[
{
"Name": "PGP Public Key",
"Regex": "^(?:-----BEGIN PGP PUBLIC KEY BLOCK-----\\n?(?:(?:(?:Version|Comment|MessageID|Hash|Charset):.*)\\n?)*[a-zA-Z0-9\\/\\.\\n\\:\\+\\=]+-----END PGP PUBLIC KEY BLOCK-----)$",
"plural_name": false,
"Description": null,
"Rarity": 1,
"URL": null,
"Tags": [
"PGP"
]
},
{
"Name": "PGP Private Key",
"Regex": "^(?:-----BEGIN PGP PRIVATE KEY BLOCK-----\\n?(?:(?:(?:Version|Comment|MessageID|Hash|Charset):.*)\\n?)*[a-zA-Z0-9\\/\\.\\n\\:\\+\\=]+-----END PGP PRIVATE KEY BLOCK-----)$",
"plural_name": false,
"Description": null,
"Rarity": 1,
"URL": null,
"Tags": [
"PGP"
]
},
{
"Name": "SSH RSA Public Key",
"Regex": "^(ssh-rsa [A-Za-z0-9+\\/=]+ [^ \\n]+)$",
"plural_name": false,
"Description": null,
"Rarity": 1,
"URL": null,
"Tags": [
"Credentials",
"SSH Public Key"
]
},
{
"Name": "SSH ECDSA Public Key",
"Regex": "^(ecdsa-sha2-nistp[0-9]{3} [A-Za-z0-9+\\/=]+ [^ \\n]+)$",
"plural_name": false,
"Description": null,
"Rarity": 1,
"URL": null,
"Tags": [
"Credentials",
"SSH Public Key"
]
},
{
"Name": "SSH ED25519 Public Key",
"Regex": "^(ssh-ed25519 [A-Za-z0-9+\\/=]+ [^ \\n]+)$",
"plural_name": false,
"Description": null,
"Rarity": 1,
"URL": null,
"Tags": [
"Credentials",
"SSH Public Key"
]
},
{
"Name": "Access-Control-Allow-Header",
"Regex": "(?i)^(Access-Control-Allow: [a-z0-9\\-*])$",
"plural_name": false,
"Description": "Used for [#CAE4F1][link=https://en.wikipedia.org/wiki/Cross-origin_resource_sharing]Cross-Origin Resource Sharing (CORS)[/link][/#CAE4F1]",
"Rarity": 1,
"URL": null,
"Tags": [
"Networking",
"Website"
]
},
{
"Name": "TryHackMe Flag Format",
"Regex": "(?i)^(thm{.*}|tryhackme{.*})$",
"plural_name": false,
"Description": "Used for Capture The Flags at https://tryhackme.com",
"Rarity": 1,
"URL": null,
"Tags": [
"CTF Flag"
]
},
{
"Name": "HackTheBox Flag Format",
"Regex": "(?i)^(hackthebox{.*}|htb{.*})$",
"plural_name": false,
"Description": "Used for Capture The Flags at https://hackthebox.eu",
"Rarity": 1,
"URL": null,
"Tags": [
"CTF Flag"
]
},
{
"Name": "Capture The Flag (CTF) Flag",
"Regex": "(?i)^(flag{.*}|ctf{.*}|ctfa{.*})$",
"plural_name": false,
"Description": null,
"Rarity": 1,
"URL": null,
"Tags": [
"CTF Flag"
]
},
{
"Name": "YouTube Video",
"Regex": "^(https?:\\/\\/(?:youtu\\.be\\/|(?:[a-z]{2,3}\\.)?youtube\\.com\\/watch(?:\\?|#\\!)v=)([\\w-]{11}))$",
"plural_name": false,
"Description": null,
"Rarity": 1,
"URL": null,
"Tags": [
"Media",
"YouTube",
"YouTube Video"
]
},
{
"Name": "Bitcoin Cash (BCH) Wallet Address",
"Regex": "(?i)^(((bitcoincash|bchreg|bchtest):)?(q|p)[a-z0-9]{41})$",
"plural_name": false,
"Description": null,
"Rarity": 1,
"URL": "https://www.blockchain.com/bch/address/",
"Tags": [
"Finance",
"Cryptocurrency Wallet",
"Bitcoin Cash Wallet"
]
},
{
"Name": "Amazon Web Services Simple Storage (AWS S3) URL",
"Regex": "(?i)^([https:\\/\\/]*s3\\.amazonaws.com[\\/]+.*|[a-zA-Z0-9_-]*\\.s3\\.amazonaws.com\\/.*)$",
"plural_name": false,
"Description": null,
"Rarity": 1,
"URL": null,
"Tags": [
"Networking",
"AWS"
]
},
{
"Name": "Amazon Web Services Simple Storage (AWS S3) Internal URL",
"Regex": "(?i)^(s3:\\/\\/([^\\/]+)\\/(.*?([^\\/]+)\\/?))$",
"plural_name": false,
"Description": "Internal URL, only accessible via the virtual private cloud.",
"Rarity": 1,
"URL": null,
"Tags": [
"Networking",
"AWS"
]
},
{
"Name": "Square Application Secret",
