ioc_parser
ioc_parser copied to clipboard
domains/urls with -'s
domains with -'s in the like www.malicious-site.com get split down to just 'site.com' which can result in benign sites being pulled as IOCs.
I found the cause for this but have no fix yet. Reason for the split domain matches is the \b word boundary in the regex pattern which in Python apparently matches the dash character (it doesn't in other regex implementations).