diff --git a/xioc/funcs.go b/xioc/funcs.go index 9a66337..0e9cecf 100644 --- a/xioc/funcs.go +++ b/xioc/funcs.go @@ -23,14 +23,14 @@ func init() { } } -var dot = `(\.| dot |\(dot\)|\[dot\]|\(\.\)|\[\.\])` +var dot = `(\.|\p{Z}dot\p{Z}|\p{Z}?(\(dot\)|\[dot\]|\(\.\)|\[\.\]|\{\.\})\p{Z}?)` var dotRegex = regexp.MustCompile(`(?i)` + dot) func replaceDot(s string) string { return dotRegex.ReplaceAllString(s, ".") } -var at = `(@| at |\(at\)|\[at\]|\(@\)|\[@\])` +var at = `(@|\p{Z}at\p{Z}|\p{Z}?(\(at\)|\[at\]|\(@\)|\[@\]|\{@\})\p{Z}?)` var atRegex = regexp.MustCompile(`(?i)` + at) func replaceAt(s string) string { diff --git a/xioc/tests.json b/xioc/tests.json index 4aec23e..71316da 100644 --- a/xioc/tests.json +++ b/xioc/tests.json @@ -585,5 +585,17 @@ "hxxp://papaya.рф/sitemap.xml": { "urls": ["http://papaya.рф/sitemap.xml"], "domains": ["papaya.рф"] + }, + "hxxps://revcode{.}eu/": { + "urls": ["https://revcode.eu/"], + "domains": ["revcode.eu"] + }, + "research {@} fireeye DOT COM": { + "emails": ["research@fireeye.com"], + "domains": ["fireeye.com"] + }, + "aminjalali_58 (at) yahoo.com intelreports (at) kaspersky [dot] com": { + "emails": ["aminjalali_58@yahoo.com", "intelreports@kaspersky.com"], + "domains": ["yahoo.com", "kaspersky.com"] } }