"Regex": "^(sandbox-?sq0csp-[0-9A-Za-z-_]{43}|sq0[a-z]{3}-[0-9A-Za-z-_]{22,43})$",
"plural_name": false,
"Description": null,
"Rarity": 1,
"URL": null,
"Tags": [
"API Keys",
"Credentials",
"Square API"
]
},
{
"Name": "Square Access Token",
"Regex": "^(sqOatp-[0-9A-Za-z-_]{22}|EAAA[a-zA-Z0-9-_]{60})$",
"plural_name": false,
"Description": null,
"Rarity": 1,
"URL": null,
"Tags": [
"API Keys",
"Credentials",
"Square API"
]
},
{
"Name": "Stripe API Key",
"Regex": "^([srp]k_live_[0-9a-zA-Z]{24})$",
"plural_name": false,
"Description": null,
"Rarity": 1,
"URL": null,
"Tags": [
"API Keys",
"Credentials"
]
},
{
"Name": "GitHub Access Token",
"Regex": "^([a-zA-Z0-9_-]*:[a-zA-Z0-9_-]+@github.com*)$",
"plural_name": false,
"Description": null,
"Rarity": 1,
"URL": null,
"Tags": [
"API Keys",
"Credentials"
]
},
{
"Name": "Amazon Resource Name (ARN)",
"Regex": "(?i)^(arn:(?P<Partition>[^:\\n]*):(?P<Service>[^:\\n]*):(?P<Region>[^:\\n]*):(?P<AccountID>[^:\\n]*):(?P<Ignore>(?P<ResourceType>[^:\\/\\n]*)[:\\/])?(?P<Resource>.*))$",
"plural_name": false,
"Description": null,
"Rarity": 1,
"URL": null,
"Tags": [
"Identifiers",
"Networking",
"AWS"
]
},
{
"Name": "Internet Protocol (IP) Address Version 6",
"Regex": "^((?=.*[0-9])\\[?(?:(?:[0-9a-f]{1,4}:){7,7}[0-9a-f]{1,4}|([0-9a-f]{4}:){1,7}:|([0-9a-f]{1,4}:){1,6}:[0-9a-f]{1,4}|([0-9a-f]{1,4}:){1,5}(:[0-9a-f]{1,4}){1,2}|([0-9a-f]{1,4}:){1,4}(:[0-9a-f]{1,4}){1,3}|([0-9a-f]{1,4}:){1,3}(:[0-9a-f]{1,4}){1,4}|([0-9a-fA]{1,4}:){1,2}(:[0-9a-f]{1,4}){1,5}|[0-9a-f]{1,4}:((:[0-9a-f]{1,4}){1,6})|:((:[0-9a-f]{1,4}){1,7}|:)|fe80:(:[0-9a-f]{0,4}){0,4}%[0-9a-z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|(?:[0-9a-f]{1,4}:){1,4}:(?:(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\\.){3,3}(25[0-5]|(?:2[0-4]|1{0,1}[0-9]){0,1}[0-9]))\\]?(?::[0-9]{1,5})?)$",
"plural_name": false,
"Description": null,
"Rarity": 0.7,
"URL": "https://www.shodan.io/host/",
"Tags": [
"Identifiers",
"Networking",
"IP"
]
},
{
"Name": "Uniform Resource Locator (URL)",
"Regex": "(?i)^((?:(?:https?|ftp):\\/\\/(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)(?::[0-9]{1,5})?)([a-z0-9-_\\/]?\\.?)*|(?:(?:https?|ftp):\\/\\/)?(?:\\S+:\\S+@)?(?:[a-z0-9-_]?\\.?)+?(?:[a-z0-9-_][a-z0-9-_]{0,62})\\.(?:XN--VERMGENSBERATUNG-PWB|XN--VERMGENSBERATER-CTB|XN--CLCHC0EA0B2G2A9GCD|XN--W4R85EL8FHU5DNRA|NORTHWESTERNMUTUAL|TRAVELERSINSURANCE|XN--3OQ18VL8PN36A|XN--5SU34J936BGSG|XN--BCK1B9A5DRE4C|XN--MGBAH1A3HJKRD|XN--MGBAI9AZGQP6J|XN--MGBERP4A5D4AR|XN--XKC2DL3A5EE0H|XN--FZYS8D69UVGM|XN--MGBA7C0BBN0A|XN--MGBCPQ6GPA1A|XN--XKC2AL3HYE2A|AMERICANEXPRESS|KERRYPROPERTIES|SANDVIKCOROMANT|XN--I1B6B1A6A2E|XN--KCRX77D1X4A|XN--LGBBAT1AD8J|XN--MGBA3A4F16A|XN--MGBAAKC7DVF|XN--MGBC0A9AZCG|XN--NQV7FS00EMA|AFAMILYCOMPANY|AMERICANFAMILY|BANANAREPUBLIC|CANCERRESEARCH|COOKINGCHANNEL|KERRYLOGISTICS|WEATHERCHANNEL|XN--54B7FTA0CC|XN--6QQ986B3XL|XN--80AQECDR1A|XN--B4W605FERD|XN--FIQ228C5HS|XN--H2BREG3EVE|XN--JLQ480N2RG|XN--JLQ61U9W7B|XN--MGBA3A3EJT|XN--MGBAAM7A8H|XN--MGBAYH7GPA|XN--MGBBH1A71E|XN--MGBCA7DZDO|XN--MGBI4ECEXP|XN--MGBX4CD0AB|XN--RVC1E0AM3E|INTERNATIONAL|LIFEINSURANCE|TRAVELCHANNEL|WOLTERSKLUWER|XN--CCKWCXETD|XN--ECKVDTC9D|XN--FPCRJ9C3D|XN--FZC2C9E2C|XN--H2BRJ9C8C|XN--TIQ49XQYJ|XN--YFRO4I67O|XN--YGBI2AMMX|CONSTRUCTION|LPLFINANCIAL|SCHOLARSHIPS|VERSICHERUNG|XN--3E0B707E|XN--45BR5CYL|XN--4DBRK0CE|XN--80ADXHKS|XN--80ASEHDB|XN--8Y0A063A|XN--GCKR3F0F|XN--MGB9AWBF|XN--MGBAB2BD|XN--MGBGU82