De-de-fang URLs and IP addresses

[krmaxwell]

Look for (dot) and [dot] and the like, translate them to something useful.

[sroberts]

Gah that's a great idea, we'll just have to build out the whole list.

[krmaxwell]

Okay, so what are the most common things here?

• 192[.]168[.]1[.]1 (where there may be <3 of those, like only the separator for the last octet)
• example dot com
• mailme at example dot com
• hxxp://example.com

The above could be mixed too.

Any others?

[sroberts]

I think those are the core ones, the simpler way to fix them the better.

I'd also add (.) just to be safe.

[deadbits]

python-iocextract will defang / refang URLs it extracts from content. could be worth a look for this https://github.com/InQuest/python-iocextract