Skip to content

Instantly share code, notes, and snippets.

View jatrost's full-sized avatar

Jason Trost jatrost

View GitHub Profile
email_provider count
Mail in Black 244
Censornet 200
email_provider count
Symantec 12864
Trend Micro 6494
Barracuda 2253
Sophos 2114
vadesecure 1583
Mailprotector 1234
FireEye 963
DuoCircle 921
SpamTitan 662
email_provider count
Proofpoint 42310
Mimecast 36064
Deteque 34759
Barracuda 22897
Solarwinds 14681
Symantec 13832
AppRiver 11149
Protonmail 8158
Trend Micro 8055
email_provider count
Proofpoint 340
Cisco Ironport 75
Mimecast 65
Symantec 54
FireEye 14
Trend Micro 4
Forcepoint 4
CSC Digital Brand Services 4
Barracuda 4
import tldextract
import sys
for line in sys.stdin:
try:
sld = tldextract.extract(line.strip()).registered_domain
if sld:
print(sld)
except:
pass
@jatrost
jatrost / download_historic_alexa_top_domains.sh
Created February 13, 2020 01:00
Downloads the historic top Alexa domains from the Way Back Machine (Internet Archive)
#!/bin/bash
# makes this MacOS compatible
DATE_CMD=$(which gdate || which date)
for DAY_AGO in {0..30};
do
DATE_FILE=$(${DATE_CMD} -d "$DAY_AGO days ago" +%F)
DATE_URL=$(${DATE_CMD} -d "$DAY_AGO days ago" +%F | sed 's/-//g')
##! Extract and include the header names used for each request in the HTTP
##! logging stream. The headers in the logging stream will be stored in the
##! same order which they were seen on the wire.
@load base/protocols/http/main
module HTTP;
export {
redef record Info += {
@jatrost
jatrost / sysmon.py
Created November 12, 2017 10:37
Using nxlog to collect sysmon log in Cuckoo
import logging
import os
import sys
from lib.common.abstracts import Auxiliary
from lib.api.process import Process
from lib.common.results import upload_to_host
log = logging.getLogger(__name__)
import re
import base64
import sys
def remove_padding(b):
b = b.rstrip('\n')
m = re.search(r'(=+)', b)
if m:
padding_amt = len(m.group(1)) + 1
return b[:len(b)-padding_amt]