A|XN--MGBPL2FH|XN--MGBT3DHD|XN--MK1BU44C|XN--NGBC5AZD|XN--NGBE9E0A|XN--OGBPF8FL|XN--QCKA1PMC|ACCOUNTANTS|BARCLAYCARD|BLACKFRIDAY|BLOCKBUSTER|BRIDGESTONE|CALVINKLEIN|CONTRACTORS|CREDITUNION|ENGINEERING|ENTERPRISES|FOODNETWORK|INVESTMENTS|KERRYHOTELS|LAMBORGHINI|MOTORCYCLES|OLAYANGROUP|PHOTOGRAPHY|PLAYSTATION|PRODUCTIONS|PROGRESSIVE|REDUMBRELLA|WILLIAMHILL|XN--11B4C3D|XN--1CK2E1B|XN--1QQW23A|XN--2SCRJ9C|XN--3BST00M|XN--3DS443G|XN--3HCRJ9C|XN--42C2D9A|XN--45BRJ9C|XN--55QW42G|XN--6FRZ82G|XN--80AO21A|XN--9KRT00A|XN--CCK2B3B|XN--CZR694B|XN--D1ACJ3B|XN--EFVY88H|XN--FCT429K|XN--FJQ720A|XN--FLW351E|XN--G2XX48C|XN--GECRJ9C|XN--GK3AT1E|XN--H2BRJ9C|XN--HXT814E|XN--IMR513N|XN--J6W193G|XN--JVR189M|XN--KPRW13D|XN--KPRY57D|XN--MGBBH1A|XN--MGBTX2B|XN--MIX891F|XN--NYQY26A|XN--OTU796D|XN--PGBS0DH|XN--Q9JYB4C|XN--RHQV96G|XN--ROVU88B|XN--S9BRJ9C|XN--SES554G|XN--T60B56A|XN--VUQ861B|XN--W4RS40L|XN--XHQ521B|XN--ZFR164B|ACCOUNTANT|APARTMENTS|ASSOCIATES|BASKETBALL|BNPPARIBAS|BOEHRINGER|CAPITALONE|CONSULTING|CREDITCARD|CUISINELLA|EUROVISION|EXTRASPACE|FOUNDATION|HEALTHCARE|IMMOBILIEN|INDUSTRIES|MANAGEMENT|MITSUBISHI|NEXTDIRECT|PROPERTIES|PROTECTION|PRUDENTIAL|REALESTATE|REPUBLICAN|RESTAURANT|SCHAEFFLER|SWIFTCOVER|TATAMOTORS|TECHNOLOGY|UNIVERSITY|VLAANDEREN|VOLKSWAGEN|XN--30RR7Y|XN--3PXU8K|XN--45Q11C|XN--4GBRIM|XN--55QX5D|XN--5TZM5G|XN--80ASWG|XN--90A3AC|XN--9DBQ2A|XN--9ET52U|XN--C2BR7G|XN--CG4BKI|XN--CZRS0T|XN--CZRU2D|XN--FIQ64B|XN--FIQS8S|XN--FIQZ9S|XN--IO0A7I|XN--KPUT3I|XN--MXTQ1M|XN--O3CW4H|XN--PSSY2U|XN--Q7CE6A|XN--UNUP4Y|XN--WGBH1C|XN--WGBL6A|XN--Y9A3AQ|ACCENTURE|ALFAROMEO|ALLFINANZ|AMSTERDAM|ANALYTICS|AQUARELLE|BARCELONA|BLOOMBERG|CHRISTMAS|COMMUNITY|DIRECTORY|EDUCATION|EQUIPMENT|FAIRWINDS|FINANCIAL|FIRESTONE|FRESENIUS|FRONTDOOR|FURNITURE|GOLDPOINT|HISAMITSU|HOMEDEPOT|HOMEGOODS|HOMESENSE|INSTITUTE|INSURANCE|KUOKGROUP|LANCASTER|LANDROVER|LIFESTYLE|MARKETING|MARSHALLS|MELBOURNE|MICROSOFT|PANASONIC|PASSAGENS|PRAMERICA|RICHARDLI|SCJOHNSON|SHANGRILA|SOLUTIONS|STATEBANK|STATEFARM|STOCKHOLM|TRAVELERS|VACATIONS|XN--90AIS|XN--C1AVG|XN--D1ALF|XN--E1A4C|XN--FHBEI|XN--J1AEF|XN--J1AMH|XN--L1ACC|XN--NGBRX|XN--NQV7F|XN--P1ACF|XN--QXA6A|XN--TCKWE|XN--VHQUV|YODOBASHI|ABUDHABI|AIRFORCE|ALLSTATE|ATTORNEY|BARCLAYS|BAREFOOT|BARGAINS|BASEBALL|BOUTIQUE|BRADESCO|BROADWAY|BRUSSELS|BUDAPEST|BUILDERS|BUSINESS|CAPETOWN|CATERING|CATHOLIC|CIPRIANI|CITYEATS|CLEANING|CLINIQUE|CLOTHING|COMMBANK|COMPUTER|DELIVERY|DELOITTE|DEMOCRAT|DIAMONDS|DISCOUNT|DISCOVER|DOWNLOAD|ENGINEER|ERICSSON|ETISALAT|EXCHANGE|FEEDBACK|FIDELITY|FIRMDALE|FOOTBALL|FRONTIER|GOODYEAR|GRAINGER|GRAPHICS|GUARDIAN|HDFCBANK|HELSINKI|HOLDINGS|HOSPITAL|INFINITI|IPIRANGA|ISTANBUL|JPMORGAN|LIGHTING|LUNDBECK|MARRIOTT|MASERATI|MCKINSEY|MEMORIAL|MERCKMSD|MORTGAGE|OBSERVER|PARTNERS|PHARMACY|PICTURES|PLUMBING|PROPERTY|REDSTONE|RELIANCE|SAARLAND|SAMSCLUB|SECURITY|SERVICES|SHOPPING|SHOWTIME|SOFTBANK|SOFTWARE|STCGROUP|SUPPLIES|TRAINING|VANGUARD|VENTURES|VERISIGN|WOODSIDE|XN--90AE|XN--NODE|XN--P1AI|XN--QXAM|YOKOHAMA|ABOGADO|ACADEMY|AGAKHAN|ALIBABA|ANDROID|ATHLETA|AUCTION|AUDIBLE|AUSPOST|AVIANCA|BANAMEX|BAUHAUS|BENTLEY|BESTBUY|BOOKING|BROTHER|BUGATTI|CAPITAL|CARAVAN|CAREERS|CHANNEL|CHARITY|CHINTAI|CITADEL|CLUBMED|COLLEGE|COLOGNE|COMCAST|COMPANY|COMPARE|CONTACT|COOKING|CORSICA|COUNTRY|COUPONS|COURSES|CRICKET|CRUISES|DENTIST|DIGITAL|DOMAINS|EXPOSED|EXPRESS|FARMERS|FASHION|FERRARI|FERRERO|FINANCE|FISHING|FITNESS|FLIGHTS|