diff --git a/net-analyzer/WhatWaf/Manifest b/net-analyzer/WhatWaf/Manifest
new file mode 100644
index 000000000..846f5f8cb
--- /dev/null
+++ b/net-analyzer/WhatWaf/Manifest
@@ -0,0 +1 @@
+DIST WhatWaf-1.7.tar.gz 84649 BLAKE2B 0461a6d2c5b733053d2e30b3b5651235baa39cf672578dfc117a908be4a5c6f69969fcf13542a4270e3a3a79f1558c96d97b80b07f405963b35276ab11e55e26 SHA512 013dfee9ae954fb6bb3c874208e9fb9267614b7dc281192cfb34429c03ebb902cc06f2983323bfe3cff9e3bf22d860a4daa21ed053e90b0c80ae1ceb268d53cb
diff --git a/net-analyzer/WhatWaf/WhatWaf-1.7.ebuild b/net-analyzer/WhatWaf/WhatWaf-1.7.ebuild
new file mode 100644
index 000000000..aef86cf20
--- /dev/null
+++ b/net-analyzer/WhatWaf/WhatWaf-1.7.ebuild
@@ -0,0 +1,27 @@
+# Copyright 1999-2019 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=6
+
+PYTHON_COMPAT=( python2_7 python3_{5,6} )
+
+#inherit distutils-r1
+inherit python-r1
+
+DESCRIPTION="Detect and bypass web application firewalls and protection systems"
+HOMEPAGE="https://github.com/Ekultek/WhatWaf"
+#SRC_URI="mirror://pypi/${PN:0:1}/${PN}/${P}.tar.gz"
+SRC_URI="https://github.com/Ekultek/WhatWaf/archive/${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="GPL-3"
+SLOT="0"
+
+#https://github.com/Ekultek/WhatWaf/issues/628
+#https://github.com/Ekultek/WhatWaf/issues/629
+#KEYWORDS="~amd64 ~x86"
+IUSE=""
+
+DEPEND=""
+RDEPEND="${DEPEND}
+	dev-python/beautifulsoup:4[${PYTHON_USEDEP}]
+	dev-python/requests[${PYTHON_USEDEP}]"
diff --git a/profiles/pentoo/base/package.accept_keywords/net-analyzer b/profiles/pentoo/base/package.accept_keywords/net-analyzer
index a620529b6..8d45f3a4f 100644
--- a/profiles/pentoo/base/package.accept_keywords/net-analyzer
+++ b/profiles/pentoo/base/package.accept_keywords/net-analyzer
@@ -11,6 +11,22 @@ net-analyzer/serialusb
 net-analyzer/w3af
 net-analyzer/wpscan
 
+net-analyzer/WhatWaf
+=net-analyzer/wafw00f-1.0*
+
+=net-analyzer/blindelephant-9999 **
+
+net-analyzer/armitage
+net-analyzer/armitage-bin
+net-analyzer/whatweb
+=net-analyzer/set-6*
+
+=net-analyzer/bettercap-2*
+=net-analyzer/crackmapexec-3.1*
+=net-analyzer/dnsrecon-0.9*
+=net-analyzer/fierce-1.3*
+=net-analyzer/ike-scan-1.9*
+
 ### Gentoo (unverified) ###
 
 net-analyzer/mdns-scan
@@ -19,25 +35,13 @@ net-analyzer/mdns-scan
 
 net-analyzer/ostinato
 
-=net-analyzer/set-6*
 net-analyzer/dnsenum
 net-analyzer/packit
 =net-analyzer/plecost-9999
-=net-analyzer/wafw00f-1.0*
 =net-analyzer/wafp-9999
 <net-analyzer/metasploit-9999 **
-net-analyzer/armitage
-net-analyzer/armitage-bin
-net-analyzer/whatweb
 net-analyzer/multimon-ng
 
-#upstream bug https://bugs.gentoo.org/show_bug.cgi?id=599216
-~net-analyzer/wireshark-3.0.0
-
-=net-analyzer/blindelephant-9999 **
-
-=net-analyzer/bettercap-2*
-
 ~net-analyzer/aimsniff-0.9d
 ~net-analyzer/arpantispoofer-1.0.1.32
 ~net-analyzer/arping-2.12
@@ -45,19 +49,15 @@ net-analyzer/multimon-ng
 ~net-analyzer/bmon-2.1.1_pre1
 ~net-analyzer/chaosreader-0.94
 net-analyzer/cloudshark
-=net-analyzer/crackmapexec-3.1*
 ~net-analyzer/davtest-1.0
 ~net-analyzer/dnsa-0.5
-=net-analyzer/dnsrecon-0.9*
 ~net-analyzer/dsniff-2.4_beta1
 ~net-analyzer/enum4linux-0.8.9
-=net-analyzer/fierce-1.3*
 ~net-analyzer/fragroute-1.2.6
 ~net-analyzer/geoedge-0.2
 ~net-analyzer/hunt-1.5-r1
 =net-analyzer/hydra-8*
 net-analyzer/hyenae
-=net-analyzer/ike-scan-1.9*
 ~net-analyzer/inguma-0.4
 =net-analyzer/ipv6toolkit-2.0*
 ~net-analyzer/libnasl-2.2.9