commonfields:
  id: EmailDomainSquattingReputation
  version: -1
name: EmailDomainSquattingReputation
script: ''
type: javascript
tags:
- email
- reputation
comment: Check if an email address's domain is trying to squat other domain using Levenshtein distance algorithm.
system: true
args:
- name: email
  required: true
  default: true
  description: The email address to check.
- name: domain
  required: true
  description: The domain list to check against for squatting (comma separated).
  isArray: true
- name: threshold
  description: The similarity threshold.
  defaultValue: "3"
outputs:
- contextPath: Account
  description: 'A user account.'
- contextPath: Account.Email
  description: The account email object.
- contextPath: Account.Email.Username
  description: The account email username.
  type: string
- contextPath: Account.Email.Address
  description: The account email address.
  type: string
- contextPath: Account.Email.Domain
  description: The account email domain.
  type: string
- contextPath: Account.Email.Distance
  description: The email address distance compare to the domains in query.
  type: number
- contextPath: Account.Email.Distance.Domain
  description: The compared domain.
  type: string
- contextPath: Account.Email.Distance.Value
  description: 'The distance between the email domain and the compared domain.'
  type: number
- contextPath: DBotScore.Indicator
  description: The Indicator.
  type: string
- contextPath: DBotScore.Type
  description: The Indicator Type.
  type: string
- contextPath: DBotScore.Vendor
  description: The DBot score vendor.
  type: string
- contextPath: DBotScore.Score
  description: The DBot score.
  type: number
scripttarget: 0
fromversion: 5.0.0
tests:
- EmailDomainSquattingReputation-Test