import demistomock as demisto # noqa: F401 from CommonServerPython import * # noqa: F401 """ initial creation by J.H.Stephan """ __version__ = "0.1.a" __license__ = "Mozilla Public License Version 2.0" import re ROOOT_Domain_List = { ".aaa": "[.]aaa", ".aarp": "[.]aarp", ".abb": "[.]abb", ".abbott": "[.]abbott", ".abbvie": "[.]abbvie", ".able": "[.]able", ".abogado": "[.]abogado", ".abudhabi": "[.]abudhabi", ".ac": "[.]ac", ".academy": "[.]academy", ".accenture": "[.]accenture", ".accountant": "[.]accountant", ".accountants": "[.]accountants", ".aco": "[.]aco", ".active": "[.]active", ".actor": "[.]actor", ".ad": "[.]ad", ".adac": "[.]adac", ".ads": "[.]ads", ".adult": "[.]adult", ".ae": "[.]ae", ".aeg": "[.]aeg", ".aero": "[.]aero", ".aetna": "[.]aetna", ".af": "[.]af", ".afl": "[.]afl", ".ag": "[.]ag", ".agakhan": "[.]agakhan", ".agency": "[.]agency", ".ai": "[.]ai", ".aig": "[.]aig", ".airbus": "[.]airbus", ".airforce": "[.]airforce", ".airtel": "[.]airtel", ".akdn": "[.]akdn", ".al": "[.]al", ".alibaba": "[.]alibaba", ".alipay": "[.]alipay", ".allfinanz": "[.]allfinanz", ".allstate": "[.]allstate", ".ally": "[.]ally", ".alsace": "[.]alsace", ".alstom": "[.]alstom", ".am": "[.]am", ".americanfamily": "[.]americanfamily", ".amfam": "[.]amfam", ".amica": "[.]amica", ".amsterdam": "[.]amsterdam", ".an": "[.]an", ".analytics": "[.]analytics", ".android": "[.]android", ".anquan": "[.]anquan", ".anz": "[.]anz", ".ao": "[.]ao", ".apartments": "[.]apartments", ".app": "[.]app", ".apple": "[.]apple", ".aq": "[.]aq", ".aquarelle": "[.]aquarelle", ".ar": "[.]ar", ".aramco": "[.]aramco", ".archi": "[.]archi", ".army": "[.]army", ".arpa": "[.]arpa", ".art": "[.]art", ".arte": "[.]arte", ".as": "[.]as", ".asia": "[.]asia", ".associates": "[.]associates", ".at": "[.]at", ".attorney": "[.]attorney", ".au": "[.]au", ".auction": "[.]auction", ".audi": "[.]audi", ".audible": "[.]audible", ".audio": "[.]audio", ".author": "[.]author", ".auto": "[.]auto", ".autos": "[.]autos", ".avianca": "[.]avianca", ".aw": "[.]aw", ".aws": "[.]aws", ".ax": "[.]ax", ".axa": "[.]axa", ".az": "[.]az", ".azure": "[.]azure", ".ba": "[.]ba", ".baby": "[.]baby", ".baidu": "[.]baidu", ".band": "[.]band", ".bank": "[.]bank", ".bar": "[.]bar", ".barcelona": "[.]barcelona", ".barclaycard": "[.]barclaycard", ".barclays": "[.]barclays", ".barefoot": "[.]barefoot", ".bargains": "[.]bargains", ".bauhaus": "[.]bauhaus", ".bayern": "[.]bayern", ".bb": "[.]bb", ".bbc": "[.]bbc", ".bbt": "[.]bbt", ".bbva": "[.]bbva", ".bcg": "[.]bcg", ".bcn": "[.]bcn", ".bd": "[.]bd", ".be": "[.]be", ".beats": "[.]beats", ".beauty": "[.]beauty", ".beer": "[.]beer", ".bentley": "[.]bentley", ".berlin": "[.]berlin", ".best": "[.]best", ".bestbuy": "[.]bestbuy", ".bet": "[.]bet", ".bf": "[.]bf", ".bg": "[.]bg", ".bh": "[.]bh", ".bharti": "[.]bharti", ".bi": "[.]bi", ".bible": "[.]bible", ".bid": "[.]bid", ".bike": "[.]bike", ".bing": "[.]bing", ".bingo": "[.]bingo", ".bio": "[.]bio", ".biz": "[.]biz", ".bj": "[.]bj", ".bl": "[.]bl", ".black": "[.]black", ".blackfriday": "[.]blackfriday", ".blanco": "[.]blanco", ".blog": "[.]blog", ".bloomberg": "[.]bloomberg", ".blue": "[.]blue", ".bm": "[.]bm", ".bms": "[.]bms", ".bmw": "[.]bmw", ".bn": "[.]bn", ".bnl": "[.]bnl", ".bnpparibas": "[.]bnpparibas", ".bo": "[.]bo", ".boats": "[.]boats", ".boehringer": "[.]boehringer", ".bom": "[.]bom", ".bond": "[.]bond", ".boo": "[.]boo", ".book": "[.]book", ".booking": "[.]booking", ".boots": "[.]boots", ".bosch": "[.]bosch", ".bostik": "[.]bostik", ".bot": "[.]bot", ".boutique": "[.]boutique", ".bq": "[.]bq", ".br": "[.]br", ".bradesco": "[.]bradesco", ".bridgestone": "[.]bridgestone", ".broadway": "[.]broadway", ".broker": "[.]broker", ".brother": "[.]brother", ".brussels": "[.]brussels", ".bs": "[.]bs", ".bt": "[.]bt", ".budapest": "[.]budapest", ".bugatti": "[.]bugatti", ".build": "[.]build", ".builders": "[.]builders", ".business": "[.]business", ".buy": "[.]buy", ".buzz": "[.]buzz", ".bv": "[.]bv", ".bw": "[.]bw", ".by": "[.]by", ".bz": "[.]bz", ".bzh": "[.]bzh", ".ca": "[.]ca", ".cab": "[.]cab", ".cafe": "[.]cafe", ".cal": "[.]cal", ".call": "[.]call", ".cam": "[.]cam", ".camera": "[.]camera", ".camp": "[.]camp", ".cancerresearch": "[.]cancerresearch", ".canon": "[.]canon", ".capetown": "[.]capetown", ".capital": "[.]capital", ".car": "[.]car", ".caravan": "[.]caravan", ".cards": "[.]cards", ".care": "[.]care", ".career": "[.]career", ".careers": "[.]careers", ".cars": "[.]cars", ".cartier": "[.]cartier", ".casa": "[.]casa", ".cash": "[.]cash", ".casino": "[.]casino", ".cat": "[.]cat", ".catering": "[.]catering", ".cba": "[.]cba", ".cbn": "[.]cbn", ".cbre": "[.]cbre", ".cc": "[.]cc", ".cd": "[.]cd", ".ceb": "[.]ceb", ".center": "[.]center", ".ceo": "[.]ceo", ".cern": "[.]cern", ".cf": "[.]cf", ".cfa": "[.]cfa", ".cfd": "[.]cfd", ".cg": "[.]cg", ".ch": "[.]ch", ".chanel": "[.]chanel", ".channel": "[.]channel", ".chase": "[.]chase", ".chat": "[.]chat", ".cheap": "[.]cheap", ".chintai": "[.]chintai", ".chloe": "[.]chloe", ".christmas": "[.]christmas", ".chrome": "[.]chrome", ".church": "[.]church", ".ci": "[.]ci", ".cipriani": "[.]cipriani", ".circle": "[.]circle", ".cisco": "[.]cisco", ".citadel": "[.]citadel", ".citic": "[.]citic", ".city": "[.]city", ".cityeats": "[.]cityeats", ".ck": "[.]ck", ".cl": "[.]cl", ".claims": "[.]claims", ".cleaning": "[.]cleaning", ".click": "[.]click", ".clinic": "[.]clinic", ".clinique": "[.]clinique", ".clothing": "[.]clothing", ".cloud": "[.]cloud", ".club": "[.]club", ".clubmed": "[.]clubmed", ".cm": "[.]cm", ".cn": "[.]cn", ".co": "[.]co", ".coach": "[.]coach", ".codes": "[.]codes", ".coffee": "[.]coffee", ".college": "[.]college", ".cologne": "[.]cologne", ".com": "[.]com", ".comcast": "[.]comcast", ".commbank": "[.]commbank", ".community": "[.]community", ".company": "[.]company", ".compare": "[.]compare", ".computer": "[.]computer", ".comsec": "[.]comsec", ".condos": "[.]condos", ".construction": "[.]construction", ".consulting": "[.]consulting", ".contact": "[.]contact", ".contractors": "[.]contractors", ".cooking": "[.]cooking", ".cookingchannel": "[.]cookingchannel", ".cool": "[.]cool", ".coop": "[.]coop", ".corsica": "[.]corsica", ".country": "[.]country", ".coupon": "[.]coupon", ".coupons": "[.]coupons", ".courses": "[.]courses", ".cr": "[.]cr", ".credit": "[.]credit", ".creditcard": "[.]creditcard", ".creditunion": "[.]creditunion", ".cricket": "[.]cricket", ".crown": "[.]crown", ".crs": "[.]crs", ".cruises": "[.]cruises", ".csc": "[.]csc", ".cu": "[.]cu", ".cuisinella": "[.]cuisinella", ".cv": "[.]cv", ".cw": "[.]cw", ".cx": "[.]cx", ".cy": "[.]cy", ".cymru": "[.]cymru", ".cyou": "[.]cyou", ".cz": "[.]cz", ".dabur": "[.]dabur", ".dad": "[.]dad", ".dance": "[.]dance", ".date": "[.]date", ".dating": "[.]dating", ".datsun": "[.]datsun", ".day": "[.]day", ".dclk": "[.]dclk", ".dds": "[.]dds", ".de": "[.]de", ".deal": "[.]deal", ".dealer": "[.]dealer", ".deals": "[.]deals", ".degree": "[.]degree", ".delivery": "[.]delivery", ".dell": "[.]dell", ".deloitte": "[.]deloitte", ".delta": "[.]delta", ".democrat": "[.]democrat", ".dental": "[.]dental", ".dentist": "[.]dentist", ".desi": "[.]desi", ".design": "[.]design", ".dev": "[.]dev", ".dhl": "[.]dhl", ".diamonds": "[.]diamonds", ".diet": "[.]diet", ".digital": "[.]digital", ".direct": "[.]direct", ".directory": "[.]directory", ".discount": "[.]discount", ".dj": "[.]dj", ".dk": "[.]dk", ".dm": "[.]dm", ".dnp": "[.]dnp", ".do": "[.]do", ".docs": "[.]docs", ".doctor": "[.]doctor", ".dog": "[.]dog", ".doha": "[.]doha", ".domains": "[.]domains", ".doosan": "[.]doosan", ".dot": "[.]dot", ".download": "[.]download", ".drive": "[