From 9d9afa6a08fcd2340ef34057c21b9ce2ed75cc71 Mon Sep 17 00:00:00 2001
From: overcuriousity <overcuriousity@posteo.org>
Date: Thu, 18 Sep 2025 21:04:29 +0200
Subject: [PATCH] fixes

---
 core/scanner.py              | 49 ++++++++++++++++++------------------
 providers/shodan_provider.py |  6 +++++
 2 files changed, 31 insertions(+), 24 deletions(-)

diff --git a/core/scanner.py b/core/scanner.py
index 08c2621..30819d5 100644
--- a/core/scanner.py
+++ b/core/scanner.py
@@ -580,30 +580,7 @@ class Scanner:
 
         if self._is_stop_requested():
             return discovered_targets, False
-
-        # Process all attributes first, grouping by target node
-        attributes_by_node = defaultdict(list)
-        for attribute in provider_result.attributes:
-            attr_dict = {
-                "name": attribute.name,
-                "value": attribute.value,
-                "type": attribute.type,
-                "provider": attribute.provider,
-                "confidence": attribute.confidence,
-                "metadata": attribute.metadata
-            }
-            attributes_by_node[attribute.target_node].append(attr_dict)
-
-        # FIXED: Add attributes to existing nodes AND create new nodes (like correlation nodes)
-        for node_id, node_attributes_list in attributes_by_node.items():
-            if provider_name == 'correlation' and not self.graph.graph.has_node(node_id):
-                node_type = NodeType.CORRELATION_OBJECT
-            elif _is_valid_ip(node_id):
-                node_type = NodeType.IP
-            else:
-                node_type = NodeType.DOMAIN
-            self.graph.add_node(node_id, node_type, attributes=node_attributes_list)
-
+            
         # Check if this should be a large entity
         if provider_result.get_relationship_count() > self.config.large_entity_threshold:
             members = self._create_large_entity_from_provider_result(target, provider_name, provider_result, current_depth)
@@ -654,6 +631,30 @@ class Scanner:
             if (_is_valid_domain(target_node) or _is_valid_ip(target_node)) and not max_depth_reached:
                 discovered_targets.add(target_node)
 
+        # Process all attributes, grouping by target node
+        attributes_by_node = defaultdict(list)
+        for attribute in provider_result.attributes:
+            attr_dict = {
+                "name": attribute.name,
+                "value": attribute.value,
+                "type": attribute.type,
+                "provider": attribute.provider,
+                "confidence": attribute.confidence,
+                "metadata": attribute.metadata
+            }
+            attributes_by_node[attribute.target_node].append(attr_dict)
+
+        # Add attributes to existing nodes OR create new nodes if they don't exist
+        for node_id, node_attributes_list in attributes_by_node.items():
+            if not self.graph.graph.has_node(node_id):
+                # If the node doesn't exist, create it with a default type
+                node_type = NodeType.IP if _is_valid_ip(node_id) else NodeType.DOMAIN
+                self.graph.add_node(node_id, node_type, attributes=node_attributes_list)
+            else:
+                # If the node already exists, just add the attributes
+                node_type_val = self.graph.graph.nodes[node_id].get('type', 'domain')
+                self.graph.add_node(node_id, NodeType(node_type_val), attributes=node_attributes_list)
+
         return discovered_targets, False
 
     def _create_large_entity_from_provider_result(self, source: str, provider_name: str, 
diff --git a/providers/shodan_provider.py b/providers/shodan_provider.py
index 45ad689..54ebb79 100644
--- a/providers/shodan_provider.py
+++ b/providers/shodan_provider.py
@@ -107,6 +107,12 @@ class ShodanProvider(BaseProvider):
         except (json.JSONDecodeError, ValueError, KeyError):
             return "stale"
 
+    def query_domain(self, domain: str) -> ProviderResult:
+        """
+        Shodan does not support domain queries. This method returns an empty result.
+        """
+        return ProviderResult()
+
     def query_ip(self, ip: str) -> ProviderResult:
         """
         Query Shodan for information about an IP address (IPv4 or IPv6), with caching of processed data.