FLORIST|FLOWERS|FORSALE|FROGANS|FUJITSU|GALLERY|GENTING|GODADDY|GROCERY|GUITARS|HAMBURG|HANGOUT|HITACHI|HOLIDAY|HOSTING|HOTELES|HOTMAIL|HYUNDAI|ISMAILI|JEWELRY|JUNIPER|KITCHEN|KOMATSU|LACAIXA|LANXESS|LASALLE|LATROBE|LECLERC|LIMITED|LINCOLN|MARKETS|MONSTER|NETBANK|NETFLIX|NETWORK|NEUSTAR|OKINAWA|OLDNAVY|ORGANIC|ORIGINS|PHILIPS|PIONEER|POLITIE|REALTOR|RECIPES|RENTALS|REVIEWS|REXROTH|SAMSUNG|SANDVIK|SCHMIDT|SCHWARZ|SCIENCE|SHIKSHA|SINGLES|STAPLES|STORAGE|SUPPORT|SURGERY|SYSTEMS|TEMASEK|THEATER|THEATRE|TICKETS|TIFFANY|TOSHIBA|TRADING|WALMART|WANGGOU|WATCHES|WEATHER|WEBSITE|WEDDING|WHOSWHO|WINDOWS|WINNERS|XFINITY|YAMAXUN|YOUTUBE|ZUERICH|ABARTH|ABBOTT|ABBVIE|AFRICA|AGENCY|AIRBUS|AIRTEL|ALIPAY|ALSACE|ALSTOM|AMAZON|ANQUAN|ARAMCO|AUTHOR|BAYERN|BEAUTY|BERLIN|BHARTI|BOSTIK|BOSTON|BROKER|CAMERA|CAREER|CASINO|CENTER|CHANEL|CHROME|CHURCH|CIRCLE|CLAIMS|CLINIC|COFFEE|COMSEC|CONDOS|COUPON|CREDIT|CRUISE|DATING|DATSUN|DEALER|DEGREE|DENTAL|DESIGN|DIRECT|DOCTOR|DUNLOP|DUPONT|DURBAN|EMERCK|ENERGY|ESTATE|EVENTS|EXPERT|FAMILY|FLICKR|FUTBOL|GALLUP|GARDEN|GEORGE|GIVING|GLOBAL|GOOGLE|GRATIS|HEALTH|HERMES|HIPHOP|HOCKEY|HOTELS|HUGHES|IMAMAT|INSURE|INTUIT|JAGUAR|JOBURG|JUEGOS|KAUFEN|KINDER|KINDLE|KOSHER|LANCIA|LATINO|LAWYER|LEFRAK|LIVING|LOCKER|LONDON|LUXURY|MADRID|MAISON|MAKEUP|MARKET|MATTEL|MOBILE|MONASH|MORMON|MOSCOW|MUSEUM|MUTUAL|NAGOYA|NATURA|NISSAN|NISSAY|NORTON|NOWRUZ|OFFICE|OLAYAN|ONLINE|ORACLE|ORANGE|OTSUKA|PFIZER|PHOTOS|PHYSIO|PICTET|QUEBEC|RACING|REALTY|REISEN|REPAIR|REPORT|REVIEW|ROCHER|ROGERS|RYUKYU|SAFETY|SAKURA|SANOFI|SCHOOL|SCHULE|SEARCH|SECURE|SELECT|SHOUJI|SOCCER|SOCIAL|STREAM|STUDIO|SUPPLY|SUZUKI|SWATCH|SYDNEY|TAIPEI|TAOBAO|TARGET|TATTOO|TENNIS|TIENDA|TJMAXX|TKMAXX|TOYOTA|TRAVEL|UNICOM|VIAJES|VIKING|VILLAS|VIRGIN|VISION|VOTING|VOYAGE|VUELOS|WALTER|WEBCAM|XIHUAN|YACHTS|YANDEX|ZAPPOS|ACTOR|ADULT|AETNA|AMFAM|AMICA|APPLE|ARCHI|AUDIO|AUTOS|AZURE|BAIDU|BEATS|BIBLE|BINGO|BLACK|BOATS|BOSCH|BUILD|CANON|CARDS|CHASE|CHEAP|CISCO|CITIC|CLICK|CLOUD|COACH|CODES|CROWN|CYMRU|DABUR|DANCE|DEALS|DELTA|DRIVE|DUBAI|EARTH|EDEKA|EMAIL|EPSON|FAITH|FEDEX|FINAL|FOREX|FORUM|GALLO|GAMES|GIFTS|GIVES|GLADE|GLASS|GLOBO|GMAIL|GREEN|GRIPE|GROUP|GUCCI|GUIDE|HOMES|HONDA|HORSE|HOUSE|HYATT|IKANO|IRISH|JETZT|KOELN|KYOTO|LAMER|LEASE|LEGAL|LEXUS|LILLY|LINDE|LIPSY|LIXIL|LOANS|LOCUS|LOTTE|LOTTO|MACYS|MANGO|MEDIA|MIAMI|MONEY|MOVIE|NEXUS|NIKON|NINJA|NOKIA|NOWTV|OMEGA|OSAKA|PARIS|PARTS|PARTY|PHONE|PHOTO|PIZZA|PLACE|POKER|PRAXI|PRESS|PRIME|PROMO|QUEST|RADIO|REHAB|REISE|RICOH|ROCKS|RODEO|RUGBY|SALON|SENER|SEVEN|SHARP|SHELL|SHOES|SKYPE|SLING|SMART|SMILE|SOLAR|SPACE|SPORT|STADA|STORE|STUDY|STYLE|SUCKS|SWISS|TATAR|TIRES|TIROL|TMALL|TODAY|TOKYO|TOOLS|TORAY|TOTAL|TOURS|TRADE|TRUST|TUNES|TUSHU|UBANK|VEGAS|VIDEO|VODKA|VOLVO|WALES|WATCH|WEBER|WEIBO|WORKS|WORLD|XEROX|YAHOO|AARP|ABLE|ADAC|AERO|AKDN|ALLY|AMEX|ARAB|ARMY|ARPA|ARTE|ASDA|ASIA|AUDI|AUTO|BABY|BAND|BANK|BBVA|BEER|BEST|BIKE|BING|BLOG|BLUE|BOFA|BOND|BOOK|BUZZ|CAFE|CALL|CAMP|CARE|CARS|CASA|CASE|CASH|CBRE|CERN|CHAT|CITI|CITY|CLUB|COOL|COOP|CYOU|DATA|DATE|DCLK|DEAL|DELL|DESI|DIET|DISH|DOCS|DUCK|DVAG|ERNI|FAGE|FAIL|FANS|FARM|FAST|FIAT|FIDO|FILM|FIRE|FISH|FLIR|FOOD|FORD|FREE|FUND|GAME|GBIZ|GENT|GGEE|GIFT|GMBH|GOLD|GOLF|GOOG|GUGE|GURU|HAIR|HAUS|HDFC|HELP|HERE|HGTV|HOST|HSBC|ICBC|IEEE|IMDB|IMMO|INFO|ITAU|JAVA|JEEP|JOBS|JPRS|KDDI|KIWI|KPMG|KRED|LAND|LEGO|LGBT|LIDL|LIFE|LIKE|LIMO|LINK|LIVE|LOAN|LOFT|LOVE|LTDA|LUXE|MAIF|MEET|MEME|MENU|MINI|MINT|MOBI|MODA|MOTO|NAME|NAVY|NEWS|NEXT|NICO|NIKE|OLLO|OPEN|PAGE|PARS|PCCW|PICS|PING|PINK|PLAY|PLUS|POHL|PORN|POST|PROD|PROF|QPON|RAID|READ|REIT|RENT|REST|RICH|RMIT|ROOM|RSVP|RUHR|SAFE|SALE|SARL|SAVE|SAXO|SCOT|SEAT|SEEK|SEXY|SHAW|SHIA|SHOP|SHOW|SILK|SINA|SITE|SKIN|SNCF|SOHU|SONG|SONY|SPOT|STAR|SURF|TALK|TAXI|TEAM|TECH|TEVA|TIAA|TIPS|TOWN|TOYS|TUBE|VANA|VISA|VIVA|VIVO|VOTE|VOTO|WANG|WEIR|WIEN|WIKI|WINE|WORK|XBOX|YOGA|ZARA|ZERO|ZONE|AAA|ABB|ABC|ACO|ADS|AEG|AFL|AIG|ANZ|AOL|APP|ART|AWS|AXA|BAR|BBC|BBT|BCG|BCN|BET|BID|BIO|BIZ|BMS|BMW|BOM|BOO|BOT|BOX|BUY|BZH|CAB|CAL|CAM|CAR|CAT|CBA|CBN|CBS|CEO|CFA|CFD|COM|CPA|CRS|CSC|DAD|DAY|DDS|DEV|DHL|DIY|DNP|DOG|DOT|DTV|DVR|EAT|ECO|EDU|ESQ|EUS|FAN|FIT|FLY|FOO|FOX|FRL|FTR|FUN|FYI|GAL|GAP|GAY|GDN|GEA|GLE|GMO|GMX|GOO|GOP|GOT|GOV|HBO|HIV|HKT|HOT|HOW|IBM|ICE|ICU|IFM|INC|ING|INK|INT|IST|ITV|JCB|JIO|JLL|JMP|JNJ|JOT|JOY|KFH|KIA|KIM|KPN|KRD|LAT|LAW|LDS|LLC|LLP|LOL|LPL|LTD|MAN|MAP|MBA|MED|MEN|MIL|MIT|MLB|MLS|MMA|MOE|MOI|MOM|MOV|MSD|MTN|MTR|NAB|NBA|NEC|NET|NEW|NFL|NGO|NHK|NOW|NRA|NRW|NTT|NYC|OBI|OFF|ONE|ONG|ONL|OOO|ORG|OTT|OVH|PAY|PET|PHD|PID|PIN|PNC|PRO|PRU|PUB|PWC|QVC|RED|REN|RIL|RIO|RIP|RUN|RWE|SAP|SAS|SBI|SBS|SCA|SCB|SES|SEW|SEX|SFR|SKI|SKY|SOY|SPA|SRL|STC|TAB|TAX|TCI|TDK|TEL|THD|TJX|TOP|TRV|TUI|TVS|UBS|UNO|UOL|UPS|VET|VIG|VIN|VIP|WED|WIN|WME|WOW|WTC|WTF|XIN|XXX|XYZ|YOU|YUN|ZIP|AC|AD|AE|AF|AG|AI|AL|AM|AO|AQ|AR|AS|AT|AU|AW|AX|AZ|BA|BB|BD|BE|BF|BG|BH|BI|BJ|BM|BN|BO|BR|BS|BT|BV|BW|BY|BZ|CA|CC|CD|CF|CG|CH|CI|CK|CL|CM|CN|CO|CR|CU|CV|CW|CX|CY|CZ|DE|DJ|DK|DM|DO|DZ|EC|EE|EG|ER|ES|ET|EU|FI|FJ|FK|FM|FO|FR|GA|GB|GD|GE|GF|GG|GH|GI|GL|GM|GN|GP|GQ|GR|GS|GT|GU|GW|GY|HK|HM|HN|HR|HT|HU|ID|IE|IL|IM|IN|IO|IQ|IR|IS|IT|JE|JM|JO|JP|KE|KG|KH|KI|KM|KN|KP|KR|KW|KY|KZ|LA|LB|LC|LI|LK|LR|LS|LT|LU|LV|LY|MA|MC|MD|ME|MG|MH|MK|ML|MM|MN|MO|MP|MQ|MR|MS|MT|MU|MV|MW|MX|MY|MZ|NA|NC|NE|NF|NG|NI|NL|NO|NP|NR|NU|NZ|OM|PA|PE|PF|PG|PH|PK|PL|PM|PN|PR|PS|PT|PW|PY|QA|RE|RO|RS|RU|RW|SA|SB|SC|SD|SE|SG|SH|SI|SJ|SK|SL|SM|SN|SO|SR|SS|ST|SU|SV|SX|SY|SZ|TC|TD|TF|TG|TH|TJ|TK|TL|TM|TN|TO|TR|TT|TV|TW|TZ|UA|UG|UK|US|UY|UZ|VA|VC|VE|VG|VI|VN|VU|WF|WS|YE|YT|ZA|ZM|ZW)(?::\\d{2,5})?(?:[\\/?#]\\S*)?)$",
"plural_name": false,
"Description": null,
"Rarity": 0.7,
"URL": null,
"Tags": [
"Identifiers",
"URL"
]
},
{
"Name": "Internet Protocol (IP) Address Version 4",
"Regex": "^((?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)(?::[0-9]{1,5})?)$",
"plural_name": false,
"Description": null,
"Rarity": 0.7,
"URL": "https://www.shodan.io/host/",
"Tags": [
"Identifiers",
"Networking",
"IP"
]
},
{
"Name": "Bitcoin (₿) Wallet Address",
"Regex": "^(([1][a-km-zA-HJ-NP-Z1-9]{25,35})|([3][a-km-zA-HJ-NP-Z1-9]{33})|(bc|tb)1(?!.*[1bio])[a-z0-9]{39,59})$",
"plural_name": false,
"Description": null,
"Rarity": 0.7,
"URL": "https://www.blockchain.com/btc/address/",
"Tags": [
"Finance",
"Cryptocurrency Wallet",
"Bitcoin Wallet"
]
},
{
"Name": "Latitude & Longitude Coordinates",
"Regex": "(?i)^((?:(?:N|W|S|E)\\s?\\d+\\s?\\u00B0?\\s?\\d+\\.?\\d*\\s?\\'?\\s?\\d*\\.?\\,?\\d*?\"?\\s?){1,2}|(?:\\d+\\s?\\u00B0\\s?\\d+\\s?\\'\\s?\\d+\\.?\\,?\\d{0,}?\"\\s?(?:N|W|S|E)\\s?){1,2}|(?:[-+]?(?:[0-8]?\\d+\\.\\d{4,}|90(?:\\.0+)?),\\s*[-+]?(?:180(?:\\.0+)?|(?:(?:1[0-7]\\d)|(?:[1-9]?\\d))(?:\\.\\d+)?)))$",
"plural_name": true,
"Description": null,
"Rarity": 0.7,
"URL": "https://www.google.com/maps/place/",
"Tags": [
"Geo-location"
]
},
{
"Name": "EUI-48 Identifier (Ethernet, WiFi, Bluetooth, etc)",