.]drive", ".dtv": "[.]dtv", ".dubai": "[.]dubai", ".duck": "[.]duck", ".dunlop": "[.]dunlop", ".duns": "[.]duns", ".dupont": "[.]dupont", ".durban": "[.]durban", ".dvag": "[.]dvag", ".dz": "[.]dz", ".earth": "[.]earth", ".eat": "[.]eat", ".ec": "[.]ec", ".edeka": "[.]edeka", ".edu": "[.]edu", ".education": "[.]education", ".ee": "[.]ee", ".eg": "[.]eg", ".eh": "[.]eh", ".email": "[.]email", ".emerck": "[.]emerck", ".energy": "[.]energy", ".engineer": "[.]engineer", ".engineering": "[.]engineering", ".enterprises": "[.]enterprises", ".epost": "[.]epost", ".epson": "[.]epson", ".equipment": "[.]equipment", ".er": "[.]er", ".ericsson": "[.]ericsson", ".erni": "[.]erni", ".es": "[.]es", ".esq": "[.]esq", ".estate": "[.]estate", ".esurance": "[.]esurance", ".et": "[.]et", ".eu": "[.]eu", ".eurovision": "[.]eurovision", ".eus": "[.]eus", ".events": "[.]events", ".everbank": "[.]everbank", ".exchange": "[.]exchange", ".expert": "[.]expert", ".exposed": "[.]exposed", ".express": "[.]express", ".extraspace": "[.]extraspace", ".fage": "[.]fage", ".fail": "[.]fail", ".fairwinds": "[.]fairwinds", ".faith": "[.]faith", ".family": "[.]family", ".fan": "[.]fan", ".fans": "[.]fans", ".farm": "[.]farm", ".farmers": "[.]farmers", ".fashion": "[.]fashion", ".fast": "[.]fast", ".fedex": "[.]fedex", ".feedback": "[.]feedback", ".ferrero": "[.]ferrero", ".fi": "[.]fi", ".film": "[.]film", ".final": "[.]final", ".finance": "[.]finance", ".financial": "[.]financial", ".fire": "[.]fire", ".firestone": "[.]firestone", ".firmdale": "[.]firmdale", ".fish": "[.]fish", ".fishing": "[.]fishing", ".fit": "[.]fit", ".fitness": "[.]fitness", ".fj": "[.]fj", ".fk": "[.]fk", ".flickr": "[.]flickr", ".flights": "[.]flights", ".flir": "[.]flir", ".florist": "[.]florist", ".flowers": "[.]flowers", ".flsmidth": "[.]flsmidth", ".fly": "[.]fly", ".fm": "[.]fm", ".fo": "[.]fo", ".foo": "[.]foo", ".foodnetwork": "[.]foodnetwork", ".football": "[.]football", ".ford": "[.]ford", ".forex": "[.]forex", ".forsale": "[.]forsale", ".forum": "[.]forum", ".foundation": "[.]foundation", ".fox": "[.]fox", ".fr": "[.]fr", ".fresenius": "[.]fresenius", ".frl": "[.]frl", ".frogans": "[.]frogans", ".frontdoor": "[.]frontdoor", ".frontier": "[.]frontier", ".ftr": "[.]ftr", ".fujitsu": "[.]fujitsu", ".fujixerox": "[.]fujixerox", ".fund": "[.]fund", ".furniture": "[.]furniture", ".futbol": "[.]futbol", ".fyi": "[.]fyi", ".ga": "[.]ga", ".gal": "[.]gal", ".gallery": "[.]gallery", ".gallo": "[.]gallo", ".gallup": "[.]gallup", ".game": "[.]game", ".games": "[.]games", ".garden": "[.]garden", ".gb": "[.]gb", ".gbiz": "[.]gbiz", ".gd": "[.]gd", ".gdn": "[.]gdn", ".ge": "[.]ge", ".gea": "[.]gea", ".gent": "[.]gent", ".genting": "[.]genting", ".gf": "[.]gf", ".gg": "[.]gg", ".ggee": "[.]ggee", ".gh": "[.]gh", ".gi": "[.]gi", ".gift": "[.]gift", ".gifts": "[.]gifts", ".gives": "[.]gives", ".giving": "[.]giving", ".gl": "[.]gl", ".glade": "[.]glade", ".glass": "[.]glass", ".gle": "[.]gle", ".global": "[.]global", ".globo": "[.]globo", ".gm": "[.]gm", ".gmail": "[.]gmail", ".gmbh": "[.]gmbh", ".gmo": "[.]gmo", ".gmx": "[.]gmx", ".gn": "[.]gn", ".godaddy": "[.]godaddy", ".gold": "[.]gold", ".goldpoint": "[.]goldpoint", ".golf": "[.]golf", ".goo": "[.]goo", ".goodhands": "[.]goodhands", ".goodyear": "[.]goodyear", ".goog": "[.]goog", ".google": "[.]google", ".gop": "[.]gop", ".got": "[.]got", ".gov": "[.]gov", ".gp": "[.]gp", ".gq": "[.]gq", ".gr": "[.]gr", ".grainger": "[.]grainger", ".graphics": "[.]graphics", ".gratis": "[.]gratis", ".green": "[.]green", ".gripe": "[.]gripe", ".group": "[.]group", ".gs": "[.]gs", ".gt": "[.]gt", ".gu": "[.]gu", ".guardian": "[.]guardian", ".gucci": "[.]gucci", ".guge": "[.]guge", ".guide": "[.]guide", ".guitars": "[.]guitars", ".guru": "[.]guru", ".gw": "[.]gw", ".gy": "[.]gy", ".hamburg": "[.]hamburg