URL

Details

ID	`urlRep`
From Version	5.5.0
Reputation Command	`url`
Format Script	FormatURL
Context Path	`URL(val.Data && val.Data === obj.Data)`
Expiration (days)	43200
Layout	URL Indicator

Detection Regex

(?i)\b(?:(?P<full_url>(?P<scheme>(?:https?|hxxps?|s?ftps?|meows?)(?:%3A|\[?[:-]]?)(?://|\|3A__)|mailto:)?(?P<host>(?P<auth>[\p{L}][-_\p{L}\d\[\]]+(?::[\p{L}][-_\p{L}\d\[\]]+)?@)?(?P<simple_domain>(?:[-\d\p{L}_]+\[?\.\]?)*(?:[-\d\p{L}]+\[?\.\]?)(?P<tld>[\p{L}][-\p{L}\d\[\]]+)[.]?)|(?P<IPv4>(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)(?:\[?\.\]?)){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?))|(?P<IPv6>\[?(?:(?:[0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,7}:|(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,5}(?::[0-9a-fA-F]{1,4}){1,2}|(?:[0-9a-fA-F]{1,4}:){1,4}(?::[0-9a-fA-F]{1,4}){1,3}|(?:[0-9a-fA-F]{1,4}:){1,3}(?::[0-9a-fA-F]{1,4}){1,4}|(?:[0-9a-fA-F]{1,4}:){1,2}(?::[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:(?:(?::[0-9a-fA-F]{1,4}){1,6})|:(?:(?::[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(?::[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(?:ffff(?::0{1,4}){0,1}:){0,1}(?:(?:25[0-5]|(?:2[0-4]|1{0,1}[0-9]){0,1}[0-9])\[?\.\]?){3,3}(?:25[0-5]|(?:2[0-4]|1{0,1}[0-9]){0,1}[0-9])|(?:[0-9a-fA-F]{1,4}:){1,4}:(?:(?:25[0-5]|(?:2[0-4]|1{0,1}[0-9]){0,1}[0-9])\[?\.\]?){3,3}(?:25[0-5]|(?:2[0-4]|1{0,1}[0-9]){0,1}[0-9]))(?:\])?))(?P<port>:[\d]+)?(?P<path>[/*#?]+(?:[?\d\p{L}+&@'#%=~_/$!:,.;*–—―\-|\[\]()]*|[(][\-\d\p{L}+&@#/%=~_$?!:,;*–—―|\[\]]*[)]*)*))|(?P<scheme_and_domain_only>(?:(?:https?|hxxps?|s?ftps?|meows?)\[?[:-]]?(?://|\|3A__)|mailto:)(?:(?:[\p{L}][-_\p{L}\d\[\]]+@)?(?:(?:[-_\d\p{L}]+\[?\.\]?)*(?:[-\d\p{L}]+\[?\.\]?)(?:[\p{L}][-\p{L}\d\[\]]+)[.]?)\b|(?:(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)(?:\[?\.\]?)){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?))|(?:\[?(?:(?:[0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,7}:|(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,5}(?::[0-9a-fA-F]{1,4}){1,2}|(?:[0-9a-fA-F]{1,4}:){1,4}(?::[0-9a-fA-F]{1,4}){1,3}|(?:[0-9a-fA-F]{1,4}:){1,3}(?::[0-9a-fA-F]{1,4}){1,4}|(?:[0-9a-fA-F]{1,4}:){1,2}(?::[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:(?:(?::[0-9a-fA-F]{1,4}){1,6})|:(?:(?::[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(?::[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(?:ffff(?::0{1,4}){0,1}:){0,1}(?:(?:25[0-5]|(?:2[0-4]|1{0,1}[0-9]){0,1}[0-9])(?:\[?\.\]?)){3,3}(?:25[0-5]|(?:2[0-4]|1{0,1}[0-9]){0,1}[0-9])|(?:[0-9a-fA-F]{1,4}:){1,4}:(?:(?:25[0-5]|(?:2[0-4]|1{0,1}[0-9]){0,1}[0-9])(?:\[?\.\]?)){3,3}(?:25[0-5]|(?:2[0-4]|1{0,1}[0-9]){0,1}[0-9]))(?:\])?)))|(?P<numerical_ip>(?P<scheme>(?:https?|hxxps?|s?ftps?|meows?)(?:%3A|\[?[:-]]?)(?://|\|3A__))(?P<octal_and_decimal>(?:(?:(?:0x)?[0-9a-f]{1,10}(?:\[?\.\]?)){1,3})?(?:0x)?[0-9a-f]{1,10})(?P<path>[/*#?]+(?:[?\d\p{L}+&@'#%=~_/$!:,.;*–—―\-|\[\]()]*|[(][\-\d\p{L}+&@#/%=~_$?!:,;*–—―|\[\]]*[)])*)))