"Regex": "^(([0-9A-Fa-f]{2}[:]){5}[0-9A-Fa-f]{2}|([0-9A-Fa-f]{2}[-]){5}[0-9A-Fa-f]{2}|([0-9A-Fa-f]{4}[\\.]){2}[0-9A-Fa-f]{4})$",
"plural_name": false,
"Description": null,
"Rarity": 0.5,
"URL": "https://maclookup.app/search/macs/",
"Tags": [
"Identifiers",
"Networking"
],
"Children": {
"path": "mac_vendors.json",
"entry": "Vendor(s): ",
"method": "hashmap",
"deletion_pattern": "[:.-]"
}
},
{
"Name": "Dogecoin (DOGE) Wallet Address",
"Regex": "^(D{1}[5-9A-HJ-NP-U]{1}[1-9A-HJ-NP-Za-km-z]{32})$",
"plural_name": false,
"Description": null,
"Rarity": 0.5,
"URL": "https://dogechain.info/address/",
"Tags": [
"Finance",
"Cryptocurrency Wallet",
"Dogecoin Wallet"
]
},
{
"Name": "Email Address",
"Regex": "^((?:[a-z0-9!#$%&'\"*+\\/=?^_`{|}~-]+(?:\\.[a-z0-9!#$%&'\"*+\\/=?^_`{|}~-]+)*)@(?:(?:[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\\.)+[a-z0-9](?:[a-z0-9-]*[a-z0-9])?|\\[(?:(?:(?:2(5[0-5]|[0-4][0-9])|1[0-9][0-9]|[1-9]?[0-9]))\\.){3}(?:(?:2(5[0-5]|[0-4][0-9])|1[0-9][0-9]|[1-9]?[0-9])|[a-z0-9-]*[a-z0-9]:)\\]))$",
"plural_name": false,
"Description": null,
"Rarity": 0.5,
"URL": null,
"Tags": [
"Identifiers",
"Credentials",
"Email Address"
]
},
{
"Name": "Phone Number",
"Regex": "^(\\s*(?:\\+?(\\d{1,3}))?[-. (]*(\\d{3})[-. )]*(\\d{3})[-. ]*(\\d{4})(?: *x(\\d+))?\\s*)$",
"plural_name": false,
"Description": null,
"Rarity": 0.5,
"URL": null,
"Tags": [
"Identifiers",
"Credentials",
"Phone Number"
],
"Children": {
"path": "phone_codes.json",
"entry": "Location(s): ",
"method": "hashmap"
}
},
{
"Name": "American Social Security Number",
"Regex": "^(([0-9][0-9][0-9])(?<!666|000|9[0-9][0-9])(=|\\+|_|\\#|:|;|\\.|-|\\s){0,3}([1-9][1-9]|0[1-9]|[1-9]0)(=|\\+|_|\\#|:|;|\\.|-|\\s){0,3}([0-9][0-9][0-9][0-9])(?<!0000)(=|\\+|_|\\#|:|;|\\.|-|\\s){0,3}?)$",
"plural_name": false,
"Description": "An [#CAE4F1][link=https://en.wikipedia.org/wiki/Social_Security_number]American Identification Number[/link][/#CAE4F1]",
"Rarity": 0.5,
"URL": null,
"Tags": [
"Credentials",
"SSN"
]
},
{
"Name": "YouTube Channel ID",
"Regex": "^(UC[0-9A-Za-z_-]{21}[AQgw]{1})$",
"plural_name": false,
"Description": null,
"Rarity": 0.5,
"URL": "https://www.youtube.com/channel/",
"Tags": [
"Media",
"YouTube"
]
},
{
"Name": "Discord Bot Token",
"Regex": "^((?:N|M|O)[a-zA-Z0-9]{23}\\.[a-zA-Z0-9-_]{6}\\.[a-zA-Z0-9-_]{27})$",
"plural_name": false,
"Description": null,
"Rarity": 0.5,
"URL": null,
"Tags": [
"Credentials",
"Token",
"API Keys"
]
},
{
"Name": "Monero (XMR) Wallet Address",
"Regex": "(?i)^([48][0-9AB][1-9A-HJ-NP-Za-km-z]{93})$",
"plural_name": false,
"Description": null,
"Rarity": 0.3,
"URL": null,
"Tags": [
"Finance",
"Cryptocurrency Wallet",
"Monero Wallet"
]
},
{
"Name": "Litecoin (LTC) Wallet Address",
"Regex": "(?i)^((?:L|M)[a-z0-9]{33})$",
"plural_name": false,
"Description": null,
"Rarity": 0.3,
"URL": "https://live.blockcypher.com/ltc/address/",
"Tags": [
"Finance",
"Cryptocurrency Wallet",
"Litecoin Wallet"
]
},
{
"Name": "Ripple (XRP) Wallet Address",
"Regex": "(?i)^(r[a-z0-9]{33})$",
"plural_name": false,
"Description": null,
"Rarity": 0.3,
"URL": "https://xrpscan.com/account/",
"Tags": [
"Finance",
"Cryptocurrency Wallet",
"Ripple Wallet"
]
},
{
"Name": "American Express Card Number",
"Regex": "^(3[47][0-9]{2}\\s?(?:[0-9]{4}\\s?){2}[0-9]{3})$",
"plural_name": false,
"Description": null,
"Rarity": 0.3,
"URL": null,
"Tags": [
"Credit Card",