", ".hangout": "[.]hangout", ".haus": "[.]haus", ".hdfcbank": "[.]hdfcbank", ".health": "[.]health", ".healthcare": "[.]healthcare", ".help": "[.]help", ".helsinki": "[.]helsinki", ".here": "[.]here", ".hermes": "[.]hermes", ".hgtv": "[.]hgtv", ".hiphop": "[.]hiphop", ".hisamitsu": "[.]hisamitsu", ".hitachi": "[.]hitachi", ".hiv": "[.]hiv", ".hk": "[.]hk", ".hkt": "[.]hkt", ".hm": "[.]hm", ".hn": "[.]hn", ".hockey": "[.]hockey", ".holdings": "[.]holdings", ".holiday": "[.]holiday", ".homedepot": "[.]homedepot", ".homegoods": "[.]homegoods", ".homes": "[.]homes", ".homesense": "[.]homesense", ".honda": "[.]honda", ".honeywell": "[.]honeywell", ".horse": "[.]horse", ".host": "[.]host", ".hosting": "[.]hosting", ".hoteles": "[.]hoteles", ".hotmail": "[.]hotmail", ".house": "[.]house", ".how": "[.]how", ".hr": "[.]hr", ".hsbc": "[.]hsbc", ".ht": "[.]ht", ".htc": "[.]htc", ".hu": "[.]hu", ".hyundai": "[.]hyundai", ".ibm": "[.]ibm", ".icbc": "[.]icbc", ".ice": "[.]ice", ".icu": "[.]icu", ".id": "[.]id", ".ie": "[.]ie", ".ieee": "[.]ieee", ".ifm": "[.]ifm", ".iinet": "[.]iinet", ".ikano": "[.]ikano", ".il": "[.]il", ".im": "[.]im", ".imamat": "[.]imamat", ".imdb": "[.]imdb", ".immo": "[.]immo", ".immobilien": "[.]immobilien", ".in": "[.]in", ".industries": "[.]industries", ".infiniti": "[.]infiniti", ".info": "[.]info", ".ing": "[.]ing", ".ink": "[.]ink", ".institute": "[.]institute", ".insurance": "[.]insurance", ".insure": "[.]insure", ".int": "[.]int", ".international": "[.]international", ".intuit": "[.]intuit", ".investments": "[.]investments", ".io": "[.]io", ".ipiranga": "[.]ipiranga", ".iq": "[.]iq", ".ir": "[.]ir", ".irish": "[.]irish", ".is": "[.]is", ".iselect": "[.]iselect", ".ismaili": "[.]ismaili", ".ist": "[.]ist", ".istanbul": "[.]istanbul", ".it": "[.]it", ".itau": "[.]itau", ".itv": "[.]itv", ".iwc": "[.]iwc", ".jaguar": "[.]jaguar", ".java": "[.]java", ".jcb": "[.]jcb", ".jcp": "[.]jcp", ".je": "[.]je", ".jetzt": "[.]jetzt", ".jewelry": "[.]jewelry", ".jlc": "[.]jlc", ".jll": "[.]jll", ".jm": "[.]jm", ".jmp": "[.]jmp", ".jnj": "[.]jnj", ".jo": "[.]jo", ".jobs": "[.]jobs", ".joburg": "[.]joburg", ".jot": "[.]jot", ".joy": "[.]joy", ".jp": "[.]jp", ".jpmorgan": "[.]jpmorgan", ".jprs": "[.]jprs", ".juegos": "[.]juegos", ".kaufen": "[.]kaufen", ".kddi": "[.]kddi", ".ke": "[.]ke", ".kerryhotels": "[.]kerryhotels", ".kerrylogistics": "[.]kerrylogistics", ".kerryproperties": "[.]kerryproperties", ".kfh": "[.]kfh", ".kg": "[.]kg", ".kh": "[.]kh", ".ki": "[.]ki", ".kia": "[.]kia", ".kim": "[.]kim", ".kinder": "[.]kinder", ".kindle": "[.]kindle", ".kitchen": "[.]kitchen", ".kiwi": "[.]kiwi", ".km": "[.]km", ".kn": "[.]kn", ".koeln": "[.]koeln", ".komatsu": "[.]komatsu", ".kosher": "[.]kosher", ".kp": "[.]kp", ".kpmg": "[.]kpmg", ".kpn": "[.]kpn", ".kr": "[.]kr", ".krd": "[.]krd", ".kred": "[.]kred", ".kuokgroup": "[.]kuokgroup", ".kw": "[.]kw", ".ky": "[.]ky", ".kyoto": "[.]kyoto", ".kz": "[.]kz", ".la": "[.]la", ".lacaixa": "[.]lacaixa", ".lamborghini": "[.]lamborghini", ".lamer": "[.]lamer", ".lancaster": "[.]lancaster", ".lancome": "[.]lancome", ".land": "[.]land", ".landrover": "[.]landrover", ".lanxess": "[.]lanxess", ".lasalle": "[.]lasalle", ".lat": "[.]lat", ".latrobe": "[.]latrobe", ".law": "[.]law", ".lawyer": "[.]lawyer", ".lb": "[.]lb", ".lc": "[.]lc", ".lds": "[.]lds", ".lease": "[.]lease", ".leclerc": "[.]leclerc", ".lefrak": "[.]lefrak", ".legal": "[.]legal", ".lego": "[.]lego", ".lexus": "[.]lexus", ".lgbt": "[.]lgbt", ".li": "[.]li", ".liaison": "[.]liaison", ".lidl": "[.]lidl", ".life": "[.]life", ".lifeinsurance": "[.]lifeinsurance", ".lifestyle": "[.]lifestyle", ".lighting": "[.]lighting", ".like": "[.]like", ".limited": "[.]limited", ".limo": "[.]limo", ".lincoln": "[.]lincoln", ".linde": "[.]linde", ".link": "[.]link", ".lipsy": "[.]lipsy", ".