
-        blockConfig.MeduimRiskSet = GetBlockConfigSetFromConsole(false, true, true);
-
-        Console.WriteLine("High low rules (<=33%):");
-        Console.WriteLine("----------------------------------------------------");
-        blockConfig.LowRiskSet = GetBlockConfigSetFromConsole(false, true, false);
-
-        return blockConfig;
-    }
-
-    private static BlockConfigSet GetBlockConfigSetFromConsole(bool ifNotProxyDefault, bool ifproxyDefault, bool ifVpnDeault)
-    {
-        BlockConfigSet blockConfigSet = new BlockConfigSet();
-        Console.WriteLine($"Block if no Proxy detected {GetDefaultHintString(ifNotProxyDefault)}:");
-        blockConfigSet.BlockIfNotProxy = GetBoolValueFromConsole(ifNotProxyDefault);
-
-        Console.WriteLine($"Block if Proxy detected {GetDefaultHintString(ifproxyDefault)}:");
-        blockConfigSet.BlockIfProxy = GetBoolValueFromConsole(ifproxyDefault);
-
-        Console.WriteLine($"Block if VPN detected {GetDefaultHintString(ifVpnDeault)}:");
-        blockConfigSet.BlockIfVpn = GetBoolValueFromConsole(ifVpnDeault);
-
-        return blockConfigSet;
-    }
-
-    private static bool GetBoolValueFromConsole(bool defaultValue)
-    {
-        string input = Console.ReadLine() ?? string.Empty;
-
-        if (string.IsNullOrWhiteSpace(input))
-        {
-            return defaultValue;
-        }
-
-        while (input.ToLower() is not "y" and not "n")
-        {
-            input = Console.ReadLine() ?? string.Empty;
-        }
-
-        return input.ToLower() == "y";
-    }
-
-    private static string GetDefaultHintString(bool defaultValue)
-    {
-        return defaultValue ? "[Y/n]" : "[y/N]";
-    }
-}

FraudCapturer/DomainHelper.cs

@@ -1,7 +1,5 @@
 using PacketDotNet;
 
-using Stone_Red_Utilities.ConsoleExtentions;
-
 using System.Net;
 using System.Net.Sockets;
 using System.Text;
@@ -9,18 +7,22 @@ using System.Text.Json;
 using System.Text.Json.Serialization;
 using System.Text.RegularExpressions;
 
-namespace FraudCapturer.Helpers;
+namespace FraudCapturer;
 
 internal class DomainHelper
 {
     public static string[] GetDomainsFromDnsReqest(TransportPacket transportPacket)
     {
+        List<string> domains = new();
         MatchCollection matchCollection = Regex.Matches(transportPacket.GetPayloadAsString().ToLower(), @"(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9][a-z0-9-]{0,61}[a-z0-9]");
-        List<string> domains = matchCollection.Select(match => match.Value).ToList();
+        foreach (Match match in matchCollection)
+        {
+            domains.Add(match.Value);
+        }
         return domains.Distinct().ToArray();
     }
 
-    public static async Task<DomainInfo?> GetDomainReputation(string domain)
+    public static DomainInfo? GetDomainReputation(string domain)
     {
         try
         {
@@ -39,19 +41,10 @@ internal class DomainHelper
             };
 
             HttpContent httpContent = new StringContent(JsonSerializer.Serialize(reqestBody), Encoding.UTF8, "application/json");
-            HttpResponseMessage responseMessage;
 
-            try
-            {
-                responseMessage = await httpClient.PostAsync("https://anti-fish.bitflow.dev/check", httpContent);
-            }
-            catch (HttpRequestException ex)
-            {
-                ConsoleExt.WriteLine($"error: {ex.Message}", ConsoleColor.Gray);
-                return null;
-            }
+            HttpResponseMessage responseMessage = httpClient.PostAsync("https://anti-fish.bitflow.dev/check", httpContent).GetAwaiter().GetResult(); ;
 
-            string resultString = await responseMessage.Content.ReadAsStringAsync();
+            string resultString = responseMessage.Content.ReadAsStringAsync().GetAwaiter().GetResult(); ;
             AntiFishResultBody? resultBody = JsonSerializer.Deserialize<AntiFishResultBody>(resultString);
 