Enhancement Scripts

URLReputation

Source

reputation-url.json

Download History Raw

{
  "id": "urlRep",
  "version": -1,
  "fromVersion": "5.5.0",
  "modified": "2019-07-18T08:14:49.85543843Z",
  "sortValues": null,
  "commitMessage": "",
  "shouldPublish": false,
  "shouldCommit": false,
  "regex": "(?i)\\b(?:(?P<full_url>(?P<scheme>(?:https?|hxxps?|s?ftps?|meows?)(?:%3A|\\[?[:-]]?)(?://|\\|3A__)|mailto:)?(?P<host>(?P<auth>[\\p{L}][-_\\p{L}\\d\\[\\]]+(?::[\\p{L}][-_\\p{L}\\d\\[\\]]+)?@)?(?P<simple_domain>(?:[-\\d\\p{L}_]+\\[?\\.\\]?)*(?:[-\\d\\p{L}]+\\[?\\.\\]?)(?P<tld>[\\p{L}][-\\p{L}\\d\\[\\]]+)[.]?)|(?P<IPv4>(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)(?:\\[?\\.\\]?)){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?))|(?P<IPv6>\\[?(?:(?:[0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,7}:|(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,5}(?::[0-9a-fA-F]{1,4}){1,2}|(?:[0-9a-fA-F]{1,4}:){1,4}(?::[0-9a-fA-F]{1,4}){1,3}|(?:[0-9a-fA-F]{1,4}:){1,3}(?::[0-9a-fA-F]{1,4}){1,4}|(?:[0-9a-fA-F]{1,4}:){1,2}(?::[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:(?:(?::[0-9a-fA-F]{1,4}){1,6})|:(?:(?::[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(?::[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(?:ffff(?::0{1,4}){0,1}:){0,1}(?:(?:25[0-5]|(?:2[0-4]|1{0,1}[0-9]){0,1}[0-9])\\[?\\.\\]?){3,3}(?:25[0-5]|(?:2[0-4]|1{0,1}[0-9]){0,1}[0-9])|(?:[0-9a-fA-F]{1,4}:){1,4}:(?:(?:25[0-5]|(?:2[0-4]|1{0,1}[0-9]){0,1}[0-9])\\[?\\.\\]?){3,3}(?:25[0-5]|(?:2[0-4]|1{0,1}[0-9]){0,1}[0-9]))(?:\\])?))(?P<port>:[\\d]+)?(?P<path>[/*#?]+(?:[?\\d\\p{L}+&@'#%=~_/$!:,.;*–—―\\-|\\[\\]()]*|[(][\\-\\d\\p{L}+&@#/%=~_$?!:,;*–—―|\\[\\]]*[)]*)*))|(?P<scheme_and_domain_only>(?:(?:https?|hxxps?|s?ftps?|meows?)\\[?[:-]]?(?://|\\|3A__)|mailto:)(?:(?:[\\p{L}][-_\\p{L}\\d\\[\\]]+@)?(?:(?:[-_\\d\\p{L}]+\\[?\\.\\]?)*(?:[-\\d\\p{L}]+\\[?\\.\\]?)(?:[\\p{L}][-\\p{L}\\d\\[\\]]+)[.]?)\\b|(?:(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)(?:\\[?\\.\\]?)){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?))|(?:\\[?(?:(?:[0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,7}:|(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|(?:[0-9a-fA-F]{1,4}:){1,5}(?::[0-9a-fA-F]{1,4}){1,2}|(?:[0-9a-fA-F]{1,4}:){1,4}(?::[0-9a-fA-F]{1,4}){1,3}|(?:[0-9a-fA-F]{1,4}:){1,3}(?::[0-9a-fA-F]{1,4}){1,4}|(?:[0-9a-fA-F]{1,4}:){1,2}(?::[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:(?:(?::[0-9a-fA-F]{1,4}){1,6})|:(?:(?::[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(?::[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(?:ffff(?::0{1,4}){0,1}:){0,1}(?:(?:25[0-5]|(?:2[0-4]|1{0,1}[0-9]){0,1}[0-9])(?:\\[?\\.\\]?)){3,3}(?:25[0-5]|(?:2[0-4]|1{0,1}[0-9]){0,1}[0-9])|(?:[0-9a-fA-F]{1,4}:){1,4}:(?:(?:25[0-5]|(?:2[0-4]|1{0,1}[0-9]){0,1}[0-9])(?:\\[?\\.\\]?)){3,3}(?:25[0-5]|(?:2[0-4]|1{0,1}[0-9]){0,1}[0-9]))(?:\\])?)))|(?P<numerical_ip>(?P<scheme>(?:https?|hxxps?|s?ftps?|meows?)(?:%3A|\\[?[:-]]?)(?://|\\|3A__))(?P<octal_and_decimal>(?:(?:(?:0x)?[0-9a-f]{1,10}(?:\\[?\\.\\]?)){1,3})?(?:0x)?[0-9a-f]{1,10})(?P<path>[/*#?]+(?:[?\\d\\p{L}+&@'#%=~_/$!:,.;*–—―\\-|\\[\\]()]*|[(][\\-\\d\\p{L}+&@#/%=~_$?!:,;*–—―|\\[\\]]*[)])*)))",
  "details": "URL",