"Finance",
"AMEX CC"
]
},
{
"Name": "BCGlobal Card Number",
"Regex": "^((?:6541|6556)[0-9]{12})$",
"plural_name": false,
"Description": null,
"Rarity": 0.3,
"URL": null,
"Tags": [
"Credit Card",
"Finance"
]
},
{
"Name": "Carte Blanche Card Number",
"Regex": "^(30[0-5][0-9]{11})$",
"plural_name": false,
"Description": null,
"Rarity": 0.3,
"URL": null,
"Tags": [
"Credit Card",
"Finance"
]
},
{
"Name": "Diners Club Card Number",
"Regex": "^(3(?:0[0-5]|[68][0-9])[0-9]\\s?(?:[0-9]{4}\\s?){2}[0-9]{2})$",
"plural_name": false,
"Description": null,
"Rarity": 0.3,
"URL": null,
"Tags": [
"Credit Card",
"Finance"
]
},
{
"Name": "Discover Card Number",
"Regex": "^((?:64[4-9][0-9]|65[0-9]{2}|6011)\\s?(?:[0-9]{4}\\s?){3}|622(?:1\\s?2[6-9][0-9]{2}|1\\s?[3-9][0-9]{3}|[2-8]\\s?[0-9]{4}|9\\s?[01][0-9]{3}|9\\s?2[0-5][0-9]{2})\\s?(?:[0-9]{4}\\s?){2})$",
"plural_name": false,
"Description": null,
"Rarity": 0.3,
"URL": null,
"Tags": [
"Credit Card",
"Finance",
"Discover CC"
]
},
{
"Name": "MasterCard Number",
"Regex": "^((?:5[1-5][0-9]{2}|222[1-9]|22[3-9][0-9]|2[3-6][0-9]{2}|27[01][0-9]|2720)\\s?(?:[0-9]{4}\\s?){3})$",
"plural_name": false,
"Description": null,
"Rarity": 0.3,
"URL": null,
"Tags": [
"Credit Card",
"Finance",
"MasterCard CC"
],
"Children": {
"path": "mastercard_companies.json",
"entry": "Issuer(s): ",
"deletion_pattern": "\\s",
"method": "hashmap"
}
},
{
"Name": "Maestro Card Number",
"Regex": "^((?:5018|5020|5038|5612|5893|6304|6759|676[1-3]|0604|6390)\\s?(?:[0-9]{4}\\s?){3}\\s?(?:[0-9]{3,7})?)$",
"plural_name": false,
"Description": null,
"Rarity": 0.3,
"URL": null,
"Tags": [
"Credit Card",
"Finance"
]
},
{
"Name": "Visa Card Number",
"Regex": "^(4[0-9]{12}(?:[0-9]{3})?|4[0-9]{3}\\s(?:[0-9]{2,4}\\s?){3}(?:[0-9])?)$",
"plural_name": false,
"Description": null,
"Rarity": 0.3,
"URL": null,
"Tags": [
"Credit Card",
"Finance",
"Visa CC"
]
},
{
"Name": "Insta Payment Card Number",
"Regex": "^(63[7-9][0-9]{13})$",
"plural_name": false,
"Description": null,
"Rarity": 0.3,
"URL": null,
"Tags": [
"Credit Card",
"Finance"
]
},
{
"Name": "JCB Card Number",
"Regex": "^((?:2131|1800|35\\d{3})\\d{11,14})$",
"plural_name": false,
"Description": null,
"Rarity": 0.3,
"URL": null,
"Tags": [
"Credit Card",
"Finance"
]
},
{
"Name": "Korean Local Card Number",
"Regex": "^(9[0-9]{15})$",
"plural_name": false,
"Description": null,
"Rarity": 0.3,
"URL": null,
"Tags": [
"Credit Card",
"Finance"
]
},
{
"Name": "Laser Card Number",
"Regex": "^((?:6304|6706|6709|6771)[0-9]{12,15})$",
"plural_name": false,
"Description": null,
"Rarity": 0.3,
"URL": null,
"Tags": [
"Credit Card",
"Finance"
]
},
{
"Name": "Solo Card Number",
"Regex": "^((?:6334|6767)[0-9]{12}|(?:6334|6767)[0-9]{14}|(?:6334|6767)[0-9]{15})$",
"plural_name": false,
"Description": null,
"Rarity": 0.3,
"URL": null,
"Tags": [
"Credit Card",
"Finance"
]
},
{
"Name": "Switch Card Number",
"Regex": "^((?:4903|4905|4911|4936|6333|6759)[0-9]{12}|(?:4903|4905|4911|4936|6333|6759)[0-9]{14}|(?:4903|4905|4911|4936|6333|6759)[0-9]{15}|564182[0-9]{10}|564182[0-9]{12}|564182[0-9]{13}|633110[0-9]{10}|633110[0-9]{12}|633110[0-9]{13})$",
"plural_name": false,
"Description": null,
"Rarity": 0.3,
"URL": null,
"Tags": [
"Credit Card",
"Finance"
]
},
{
"Name": "Ethereum (ETH) Wallet Address",
"Regex": "(?i)^(0x[a-f0-9]{40})$",
"plural_name": false,
"Description": null,
"Rarity": 0.3,
"URL": "https://etherscan.io/address/",