             AntiFishResult? result = resultBody?.Matches?.FirstOrDefault(m => m.Domain == domain);
@@ -70,18 +63,18 @@ internal class DomainHelper
         }
         catch (SocketException ex)
         {
-            ConsoleExt.WriteLine($"error: {ex.Message} ({domain})", ConsoleColor.Gray);
+            Console.WriteLine($"error: {ex.Message} ({domain})");
             return null;
         }
     }
 
-    private sealed class AntiFishReqestBody
+    private class AntiFishReqestBody
     {
         [JsonPropertyName("message")]
         public string? Message { get; set; }
     }
 
-    private sealed class AntiFishResult
+    private class AntiFishResult
     {
         [JsonPropertyName("followed")]
         public bool Followed { get; set; }
@@ -99,7 +92,7 @@ internal class DomainHelper
         public double TrustRating { get; set; }
     }
 
-    private sealed class AntiFishResultBody
+    private class AntiFishResultBody
     {
         [JsonPropertyName("match")]
         public bool Match { get; set; }

FraudCapturer/FirewallHelper.cs

@@ -0,0 +1,67 @@
+using System.Net;
+
+namespace FraudCapturer;
+
+internal class FirewallHelper
+{
+    public static void BlockIp(IPAddress? ipAddress)
+    {
+        if (ipAddress is null)
+        {
+            throw new ArgumentNullException(nameof(ipAddress));
+        }
+
+        AddRuleIfDoesnotExist(ipAddress);
+
+        File.AppendAllText(Program.IpStorePath, $"{Environment.NewLine}{ipAddress}");
+
+        string[] iPs = File.ReadAllLines(Program.IpStorePath);
+
+        System.Diagnostics.Process process = new System.Diagnostics.Process();
+        System.Diagnostics.ProcessStartInfo startInfo = new System.Diagnostics.ProcessStartInfo
+        {
+            WindowStyle = System.Diagnostics.ProcessWindowStyle.Hidden,
+            FileName = "cmd.exe",
+            Arguments = $"/C netsh advfirewall firewall set rule name=\"{Program.AppName} IP Block\" new remoteIp={string.Join(',', iPs)}"
+        };
+        process.StartInfo = startInfo;
+        _ = process.Start();
+    }
+
+    public static void UnblockIp(IPAddress? ipAddress)
+    {
+        if (ipAddress is null)
+        {
+            throw new ArgumentNullException(nameof(ipAddress));
+        }
+
+        List<string> iPs = File.ReadAllLines(Program.IpStorePath).ToList();
+        iPs.Remove(ipAddress.ToString());
+
+        File.WriteAllLines(Program.IpStorePath, iPs);
+
+        System.Diagnostics.Process process = new System.Diagnostics.Process();
+        System.Diagnostics.ProcessStartInfo startInfo = new System.Diagnostics.ProcessStartInfo
+        {
+            WindowStyle = System.Diagnostics.ProcessWindowStyle.Hidden,
+            FileName = "cmd.exe",
+            Arguments = $"/C netsh advfirewall firewall set rule name=\"{Program.AppName} IP Block\" new remoteIp={string.Join(',', iPs.ToArray())}"
+        };
+        process.StartInfo = startInfo;
+        _ = process.Start();
+    }
+
+    public static void AddRuleIfDoesnotExist(IPAddress ipAddress)
+    {
+        System.Diagnostics.Process process = new System.Diagnostics.Process();
+        System.Diagnostics.ProcessStartInfo startInfo = new System.Diagnostics.ProcessStartInfo
+        {
+            WindowStyle = System.Diagnostics.ProcessWindowStyle.Hidden,
+            FileName = "cmd.exe",
+            Arguments = $"/C netsh advfirewall firewall show rule name=\"{Program.AppName} IP Block\" >nul || netsh advfirewall firewall add rule name=\"{Program.AppName} IP Block\" dir=in interface=any action=block remoteIp={ipAddress} && netsh advfirewall firewall add rule name=\"{Program.AppName} IP Block\" dir=out interface=any action=block remoteIp={ipAddress}"
+        };
+        process.StartInfo = startInfo;
+        _ = process.Start();
+        process.WaitForExit();
+    }
+}

FraudCapturer/FraudCapturer.csproj

@@ -9,7 +9,6 @@
 
   <ItemGroup>
     <PackageReference Include="SharpPcap" Version="6.1.0" />
-    <PackageReference Include="Stone_Red-C-Sharp-Utilities" Version="1.0.3.1" />
   </ItemGroup>
 