  "prevDetails": "URL",
  "reputationScriptName": "",
  "reputationCommand": "url",
  "enhancementScriptNames": [
    "URLReputation"
  ],
  "system": true,
  "locked": false,
  "disabled": false,
  "file": false,
  "updateAfter": 0,
  "mergeContext": false,
  "formatScript": "FormatURL",
  "contextPath": "URL(val.Data \u0026\u0026 val.Data === obj.Data)",
  "contextValue": "Data",
  "excludedBrands": [],
  "expiration": 43200,
  "defaultMapping": {
    "blocked": {
      "simple": "",
      "complex": {
        "root": "URL",
        "filters": [],
        "accessor": "Blocked",
        "transformers": [
          {
            "operator": "uniq",
            "args": {}
          }
        ]
      }
    },
    "detectionengines": {
      "simple": "",
      "complex": {
        "root": "URL",
        "filters": [],
        "accessor": "DetectionEngines",
        "transformers": [
          {
            "operator": "uniq",
            "args": {}
          }
        ]
      }
    },
    "internal": {
      "simple": "",
      "complex": {
        "root": "URL",
        "filters": [],
        "accessor": "Internal",
        "transformers": [
          {
            "operator": "uniq",
            "args": {}
          }
        ]
      }
    },
    "positivedetections": {
      "simple": "",
      "complex": {
        "root": "URL",
        "filters": [],
        "accessor": "PositiveDetections",
        "transformers": [
          {
            "operator": "uniq",
            "args": {}
          }
        ]
      }
    },
    "signed": {
      "simple": "",
      "complex": {
        "root": "URL",
        "filters": [],
        "accessor": "Signed",
        "transformers": [
          {
            "operator": "uniq",
            "args": {}
          }
        ]
      }
    },
    "category": {
      "simple": "",
      "complex": {
        "root": "URL",
        "filters": [],
        "accessor": "Category",
        "transformers": [
          {
            "operator": "uniq",
            "args": {}
          }
        ]
      }
    },
    "associations": {
      "simple": "",
      "complex": {
        "root": "URL",
        "filters": [],
        "accessor": "Associations",
        "transformers": [{
          "operator": "uniq",
          "args": {}
        }]
      }
    },
    "reportedby": {
      "simple": "",
      "complex": {
        "root": "URL",
        "filters": [],
        "accessor": "ReportedBy",
        "transformers": [{
          "operator": "uniq",
          "args": {}
        }]
      }
    },
    "threattypes": {
      "simple": "",
      "complex": {
        "root": "URL",
        "filters": [],
        "accessor": "ThreatTypes",
        "transformers": [{
          "operator": "uniq",
          "args": {}
        }]
      }
    },
    "trafficlightprotocol": {
      "simple": "",
      "complex": {
        "root": "URL",
        "filters": [],
        "accessor": "TrafficLightProtocol",
        "transformers": [{
          "operator": "uniq",
          "args": {}
        }]
      }
    },
    "feedrelatedindicators": {
        "simple": "",
        "complex": {
            "root": "URL",
