fixes

core/scanner.py

@@ -581,29 +581,6 @@ class Scanner:
         if self._is_stop_requested():
             return discovered_targets, False
             
-        # Process all attributes first, grouping by target node
-        attributes_by_node = defaultdict(list)
-        for attribute in provider_result.attributes:
-            attr_dict = {
-                "name": attribute.name,
-                "value": attribute.value,
-                "type": attribute.type,
-                "provider": attribute.provider,
-                "confidence": attribute.confidence,
-                "metadata": attribute.metadata
-            }
-            attributes_by_node[attribute.target_node].append(attr_dict)
-
-        # FIXED: Add attributes to existing nodes AND create new nodes (like correlation nodes)
-        for node_id, node_attributes_list in attributes_by_node.items():
-            if provider_name == 'correlation' and not self.graph.graph.has_node(node_id):
-                node_type = NodeType.CORRELATION_OBJECT
-            elif _is_valid_ip(node_id):
-                node_type = NodeType.IP
-            else:
-                node_type = NodeType.DOMAIN
-            self.graph.add_node(node_id, node_type, attributes=node_attributes_list)
-
         # Check if this should be a large entity
         if provider_result.get_relationship_count() > self.config.large_entity_threshold:
             members = self._create_large_entity_from_provider_result(target, provider_name, provider_result, current_depth)
@@ -654,6 +631,30 @@ class Scanner:
             if (_is_valid_domain(target_node) or _is_valid_ip(target_node)) and not max_depth_reached:
                 discovered_targets.add(target_node)
 
+        # Process all attributes, grouping by target node
+        attributes_by_node = defaultdict(list)
+        for attribute in provider_result.attributes:
+            attr_dict = {
+                "name": attribute.name,
+                "value": attribute.value,
+                "type": attribute.type,
+                "provider": attribute.provider,
+                "confidence": attribute.confidence,
+                "metadata": attribute.metadata
+            }
+            attributes_by_node[attribute.target_node].append(attr_dict)
+
+        # Add attributes to existing nodes OR create new nodes if they don't exist
+        for node_id, node_attributes_list in attributes_by_node.items():
+            if not self.graph.graph.has_node(node_id):
+                # If the node doesn't exist, create it with a default type
+                node_type = NodeType.IP if _is_valid_ip(node_id) else NodeType.DOMAIN
+                self.graph.add_node(node_id, node_type, attributes=node_attributes_list)
+            else:
+                # If the node already exists, just add the attributes
+                node_type_val = self.graph.graph.nodes[node_id].get('type', 'domain')
+                self.graph.add_node(node_id, NodeType(node_type_val), attributes=node_attributes_list)
+
         return discovered_targets, False
 
     def _create_large_entity_from_provider_result(self, source: str, provider_name: str, 

providers/shodan_provider.py

@@ -107,6 +107,12 @@ class ShodanProvider(BaseProvider):
         except (json.JSONDecodeError, ValueError, KeyError):
             return "stale"
 
+    def query_domain(self, domain: str) -> ProviderResult:
+        """
+        Shodan does not support domain queries. This method returns an empty result.
+        """
+        return ProviderResult()
+
     def query_ip(self, ip: str) -> ProviderResult:
         """
         Query Shodan for information about an IP address (IPv4 or IPv6), with caching of processed data.