 </Project>

FraudCapturer/GlobalSuppressions.cs

@@ -1,8 +0,0 @@
-// This file is used by Code Analysis to maintain SuppressMessage
-// attributes that are applied to this project.
-// Project-level suppressions either have no target or are given
-// a specific target and scoped to a namespace, type, member, etc.
-
-using System.Diagnostics.CodeAnalysis;
-
-[assembly: SuppressMessage("Minor Code Smell", "S1075:URIs should not be hardcoded", Justification = "<Pending>", Scope = "member", Target = "~F:FraudCapturer.Program.AppUrl")]

FraudCapturer/Helpers/FirewallHelper.cs

@@ -1,76 +0,0 @@
-using System.Net;
-
-namespace FraudCapturer.Helpers;
-
-internal static class FirewallHelper
-{
-    public static void BlockIp(IPAddress? ipAddress)
-    {
-        if (ipAddress is null)
-        {
-            throw new ArgumentNullException(nameof(ipAddress));
-        }
-
-        lock (Program.IpStorePath)
-        {
-            AddRuleIfDoesnotExist(ipAddress);
-
-            File.AppendAllText(Program.IpStorePath, $"{Environment.NewLine}{ipAddress}");
-
-            string[] iPs = File.ReadAllLines(Program.IpStorePath);
-
-            System.Diagnostics.Process process = new System.Diagnostics.Process();
-            System.Diagnostics.ProcessStartInfo startInfo = new System.Diagnostics.ProcessStartInfo
-            {
-                WindowStyle = System.Diagnostics.ProcessWindowStyle.Hidden,
-                FileName = "cmd.exe",
-                Arguments = $"/C netsh advfirewall firewall set rule name=\"{Program.AppName} IP Block\" new remoteIp={string.Join(',', iPs)}"
-            };
-            process.StartInfo = startInfo;
-            _ = process.Start();
-        }
-    }
-
-    public static void UnblockIp(IPAddress? ipAddress)
-    {
-        if (ipAddress is null)
-        {
-            throw new ArgumentNullException(nameof(ipAddress));
-        }
-
-        lock (Program.IpStorePath)
-        {
-            List<string> iPs = File.ReadAllLines(Program.IpStorePath).ToList();
-            _ = iPs.Remove(ipAddress.ToString());
-
-            File.WriteAllLines(Program.IpStorePath, iPs);
-
-            System.Diagnostics.Process process = new System.Diagnostics.Process();
-            System.Diagnostics.ProcessStartInfo startInfo = new System.Diagnostics.ProcessStartInfo
-            {
-                WindowStyle = System.Diagnostics.ProcessWindowStyle.Hidden,
-                FileName = "cmd.exe",
-                Arguments = $"/C netsh advfirewall firewall set rule name=\"{Program.AppName} IP Block\" new remoteIp={string.Join(',', iPs.ToArray())}"
-            };
-            process.StartInfo = startInfo;
-            _ = process.Start();
-        }
-    }
-
-    public static void AddRuleIfDoesnotExist(IPAddress ipAddress)
-    {
-        lock (Program.IpStorePath)
-        {
-            System.Diagnostics.Process process = new System.Diagnostics.Process();
-            System.Diagnostics.ProcessStartInfo startInfo = new System.Diagnostics.ProcessStartInfo
-            {
-                WindowStyle = System.Diagnostics.ProcessWindowStyle.Hidden,
-                FileName = "cmd.exe",
-                Arguments = $"/C netsh advfirewall firewall show rule name=\"{Program.AppName} IP Block\" >nul || netsh advfirewall firewall add rule name=\"{Program.AppName} IP Block\" dir=in interface=any action=block remoteIp={ipAddress} && netsh advfirewall firewall add rule name=\"{Program.AppName} IP Block\" dir=out interface=any action=block remoteIp={ipAddress}"
-            };
-            process.StartInfo = startInfo;
-            _ = process.Start();
-            process.WaitForExit();
-        }
-    }
-}

FraudCapturer/IpHelper.cs

@@ -1,28 +1,17 @@
-using Stone_Red_Utilities.ConsoleExtentions;
-
-using System.Net;
+using System.Net;
 using System.Text.Json;
 
-namespace FraudCapturer.Helpers;
+namespace FraudCapturer;
 
-internal static class IpHelper
+internal class IpHelper
 {
     public static string? ProxycheckApiKey { get; set; }
 