live": "[.]live", ".living": "[.]living", ".lixil": "[.]lixil", ".lk": "[.]lk", ".loan": "[.]loan", ".loans": "[.]loans", ".locker": "[.]locker", ".locus": "[.]locus", ".lol": "[.]lol", ".london": "[.]london", ".lotte": "[.]lotte", ".lotto": "[.]lotto", ".love": "[.]love", ".lpl": "[.]lpl", ".lplfinancial": "[.]lplfinancial", ".lr": "[.]lr", ".ls": "[.]ls", ".lt": "[.]lt", ".ltd": "[.]ltd", ".ltda": "[.]ltda", ".lu": "[.]lu", ".lundbeck": "[.]lundbeck", ".lupin": "[.]lupin", ".luxe": "[.]luxe", ".luxury": "[.]luxury", ".lv": "[.]lv", ".ly": "[.]ly", ".ma": "[.]ma", ".macys": "[.]macys", ".madrid": "[.]madrid", ".maif": "[.]maif", ".maison": "[.]maison", ".makeup": "[.]makeup", ".man": "[.]man", ".management": "[.]management", ".mango": "[.]mango", ".market": "[.]market", ".marketing": "[.]marketing", ".markets": "[.]markets", ".marriott": "[.]marriott", ".marshalls": "[.]marshalls", ".mattel": "[.]mattel", ".mba": "[.]mba", ".mc": "[.]mc", ".md": "[.]md", ".me": "[.]me", ".med": "[.]med", ".media": "[.]media", ".meet": "[.]meet", ".melbourne": "[.]melbourne", ".meme": "[.]meme", ".memorial": "[.]memorial", ".men": "[.]men", ".menu": "[.]menu", ".meo": "[.]meo", ".metlife": "[.]metlife", ".mf": "[.]mf", ".mg": "[.]mg", ".mh": "[.]mh", ".miami": "[.]miami", ".microsoft": "[.]microsoft", ".mil": "[.]mil", ".mini": "[.]mini", ".mint": "[.]mint", ".mit": "[.]mit", ".mitsubishi": "[.]mitsubishi", ".mk": "[.]mk", ".ml": "[.]ml", ".mlb": "[.]mlb", ".mls": "[.]mls", ".mm": "[.]mm", ".mma": "[.]mma", ".mn": "[.]mn", ".mo": "[.]mo", ".mobi": "[.]mobi", ".mobily": "[.]mobily", ".moda": "[.]moda", ".moe": "[.]moe", ".moi": "[.]moi", ".mom": "[.]mom", ".monash": "[.]monash", ".money": "[.]money", ".montblanc": "[.]montblanc", ".mormon": "[.]mormon", ".mortgage": "[.]mortgage", ".moscow": "[.]moscow", ".motorcycles": "[.]motorcycles", ".mov": "[.]mov", ".movie": "[.]movie", ".movistar": "[.]movistar", ".mp": "[.]mp", ".mq": "[.]mq", ".mr": "[.]mr", ".ms": "[.]ms", ".msd": "[.]msd", ".mt": "[.]mt", ".mtn": "[.]mtn", ".mtpc": "[.]mtpc", ".mtr": "[.]mtr", ".mu": "[.]mu", ".museum": "[.]museum", ".mutual": "[.]mutual", ".mutuelle": "[.]mutuelle", ".mv": "[.]mv", ".mw": "[.]mw", ".mx": "[.]mx", ".my": "[.]my", ".mz": "[.]mz", ".na": "[.]na", ".nadex": "[.]nadex", ".nagoya": "[.]nagoya", ".name": "[.]name", ".nationwide": "[.]nationwide", ".natura": "[.]natura", ".navy": "[.]navy", ".nc": "[.]nc", ".ne": "[.]ne", ".nec": "[.]nec", ".net": "[.]net", ".netbank": "[.]netbank", ".netflix": "[.]netflix", ".network": "[.]network", ".neustar": "[.]neustar", ".new": "[.]new", ".news": "[.]news", ".next": "[.]next", ".nextdirect": "[.]nextdirect", ".nexus": "[.]nexus", ".nf": "[.]nf", ".nfl": "[.]nfl", ".ng": "[.]ng", ".ngo": "[.]ngo", ".nhk": "[.]nhk", ".ni": "[.]ni", ".nico": "[.]nico", ".nike": "[.]nike", ".nikon": "[.]nikon", ".ninja": "[.]ninja", ".nissan": "[.]nissan", ".nissay": "[.]nissay", ".nl": "[.]nl", ".no": "[.]no", ".nokia": "[.]nokia", ".northwesternmutual": "[.]northwesternmutual", ".norton": "[.]norton", ".now": "[.]now", ".nowruz": "[.]nowruz", ".nowtv": "[.]nowtv", ".np": "[.]np", ".nr": "[.]nr", ".nra": "[.]nra", ".nrw": "[.]nrw", ".ntt": "[.]ntt", ".nu": "[.]nu", ".nyc": "[.]nyc", ".nz": "[.]nz", ".obi": "[.]obi", ".off": "[.]off", ".office": "[.]office", ".okinawa": "[.]okinawa", ".olayan": "[.]olayan", ".olayangroup": "[.]olayangroup", ".ollo": "[.]ollo", ".om": "[.]om", ".omega": "[.]omega", ".one": "[.]one", ".ong": "[.]ong", ".onl": "[.]onl", ".online": "[.]online", ".onyourside": "[.]onyourside", ".ooo": "[.]ooo", ".oracle": "[.]oracle", ".orange": "[.]orange", ".org": "[.]org", ".organic": "[.]organic", ".orientexpress": "[.]orientexpress", ".origins": "[.]origins", ".osaka": "[.]osaka", ".otsuka": "[.]otsuka", ".ott": "[.]ott", ".ovh": "[.]ovh", ".pa": "[.]pa", ".page