            "filters": [],
            "accessor": "FeedRelatedIndicators",
            "transformers": [
                {
                    "operator": "uniq",
                    "args": {}
                }
            ]
        }
    },
    "malwarefamily": {
        "simple": "",
        "complex": {
            "root": "URL",
            "filters": [],
            "accessor": "MalwareFamily",
            "transformers": [
                {
                    "operator": "uniq",
                    "args": {}
                }
            ]
        }
    },
    "asn": {
        "simple": "",
        "complex": {
            "root": "URL",
            "filters": [],
            "accessor": "ASN",
            "transformers": [
                {
                    "operator": "uniq",
                    "args": {}
                }
            ]        }
    },
    "asowner": {
        "simple": "",
        "complex": {
            "root": "URL",
            "filters": [],
            "accessor": "ASOwner",
            "transformers": [
                {
                    "operator": "uniq",
                    "args": {}
                }
            ]        }
    },
    "geocountry": {
        "simple": "",
        "complex": {
            "root": "URL.Geo",
            "filters": [],
            "accessor": "Country",
            "transformers": [
                {
                    "operator": "uniq",
                    "args": {}
                }
            ]        }
    },
    "communitynotes": {
        "simple": "",
        "complex": {
            "root": "URL",
            "filters": [],
            "accessor": "CommunityNotes",
            "transformers": [
                {
                    "operator": "uniq",
                    "args": {}
                }
            ]
        }
    },
    "publications": {
        "simple": "",
        "complex": {
            "root": "URL",
            "filters": [],
            "accessor": "Publications",
            "transformers": [
                {
                    "operator": "uniq",
                    "args": {}
                }
            ]
        }
    },
    "tags": {
      "simple": "",
      "complex": {
        "root": "URL",
        "filters": [],
        "accessor": "Tags",
        "transformers": [{
          "operator": "uniq",
          "args": {}
        }]
        }
    },
    "organizationprevalence": {
        "simple": "URL.OrganizationPrevalence",
        "complex": null
    },
    "globalprevalence": {
        "simple": "URL.GlobalPrevalence",
        "complex": null
    },
    "organizationfirstseen": {
        "simple": "URL.OrganizationFirstSeen",
        "complex": null
    },
    "organizationlastseen": {
        "simple": "URL.OrganizationLastSeen",
        "complex": null
    },
    "firstseenbysource": {
        "simple": "URL.FirstSeenBySource",
        "complex": null
    },
    "lastseenbysource": {
        "simple": "URL.LastSeenBySource",
        "complex": null
    }
  },
  "manualMapping": null,
  "fileHashesPriority": null,
  "layout": "urlRep",
  "supportedModules": [
    "agentix",
    "xsiam",
    "xti"
  ]
}