-    public static async Task<IpInfo?> GetIpReputation(IPAddress ipAddress)
+    public static IpInfo? GetIpReputation(IPAddress ipAddress)
     {
         HttpClient httpClient = new HttpClient();
-        string rawResponseData;
 
-        try
-        {
-            rawResponseData = await httpClient.GetStringAsync($"http://proxycheck.io/v2/{ipAddress}?key={ProxycheckApiKey}&risk=2&vpn=1&asn=1&tag={Program.AppName}({Environment.MachineName})");
-        }
-        catch (HttpRequestException ex)
-        {
-            ConsoleExt.WriteLine($"error: {ex.Message}", ConsoleColor.Gray);
-            return null;
-        }
+        string rawResponseData = httpClient.GetStringAsync($"http://proxycheck.io/v2/{ipAddress}?key={ProxycheckApiKey}&risk=2&vpn=1&asn=1&tag={Program.AppName}({Environment.MachineName})").GetAwaiter().GetResult();
 
         JsonDocument responseData = JsonDocument.Parse(rawResponseData);
 
@@ -33,10 +22,10 @@ internal static class IpHelper
 
         if (statusValue.GetString() != "ok")
         {
-            ConsoleExt.Write(statusValue.GetString(), ConsoleColor.Gray);
+            Console.Write(statusValue.GetString());
             if (responseData.RootElement.TryGetProperty("message", out JsonElement messageValue))
             {
-                ConsoleExt.WriteLine($": {messageValue.GetString()}", ConsoleColor.Gray);
+                Console.WriteLine($": {messageValue.GetString()}");
             }
             else
             {
@@ -98,13 +87,21 @@ internal static class IpHelper
         }
 
         byte[] ip = IPAddress.Parse(ipAdress).GetAddressBytes();
-        return ip[0] switch
+        switch (ip[0])
         {
-            10 or 127 => true,
-            172 => ip[1] is >= 16 and < 32,
-            192 => ip[1] == 168,
-            _ => false,
-        };
+            case 10:
+            case 127:
+                return true;
+
+            case 172:
+                return ip[1] >= 16 && ip[1] < 32;
+
+            case 192:
+                return ip[1] == 168;
+
+            default:
+                return false;
+        }
     }
 
     public static bool IsLocalIpAddress(string host)
@@ -124,14 +121,16 @@ internal static class IpHelper
                     return true;
                 }
 
-                return localIPs.Any(i => i.Equals(hostIP));
-            }
-        }
-        catch
+                foreach (IPAddress localIP in localIPs)
                 {
-            return false;
+                    if (hostIP.Equals(localIP))
+                    {
+                        return true;
                     }
-
+                }
+            }
+        }
+        catch { }
         return false;
     }
 }

FraudCapturer/PackageHelper.cs

@@ -2,31 +2,31 @@
 
 using System.Text;
 
-namespace FraudCapturer.Helpers;
+namespace FraudCapturer;
 
 internal static class PackageHelper
 {
     public static string GetPayloadAsString(this TransportPacket transportPacket)
     {
         byte[] data = transportPacket.PayloadData;
-        StringBuilder bytes = new StringBuilder();
-        StringBuilder ascii = new StringBuilder();
+        string bytes = "";
+        string ascii = "";
 
         for (int i = 1; i <= data.Length; i++)
         {
             // add the current byte to the bytes hex string
-            _ = bytes.Append(data[i - 1].ToString("x").PadLeft(2, '0') + " ");
+            bytes += data[i - 1].ToString("x").PadLeft(2, '0') + " ";
 
             // add the current byte to the asciiBytes array for later processing
-            if (data[i - 1] is < 0x21 or > 0x7e)
+            if (data[i - 1] < 0x21 || data[i - 1] > 0x7e)
             {
-                _ = ascii.Append('.');
+                ascii += ".";
             }
             else
             {
-                _ = ascii.Append(Encoding.ASCII.GetString(new[] { data[i - 1] }));
+                ascii += Encoding.ASCII.GetString(new[] { data[i - 1] });
             }
         }
-        return ascii.ToString().Trim('.');
+        return ascii.Trim('.');
     }
 }

FraudCapturer/Program.cs

@@ -1,32 +1,26 @@
-using FraudCapturer.Configuration;
-using FraudCapturer.Helpers;
-
+
 using PacketDotNet;
 
 using SharpPcap;
 
