@@ -52,13 +52,20 @@ def get_iocs_from_string(
5252include_source_ip :Optional [bool ]= False ,
5353 )-> dict :
5454iocs = Iocs ()
55- string = self .replace_dots_hxxp (string ,ioc_parsing_rules )
5655if not include_ioc_types or "ip" in include_ioc_types :
5756iocs .ip .extend (self ._find_all_str_by_regex (string ,IP_IOC_REGEXP_PATTERN ))
5857if not include_ioc_types or "domain" in include_ioc_types :
59- iocs .domain .extend (self ._find_all_str_by_regex (string ,DOMAIN_IOC_REGEXP_PATTERN ))
58+ for domain in self ._find_all_str_by_regex (string ,DOMAIN_IOC_REGEXP_PATTERN ):
59+ for domain_val in domain :
60+ if domain_val :
61+ iocs .domain .extend (self .replace_dots_hxxp (domain_val ))
6062if not include_ioc_types or "url" in include_ioc_types :
61- iocs .url .extend ([url .rstrip ("." )for url in self ._find_all_str_by_regex (string ,URL_IOC_REGEXP_PATTERN )])
63+ iocs .url .extend (
64+ [
65+ self .replace_dots_hxxp (url ).rstrip ("." )
66+ for url in self ._find_all_str_by_regex (string ,URL_IOC_REGEXP_PATTERN )
67+ ]
68+ )
6269if not include_ioc_types or "hash" in include_ioc_types :
6370if not include_hash_types :
6471include_hash_types = list (hash_regexes .keys ())
@@ -74,7 +81,7 @@ def get_iocs_from_string(
7481raise IocsLimitExceededException (f"IOCs count{ total_count } { limit } )
7582return iocs .return_iocs (include_source_ip )
7683
77- def replace_dots_hxxp (self ,string :str ,ioc_parsing_rules :Optional [list [IocParsingRule ]])-> str :
84+ def replace_dots_hxxp (self ,string :str ,ioc_parsing_rules :Optional [list [IocParsingRule ]]= None )-> str :
7885if ioc_parsing_rules is None or "replace_dots" in ioc_parsing_rules :
7986string = self ._replace_dots (string )
8087if ioc_parsing_rules is None or "replace_hxxp" in ioc_parsing_rules :