": "[.]page", ".pamperedchef": "[.]pamperedchef", ".panasonic": "[.]panasonic", ".panerai": "[.]panerai", ".paris": "[.]paris", ".pars": "[.]pars", ".partners": "[.]partners", ".parts": "[.]parts", ".party": "[.]party", ".passagens": "[.]passagens", ".pccw": "[.]pccw", ".pe": "[.]pe", ".pet": "[.]pet", ".pf": "[.]pf", ".pfizer": "[.]pfizer", ".pg": "[.]pg", ".ph": "[.]ph", ".pharmacy": "[.]pharmacy", ".philips": "[.]philips", ".photo": "[.]photo", ".photography": "[.]photography", ".photos": "[.]photos", ".physio": "[.]physio", ".piaget": "[.]piaget", ".pics": "[.]pics", ".pictet": "[.]pictet", ".pictures": "[.]pictures", ".pid": "[.]pid", ".pin": "[.]pin", ".ping": "[.]ping", ".pink": "[.]pink", ".pioneer": "[.]pioneer", ".pizza": "[.]pizza", ".pk": "[.]pk", ".pl": "[.]pl", ".place": "[.]place", ".play": "[.]play", ".playstation": "[.]playstation", ".plumbing": "[.]plumbing", ".plus": "[.]plus", ".pm": "[.]pm", ".pn": "[.]pn", ".pnc": "[.]pnc", ".pohl": "[.]pohl", ".poker": "[.]poker", ".politie": "[.]politie", ".porn": "[.]porn", ".post": "[.]post", ".pr": "[.]pr", ".praxi": "[.]praxi", ".press": "[.]press", ".prime": "[.]prime", ".pro": "[.]pro", ".prod": "[.]prod", ".productions": "[.]productions", ".prof": "[.]prof", ".progressive": "[.]progressive", ".promo": "[.]promo", ".properties": "[.]properties", ".property": "[.]property", ".protection": "[.]protection", ".ps": "[.]ps", ".pt": "[.]pt", ".pub": "[.]pub", ".pw": "[.]pw", ".pwc": "[.]pwc", ".py": "[.]py", ".qa": "[.]qa", ".qpon": "[.]qpon", ".quebec": "[.]quebec", ".quest": "[.]quest", ".racing": "[.]racing", ".raid": "[.]raid", ".re": "[.]re", ".read": "[.]read", ".realestate": "[.]realestate", ".realtor": "[.]realtor", ".realty": "[.]realty", ".recipes": "[.]recipes", ".red": "[.]red", ".redstone": "[.]redstone", ".redumbrella": "[.]redumbrella", ".rehab": "[.]rehab", ".reise": "[.]reise", ".reisen": "[.]reisen", ".reit": "[.]reit", ".ren": "[.]ren", ".rent": "[.]rent", ".rentals": "[.]rentals", ".repair": "[.]repair", ".report": "[.]report", ".republican": "[.]republican", ".rest": "[.]rest", ".restaurant": "[.]restaurant", ".review": "[.]review", ".reviews": "[.]reviews", ".rexroth": "[.]rexroth", ".rich": "[.]rich", ".richardli": "[.]richardli", ".ricoh": "[.]ricoh", ".rightathome": "[.]rightathome", ".rio": "[.]rio", ".rip": "[.]rip", ".ro": "[.]ro", ".rocher": "[.]rocher", ".rocks": "[.]rocks", ".rodeo": "[.]rodeo", ".room": "[.]room", ".rs": "[.]rs", ".rsvp": "[.]rsvp", ".ru": "[.]ru", ".ruhr": "[.]ruhr", ".run": "[.]run", ".rw": "[.]rw", ".rwe": "[.]rwe", ".ryukyu": "[.]ryukyu", ".sa": "[.]sa", ".saarland": "[.]saarland", ".safe": "[.]safe", ".safety": "[.]safety", ".sakura": "[.]sakura", ".sale": "[.]sale", ".salon": "[.]salon", ".samsung": "[.]samsung", ".sandvik": "[.]sandvik", ".sandvikcoromant": "[.]sandvikcoromant", ".sanofi": "[.]sanofi", ".sap": "[.]sap", ".sapo": "[.]sapo", ".sarl": "[.]sarl", ".sas": "[.]sas", ".save": "[.]save", ".saxo": "[.]saxo", ".sb": "[.]sb", ".sbi": "[.]sbi", ".sbs": "[.]sbs", ".sc": "[.]sc", ".sca": "[.]sca", ".scb": "[.]scb", ".schaeffler": "[.]schaeffler", ".schmidt": "[.]schmidt", ".scholarships": "[.]scholarships", ".school": "[.]school", ".schule": "[.]schule", ".schwarz": "[.]schwarz", ".science": "[.]science", ".scjohnson": "[.]scjohnson", ".scor": "[.]scor", ".scot": "[.]scot", ".sd": "[.]sd", ".se": "[.]se", ".seat": "[.]seat", ".security": "[.]security", ".seek": "[.]seek", ".select": "[.]select", ".sener": "[.]sener", ".services": "[.]services", ".ses": "[.]ses", ".seven": "[.]seven", ".sew": "[.]sew", ".sex": "[.]sex", ".sexy": "[.]sexy", ".sfr": "[.]sfr", ".sg": "[.]sg", ".sh": "[.]sh", ".shangrila": "[.]shangrila", ".sharp": "[.]sharp", ".shaw": "[.]shaw", ".shell": "[.]shell", ".shia": "[.]shia", ".shiksha": "[.]shiksha", ".shoes": "[.]shoes", ".shop": "[.]shop", ".shopping": "[.]shopping", ".shouji": "[.]shouji", ".show": "[.]show", ".shriram": "[.]shriram", ".si": "[.]si", ".silk": "[.]silk", ".sina": "[.]sina", ".singles": "[.]singles", ".site": "[.]site", ".sj": "[.]sj", ".sk": "[.]sk", ".ski": "[.]ski", ".skin": "[.]skin", ".sky": "[.]sky", ".skype": "[.]skype", ".sl": "[.]sl", ".sm": "[.]sm", ".smart": "[.]smart", ".smile": "[.]smile", ".sn": "[.]sn", ".sncf": "[.]sncf", ".so": "[.]so", ".soccer": "[.]soccer", ".social": "[.]social", ".softbank": "[.]softbank", ".software": "[.]software", ".sohu": "[.]sohu", ".solar": "[.]solar", ".solutions": "[.]solutions", ".song": "[.]song", ".sony": "[.]sony", ".soy": "[.]soy", ".space": "[.]space", ".spiegel": "[.]spiegel", ".spot": "[.]spot", ".spreadbetting": "[.]spreadbetting", ".sr": "[.]sr", ".srl": "[.]srl", ".ss": "[.]ss", ".st": "[.]st", ".stada": "[.]stada", ".staples": "[.]staples", ".star": "[.]star", ".starhub": "[.]starhub", ".statebank": "[.]statebank", ".statefarm": "[.]statefarm", ".statoil": "[.]statoil", ".stc": "[.]stc", ".stcgroup": "[.]stcgroup", ".stockholm": "[.]stockholm", ".storage": "[.]storage", ".store": "[.]store", ".stream": "[.]stream", ".studio": "[.]studio", ".study": "[.]study", ".style": "[.]style", ".su": "[.]su", ".sucks": "[.]sucks", ".supplies": "[.]supplies", ".supply": "[.]supply", ".support": "[.]support", ".surf": "[.]surf", ".surgery": "[.]surgery", ".suzuki": "[.]suzuki", ".sv": "[.]sv", ".swatch": "[.]swatch", ".swiftcover": "[.]swiftcover", ".swiss": "[.]swiss", ".sx": "[.]sx", ".sy": "[.]sy", ".sydney": "[.]sydney", ".symantec": "[.]symantec", ".systems": "[.]systems", ".sz": "[.]sz", ".tab": "[.]tab", ".taipei": "[.]taipei", ".talk": "[.]talk", ".taobao": "[.]taobao", ".tatamotors": "[.]tatamotors", ".tatar": "[.]tatar", ".tattoo": "[.]tattoo", ".tax": "[.]tax", ".taxi": "[.]taxi", ".tc": "[.]tc", ".tci": "[.]tci", ".td": "[.]td", ".tdk": "[.]tdk", ".team": "[.]team", ".tech": "[.]tech", ".technology": "[.]technology", ".tel": "[.]tel", ".telecity": "[.]telecity", ".telefonica": "[.]telefonica", ".temasek": "[.]temasek", ".tennis": "[.]tennis", ".teva": "[.]teva", ".tf": "[.]tf", ".tg": "[.]tg", ".th": "[.]th", ".thd": "[.]thd", ".theater": "[.]theater", ".theatre": "[.]theatre", ".tiaa": "[.]tiaa", ".tickets": "[.]tickets", ".tienda": "[.]tienda", ".tiffany": "[.]tiffany", ".tips": "[.]tips", ".tires": "[.]tires", ".tirol": "[.]tirol", ".tj": "[.]tj", ".tjmaxx": "[.]tjmaxx", ".tjx": "[.]tjx", ".tk": "[.]tk", ".tkmaxx": "[.]tkmaxx", ".tl": "[.]tl", ".tm": "[.]tm", ".tmall": "[.]tmall", ".tn": "[.]tn", ".to": "[.]to", ".today": "[.]today", ".tokyo": "[.]tokyo", ".tools": "[.]tools", ".top": "[.]top", ".toray": "[.]toray", ".toshiba": "[.]toshiba", ".total": "[.]total", ".tours": "[.]tours", ".town": "[.]town", ".toyota": "[.]toyota", ".toys": "[.]toys", ".tp": "[.]tp", ".tr": "[.]tr", ".trade": "[.]trade", ".trading": "[.]trading", ".training": "[.]training", ".travel": "[.]travel", ".travelchannel": "[.]travelchannel", ".travelers": "[.]travelers", ".travelersinsurance": "[.]travelersinsurance", ".trust": "[.]trust", ".trv": "[.]trv", ".tt": "[.]tt", ".tube": "[.]tube", ".tui": "[.]tui", ".tunes": "[.]tunes", ".tushu": "[.]tushu", ".tv": "[.]tv", ".tvs": "[.]tvs", ".tw": "[.]tw", ".tz": "[.]tz", ".ua": "[.]ua", ".ubs": "[.]ubs", ".ug": "[.]ug", ".uk": "[.]uk", ".um": "[.]um", ".unicom": "[.]unicom", ".university": "[.]university", ".uno": "[.]uno", ".uol": "[.]uol", ".ups": "[.]ups", ".us": "[.]us", ".uy": "[.]uy", ".uz": "[.]uz", ".va": "[.]va", ".vacations": "[.]vacations", ".vana": "[.]vana", ".vc": "[.]vc", ".ve": "[.]ve", ".vegas": "[.]vegas", ".ventures": "[.]ventures", ".verisign": "[.]verisign", ".versicherung": "[.]versicherung", ".vet": "[.]vet", ".vg": "[.]vg", ".vi": "[.]vi", ".viajes": "[.]viajes", ".video": "[.]video", ".vig": "[.]vig", ".viking": "[.]viking", ".villas": "[.]villas", ".vin": "[.]vin", ".vip": "[.]vip", ".virgin": "[.]virgin", ".visa": "[.]visa", ".vision": "[.]vision", ".vista": "[.]vista", ".vistaprint": "[.]vistaprint", ".viva": "[.]viva", ".vivo": "[.]vivo", ".vlaanderen": "[.]vlaanderen", ".vn": "[.]vn", ".vodka": "[.]vodka", ".volkswagen": "[.]volkswagen", ".vote": "[.]vote", ".voting": "[.]voting", ".voto": "[.]voto", ".voyage": "[.]voyage", ".vu": "[.]vu", ".vuelos": "[.]vuelos", ".wales": "[.]wales", ".walter": "[.]walter", ".wang": "[.]wang", ".wanggou": "[.]wanggou", ".warman": "[.]warman", ".watch": "[.]watch", ".watches": "[.]watches", ".weather": "[.]weather", ".weatherchannel": "[.]weatherchannel", ".webcam": "[.]webcam", ".weber": "[.]weber", ".website": "[.]website", ".wed": "[.]wed", ".wedding": "[.]wedding", ".weibo": "[.]weibo", ".weir": "[.]weir", ".wf": "[.]wf", ".whoswho": "[.]whoswho", ".wien": "[.]wien", ".wiki": "[.]wiki", ".williamhill": "[.]williamhill", ".win": "[.]win", ".windows": "[.]windows", ".wine": "[.]wine", ".winners": "[.]winners", ".wme": "[.]wme", ".wolterskluwer": "[.]wolterskluwer", ".woodside": "[.]woodside", ".work": "[.]work", ".works": "[.]works", ".world": "[.]world", ".ws": "[.]ws", ".wtc": "[.]wtc", ".wtf": "[.]wtf", ".xbox": "[.]xbox", ".xerox": "[.]xerox", ".xfinity": "[.]xfinity", ".xihuan": "[.]xihuan", ".xin": "[.]xin", ".xperia": "[.]xperia", ".xxx": "[.]xxx", ".xyz": "[.]xyz", ".yachts": "[.]yachts", ".yahoo": "[.]yahoo", ".yamaxun": "[.]yamaxun", ".yandex": "[.]yandex", ".ye": "[.]ye", ".yodobashi": "[.]yodobashi", ".yoga": "[.]yoga", ".yokohama": "[.]yokohama", ".you": "[.]you", ".youtube": "[.]youtube", ".yt": "[.]yt", ".yun": "[.]yun", ".za": "[.]za", ".zappos": "[.]zappos", ".zara": "[.]zara", ".zero": "[.]zero", ".zip": "[.]zip", ".zippo": "[.]zippo", ".zm": "[.]zm", ".zone": "[.]zone", ".zuerich": "[.]zuerich", ".zw": "[.]zw", } def redactIP(ip): iplist = ip.split(".") newip = ".".join(iplist[0:3]) + "[.]" + iplist[3] return newip def redactemail(email): itemlist = email.split("@") domain = itemlist[1].split(".") newdomain = ".".join(domain[0 : len(domain) - 1]) + "[.]" + str(domain[-1]) newemail = itemlist[0] + "[@]" + str(newdomain) return newemail def main(): try: args = demisto.args() if not args.get("value") and not args.get("indicator"): return_error('Must provide either arg "value" or arg "indicator".') text = args.get("value", args.get("indicator")) searchkey = demisto.args().get("searchkey") ip = re.compile(r"\b(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\b") redactDictBASIC = {"http": "hxxp", "meow": "hxxp", "HTTP": "hxxp"} redactDict = {} searchkeyDict = {} if searchkey is not None and len(searchkey) > 1: Redact_String = "" for item in searchkey.split(","): if item.startswith("$#="): Redact_String = item.split("=")[1] else: searchkeyDict.update({item.strip(): Redact_String}) for key, value in searchkeyDict.items(): text = text.replace(str(key).strip(), str(value).strip()) for item in ip.findall(text): redactDict.update({item: redactIP(item)}) email = re.compile(r"[\w\.-]+@[\w\.-]+") for item in email.findall(text): redactDict.update({item: redactemail(item)}) for key, value in redactDict.items(): text = text.replace(str(key).strip(), str(value).strip()) for key, value in redactDictBASIC.items(): text = text.replace(str(key).strip(), str(value).strip()) for key, value in ROOOT_Domain_List.items(): text = text.replace(str(key).strip(), str(value).strip()) output = CommandResults(outputs_prefix="Redacted_inicator", outputs=text) return_results(output) except Exception as ex: demisto.error(traceback.format_exc()) # print the traceback return_error(f"Failed to execute redactindicator. Error: {str(ex)}") if __name__ in ("__main__", "__builtin__", "builtins"): main()