-using Stone_Red_Utilities.ConsoleExtentions;
-
-using System.Collections.Concurrent;
 using System.Net;
-using System.Text.Json;
 
 namespace FraudCapturer;
 
-public static class Program
+/// <summary>
+/// Example showing packet manipulation
+/// </summary>
+public class Program
 {
     public const string AppName = "FraudCapturer";
     public const string AppUrl = "https://github.com/Stone-Red-Code/FraudCapturer";
     public const string IpStorePath = "ipAdresses.txt";
-    public const string ConfigStorePath = "config.txt";
 
     private static DateTime lastCacheClear;
     private static string lastDomain = string.Empty;
 
-    private static readonly ConcurrentBag<string> capturedIpsCache = new();
-    private static readonly ConcurrentDictionary<string, DomainInfo?> capturedDomainsCache = new();
-
-    private static BlockConfig blockConfig = new BlockConfig();
+    private static readonly List<string> capturedIpsCache = new();
+    private static readonly Dictionary<string, DomainInfo> capturedDomainsCache = new();
 
     /// <summary>
     /// The main entry point for the application.
@@ -41,30 +35,18 @@ public static class Program
         // Retrieve the device list
         CaptureDeviceList devices = CaptureDeviceList.Instance;
 
-        if (args.FirstOrDefault() == "config")
+        if (string.IsNullOrWhiteSpace(args.FirstOrDefault()))
         {
-            blockConfig = Configurator.GetConfig();
-            string jsonConfig = JsonSerializer.Serialize(blockConfig);
-            File.WriteAllText(ConfigStorePath, jsonConfig);
-
-            Console.WriteLine("-- Configuration saved!");
-            return;
-        }
-        else if (string.IsNullOrWhiteSpace(args.FirstOrDefault()))
-        {
-            ConsoleExt.WriteLine("No proxycheck api key provided! You are limited to 100 IP checks per day. Get one for free at proxycheck.io.", ConsoleColor.Red);
+            Console.ForegroundColor = ConsoleColor.Red;
+            Console.WriteLine("No proxycheck api key provided! You are limited to 100 IP checks per day. Get one for free at proxycheck.io.");
             Console.WriteLine();
+            Console.ResetColor();
         }
         else
         {
             IpHelper.ProxycheckApiKey = args.FirstOrDefault();
         }
 
-        if (File.Exists(ConfigStorePath))
-        {
-            blockConfig = JsonSerializer.Deserialize<BlockConfig>(File.ReadAllText(ConfigStorePath)) ?? new BlockConfig();
-        }
-
         // If no devices were found print an error
         if (devices.Count < 1)
         {
@@ -110,7 +92,7 @@ public static class Program
         device.Open();
 
         Console.WriteLine();
-        Console.WriteLine($"-- Listening on {device.Description}, hit 'Ctrl-C' to exit...");
+        Console.WriteLine("-- Listening on {0}, hit 'Ctrl-C' to exit...", device.Description);
 
         // Start capture of packets
         device.Capture();
@@ -119,11 +101,6 @@ public static class Program
     private static void Device_OnPacketArrival(object sender, PacketCapture e)
     {
         RawCapture rawPacket = e.GetPacket();
-        _ = ProcessRawPacket(rawPacket);
-    }
-
-    private static async Task ProcessRawPacket(RawCapture rawPacket)
-    {
         Packet packet = Packet.ParsePacket(rawPacket.LinkLayerType, rawPacket.Data);
         if (packet is EthernetPacket)
         {
@@ -156,73 +133,74 @@ public static class Program
                     capturedIpsCache.Clear();
                     capturedDomainsCache.Clear();
                     File.WriteAllText(IpStorePath, string.Empty);
-                    ConsoleExt.WriteLine("Cleared cache", ConsoleColor.Gray);
+                    Console.WriteLine("Cleared cache");
                 }
 
                 //Check if a DNS packet contains a "dangerous" domain.
-                await CheckDns(packet, remoteIpAddress, direction);
+                CheckDns(packet, remoteIpAddress, direction);
 
                 if (capturedIpsCache.Contains(remoteIpAddress.ToString()))
                 {
                     return;
                 }
 
+                TimeSpan timeRemainingUntilCacheReset = new TimeSpan(0, 10, 0) - (DateTime.Now - lastCacheClear);
+                Console.WriteLine($"Next cache reset in {timeRemainingUntilCacheReset.Minutes} minute(s) and {timeRemainingUntilCacheReset.Seconds} second(s)");
+
                 capturedIpsCache.Add(remoteIpAddress.ToString());
 
