new de-defangs

1. {.} => .
2. {@} => @
3. allow whitespace before and after special defangs like {.}, [@],
(at), etc.

xioc/funcs.go

@@ -23,14 +23,14 @@ func init() {
 	}
 }
 
-var dot = `(\.| dot |\(dot\)|\[dot\]|\(\.\)|\[\.\])`
+var dot = `(\.|\p{Z}dot\p{Z}|\p{Z}?(\(dot\)|\[dot\]|\(\.\)|\[\.\]|\{\.\})\p{Z}?)`
 var dotRegex = regexp.MustCompile(`(?i)` + dot)
 
 func replaceDot(s string) string {
 	return dotRegex.ReplaceAllString(s, ".")
 }
 
-var at = `(@| at |\(at\)|\[at\]|\(@\)|\[@\])`
+var at = `(@|\p{Z}at\p{Z}|\p{Z}?(\(at\)|\[at\]|\(@\)|\[@\]|\{@\})\p{Z}?)`
 var atRegex = regexp.MustCompile(`(?i)` + at)
 
 func replaceAt(s string) string {

xioc/tests.json

@@ -585,5 +585,17 @@
   "hxxp://papaya.рф/sitemap.xml": {
     "urls": ["http://papaya.рф/sitemap.xml"],
     "domains": ["papaya.рф"]
+  },
+  "hxxps://revcode{.}eu/": {
+    "urls": ["https://revcode.eu/"],
+    "domains": ["revcode.eu"]
+  },
+  "research {@} fireeye DOT COM": {
+    "emails": ["research@fireeye.com"],
+    "domains": ["fireeye.com"]
+  },
+  "aminjalali_58 (at) yahoo.com intelreports (at) kaspersky [dot] com": {
+    "emails": ["aminjalali_58@yahoo.com", "intelreports@kaspersky.com"],
+    "domains": ["yahoo.com", "kaspersky.com"]
   }
 }