Merge pull request #44 from CybercentreCanada/uri_hostname

Inspect URI hostname as IP or Domain
CybercentreCanada · Nov 8, 2023 · 0cdab42 · 0cdab42
2 parents 57c9ff7 + 42a01b5
commit 0cdab42
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/netrep/netrep.py b/netrep/netrep.py
@@ -92,6 +92,10 @@ def execute(self, request: ServiceRequest):
 
         if request.file_type.startswith("uri/"):
             iocs["uri"].append(request.task.fileinfo.uri_info.uri)
+            if re.match(IP_ONLY_REGEX, request.task.fileinfo.uri_info.hostname):
+                iocs["ip"].append(request.task.fileinfo.uri_info.hostname)
+            else:
+                iocs["domain"].append(request.task.fileinfo.uri_info.hostname)
 
         # Filter out URIs that are emails prefixed by http/s
         # (commonly tagged by OLETools but causes phishing heuristic to be raised because of '@')