                 //Check if ip address is "dangerous" or blocked
-                await CheckIpAddress(remoteIpAddress, direction);
-
-                TimeSpan timeRemainingUntilCacheReset = new TimeSpan(0, 10, 0) - (DateTime.Now - lastCacheClear);
-                ConsoleExt.WriteLine($"Next cache reset in {timeRemainingUntilCacheReset.Minutes} minute(s) and {timeRemainingUntilCacheReset.Seconds} second(s)", ConsoleColor.Gray);
+                CheckIpAddress(remoteIpAddress, direction);
             }
         }
     }
 
-    private static async Task CheckIpAddress(IPAddress remoteIpAddress, string direction)
+    private static void CheckIpAddress(IPAddress remoteIpAddress, string direction)
     {
-        IpInfo? ipInfo = await IpHelper.GetIpReputation(remoteIpAddress);
+        IpInfo? ipInfo = IpHelper.GetIpReputation(remoteIpAddress);
 
         if (IpHelper.IsInternalIpAddress(remoteIpAddress.ToString()))
         {
-            ConsoleExt.WriteLine($"[{direction}] [Internal] {remoteIpAddress}", ConsoleColor.Cyan);
+            Console.ForegroundColor = ConsoleColor.Cyan;
+            Console.WriteLine($"[{direction}] [Internal] {remoteIpAddress}");
         }
         else if (ipInfo is not null)
         {
             bool block = false;
-            ConsoleColor consoleColor;
-
-            if (ipInfo.Risk >= 67 && BlockConfig.CheckIfBlockSet(ipInfo, blockConfig.HighRiskSet))
+            if (ipInfo.Risk >= 67)
             {
                 FirewallHelper.BlockIp(remoteIpAddress);
-                consoleColor = ConsoleColor.Red;
+                Console.ForegroundColor = ConsoleColor.Red;
                 block = true;
             }
-            else if (ipInfo.Risk <= 33 && BlockConfig.CheckIfBlockSet(ipInfo, blockConfig.LowRiskSet))
+            else if (ipInfo.Risk >= 34 && ipInfo.IsProxy)
             {
                 FirewallHelper.BlockIp(remoteIpAddress);
-                consoleColor = ConsoleColor.Yellow;
+                Console.ForegroundColor = ConsoleColor.DarkYellow;
                 block = true;
             }
-            else if (BlockConfig.CheckIfBlockSet(ipInfo, blockConfig.MeduimRiskSet))
+            else if (ipInfo.IsProxy && ipInfo.Type != "VPN")
             {
                 FirewallHelper.BlockIp(remoteIpAddress);
-                consoleColor = ConsoleColor.DarkYellow;
+                Console.ForegroundColor = ConsoleColor.DarkYellow;
                 block = true;
             }
             else
             {
-                consoleColor = ConsoleColor.Green;
+                Console.ForegroundColor = ConsoleColor.Green;
             }
 
-            ConsoleExt.WriteLine($"[{direction}] [Provider: {ipInfo.Provider}] [Risk: {ipInfo.Risk}] [Proxy: {ipInfo.IsProxy}] [Type: {ipInfo.Type}] [Block: {block}] {remoteIpAddress}", consoleColor);
+            Console.WriteLine($"[{direction}] [Provider: {ipInfo.Provider}] [Risk: {ipInfo.Risk}] [Proxy: {ipInfo.IsProxy}] [Type: {ipInfo.Type}] [Block: {block}] {remoteIpAddress}");
         }
         else
         {
-            ConsoleExt.WriteLine($"[{direction}] [Invalid] {remoteIpAddress}", ConsoleColor.Magenta);
+            Console.ForegroundColor = ConsoleColor.Magenta;
+            Console.WriteLine($"[{direction}] [Invalid] {remoteIpAddress}");
         }
+        Console.ResetColor();
     }
 
