[adulau]

Adds a dedicated SpamCop Blocking List (SCBL) expansion and hover module so analysts can query SpamCop directly for an ip-src or ip-dst attribute. The existing generic RBL module includes SpamCop among many providers; this module offers a focused lookup with explicit response handling.

A documented 127.0.0.2 A response produces a misp_standard reputation object with a suspicious classification, the SpamCop list name, a lookup URL, and a reference to the original IP attribute. NXDOMAIN reports that the address is not listed, without assigning a benign verdict. DNS failures, missing A answers, and unexpected response codes return separate errors and produce no reputation object.

The module validates IPv4 input and supports an optional positive, finite timeout in seconds (default: 5). It requires no API key and uses the existing dnspython dependency. Module metadata, documentation pages, and module indexes are included.

The PR also fixes two existing CI assumptions exposed by its first run. The Spamhaus smoke test now accepts the module's explicit refused-query and unknown-code errors while continuing to reject malformed results. Nine regression cases cover those checks. The workflow waits for a successful health response with bounded connection retries, allowing module imports to take longer than the previous fixed 10-second sleep.

Validation:

• GitHub CI passed for documentation and Python 3.10, 3.11, 3.12, 3.13, and 3.14. The Python 3.14 full suite reported 864 passed, 4 skipped, and 5 subtests passed.
• pytest -q tests/test_spamcop.py tests/test_dnsbl.py tests/test_expansion_smoke.py: 62 passed.
• Flake8 for the SpamCop module, isort checks, Black formatting checks for the new files, workflow YAML validation, and git diff --check passed.
• Tests use mocked DNS responses, including an actual dnspython A record for the positive path. They cover both supported attribute types, object references, negative answers, resolver failures, unexpected responses, malformed requests, IPv6 rejection, timeout validation, and module discovery.

The local full suite reported 860 passed, 4 skipped, and 4 failures involving external DNS access and unavailable PDF/module runtime components; the complete suite passed in GitHub CI. Live SpamCop DNS lookups were not run. IPv6 is explicitly unsupported.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-15T07:49:49.893297Z	edc1f6b	Draft marked ready
🔒 Security Review	✅ Completed 2026-10-15T07:43:25.403497Z	edc1f6b	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.