-    private static async Task CheckDns(Packet packet, IPAddress remoteIpAddress, string direction)
+    private static void CheckDns(Packet packet, IPAddress remoteIpAddress, string direction)
     {
         TransportPacket transportPacket = packet.Extract<TcpPacket>();
         transportPacket ??= packet.Extract<UdpPacket>();
@@ -241,53 +219,54 @@ public static class Program
                 }
                 else
                 {
-                    domainInfo = await DomainHelper.GetDomainReputation(domain);
-                    _ = capturedDomainsCache.TryAdd(domain, domainInfo);
+                    domainInfo = DomainHelper.GetDomainReputation(domain);
                 }
 
                 if (domainInfo is null)
                 {
+                    Console.ForegroundColor = ConsoleColor.Magenta;
                     if (lastDomain != domain)
                     {
                         lastDomain = domain;
-                        ConsoleExt.WriteLine($"[{direction}] [Dns] [Invalid] [Domain: {domain}] {remoteIpAddress}", ConsoleColor.Magenta);
+                        Console.WriteLine($"[{direction}] [Dns] [Invalid] [Domain: {domain}] {remoteIpAddress}");
                     }
+                    Console.ResetColor();
                     continue;
                 }
 
-                if (!domainInfo.IsMatch)
+                if (domainInfo.IsMatch == false)
                 {
+                    Console.ForegroundColor = ConsoleColor.Green;
                     if (lastDomain != domain)
                     {
                         lastDomain = domain;
-                        ConsoleExt.WriteLine($"[{direction}] [Dns] [Domain: {domain}] [Type: Undetected] [Block: {block}] {remoteIpAddress}", ConsoleColor.Green);
+                        Console.WriteLine($"[{direction}] [Dns] [Domain: {domain}] [Type: Undetected] [Block: {block}] {remoteIpAddress}");
                     }
+                    Console.ResetColor();
                     continue;
                 }
 
-                ConsoleColor consoleColor;
-
                 if (domainInfo.TrustRating >= 0.9)
                 {
                     FirewallHelper.BlockIp(domainInfo.IpAddress);
-                    consoleColor = ConsoleColor.Red;
+                    Console.ForegroundColor = ConsoleColor.Red;
                     block = true;
                 }
                 else if (domainInfo.TrustRating >= 0.5)
                 {
                     FirewallHelper.BlockIp(domainInfo.IpAddress);
-                    consoleColor = ConsoleColor.DarkYellow;
+                    Console.ForegroundColor = ConsoleColor.DarkYellow;
                     block = true;
                 }
                 else
                 {
-                    consoleColor = ConsoleColor.Green;
+                    Console.ForegroundColor = ConsoleColor.Green;
                 }
 
                 if (lastDomain != domain)
                 {
                     lastDomain = domain;
-                    ConsoleExt.WriteLine($"[{direction}] [Dns] [Domain: {domain}] [Type: {domainInfo.Type}] [Source: {domainInfo.Source}] [Source Trust: {domainInfo.TrustRating * 100d}] [Block: {block}] {remoteIpAddress}", consoleColor);
+                    Console.WriteLine($"[{direction}] [Dns] [Domain: {domain}] [Type: {domainInfo.Type}] [Source: {domainInfo.Source}] [Source Trust: {domainInfo.TrustRating * 100d}] [Block: {block}] {remoteIpAddress}");
                 }
 
                 Console.ResetColor();

README.md

@@ -1,2 +1,26 @@
 # FraudCapturer
  
+> FraudCapturer is a windows app which analyzes the network trafic of your PC and blocks potential threats
+
+## Usage
+
+1. Download one of the [releases](https://github.com/Stone-Red-Code/FraudCapturer/releases)
+1. Download and install [nmap](https://nmap.org/download.html)
+1. (Not reqired but recommended) Get a [proxycheck.io](https://proxycheck.io/) api key
+1. Start `FraudCapturer.exe` as administrator and pass the proxycheck api key to it if you have one
+1. Select the network device you want the program to listen to
+
+## Additional information
+
+1. Why do i need to install nmap?\
+   It is required because FraudCapturer uses it to monitor incoming and outgoing packets.\
+   FraudCapturer uses the [sharppcap](https://github.com/dotpcap/sharppcap) ([license](https://github.com/dotpcap/sharppcap/blob/master/LICENSE)) library to communicate with nmap.
+
+1. Does FraudCapturer send all packet contents to the APIs?\
+   No, only the required information (IP addresses/domains) and the PC name to identify the device are sent to the APIs.
+
+1. How does FraudCapturer determine which IP addresses or domains are potential threats?\
+   It uses the [proxycheck.io](https://proxycheck.io/) and [Anti-Fish](https://anti-fish.bitflow.dev/) APIs.
+
+1. Why does FraudCapturer need administrator rights?\
+   FraudCapturer needs them because it uses the Windows firewall to block IP addresses.