"Tags": [
"Finance",
"Cryptocurrency Wallet",
"Ethereum Wallet"
]
},
{
"Name": "Slack Token",
"Regex": "^(xox[a-zA-Z]-[a-zA-Z0-9-]+)$",
"plural_name": false,
"Description": null,
"Rarity": 0.3,
"URL": null,
"Tags": [
"API Keys",
"Credentials"
]
},
{
"Name": "Amazon Web Services Organization identifier",
"Regex": "^(o-[a-z0-9]{10,32})$",
"plural_name": false,
"Description": null,
"Rarity": 0.3,
"URL": null,
"Tags": [
"Identifiers",
"AWS"
]
},
{
"Name": "Google API Key",
"Regex": "^(AIza[0-9A-Za-z-_]{35})$",
"plural_name": false,
"Description": null,
"Rarity": 0.3,
"URL": null,
"Tags": [
"API Keys",
"Credentials",
"Google"
]
},
{
"Name": "Google OAuth Token",
"Regex": "^(ya29.[0-9A-Za-z-_]+)$",
"plural_name": false,
"Description": null,
"Rarity": 0.3,
"URL": null,
"Tags": [
"API Keys",
"Credentials",
"Google"
]
},
{
"Name": "Mailgun API Key",
"Regex": "^(key-[0-9a-zA-Z]{32})$",
"plural_name": false,
"Description": null,
"Rarity": 0.3,
"URL": null,
"Tags": [
"API Keys",
"Credentials"
]
},
{
"Name": "Twilio API Key",
"Regex": "^(SK[0-9a-fA-F]{32})$",
"plural_name": false,
"Description": null,
"Rarity": 0.3,
"URL": null,
"Tags": [
"API Keys",
"Credentials",
"Twilio"
]
},
{
"Name": "Twilio Account SID",
"Regex": "^(AC[a-zA-Z0-9_-]{32})$",
"plural_name": false,
"Description": null,
"Rarity": 0.3,
"URL": null,
"Tags": [
"API Keys",
"Credentials",
"Twilio"
]
},
{
"Name": "Twilio Application SID",
"Regex": "^(AP[a-zA-Z0-9_-]{32})$",
"plural_name": false,
"Description": null,
"Rarity": 0.3,
"URL": null,
"Tags": [
"API Keys",
"Credentials",
"Twilio"
]
},
{
"Name": "Google ReCaptcha API Key",
"Regex": "^(6L[0-9A-Za-z-_]{38}|6[0-9a-zA-Z_-]{39})$",
"plural_name": false,
"Description": null,
"Rarity": 0.3,
"URL": null,
"Tags": [
"API Keys",
"Credentials",
"Google"
]
},
{
"Name": "Amazon Standard Identification Number (ASIN)",
"Regex": "^(B[A-Z0-9]{9})$",
"plural_name": false,
"Description": null,
"Rarity": 0.3,
"URL": "https://amzn.com/",
"Tags": [
"Identifiers",
"Amazon"
]
},
{
"Name": "JSON Web Token (JWT)",
"Regex": "(?i)^((?=.*[a-z])(?=.*[0-9])(?:[a-z0-9_=]+\\.){2}(?:[a-z0-9_\\-\\+\\/=]*))$",
"plural_name": false,
"Description": null,
"Rarity": 0.2,
"URL": null,
"Tags": [
"Token",
"Website",
"JWT Token"
]
},
{
"Name": "Amazon Web Services Access Key",
"Regex": "^((?<![A-Z0-9])[A-Z0-9]{20}(?![A-Z0-9]))$",
"plural_name": false,
"Description": null,
"Rarity": 0.2,
"URL": null,
"Tags": [
"Credentials",
"API Keys",
"AWS"
]
},
{
"Name": "Amazon Web Services Secret Access Key",
"Regex": "^((?<![A-Za-z0-9\\/+=])[A-Za-z0-9\\/+=]{40}(?![A-Za-z0-9\\/+=]))$",
"plural_name": false,
"Description": null,
"Rarity": 0.2,
"URL": null,
"Tags": [
"Credentials",
"API Keys",
"AWS"
]
},
{
"Name": "Amazon Web Services EC2 Instance identifier",
"Regex": "(?i)^(\\b[a-z]+-[a-z0-9]+)$",
"plural_name": false,
"Description": null,
"Rarity": 0.2,
"URL": null,
"Tags": [
"Identifiers",
"AWS"
]
},
{
"Name": "YouTube Video ID",
"Regex": "^((?=.*[A-Z])(?=.*[a-z])[0-9A-Za-z_-]{10}[048AEIMQUYcgkosw]{1})$",
"plural_name": false,
"Description": null,
"Rarity": 0.2,
"URL": "https://www.youtube.com/watch?v=",
"Tags": [
"Media",
"YouTube Video"
]
},
{
"Name": "Recent Unix Timestamp",
"Regex": "^([0-9]{10})$",
"plural_name": false,
"Description": "Seconds elapsed since unix epoch: 1970, between year 2001 and 2286",
"Rarity": 0.2,
"URL": null,
"Tags": [
"UNIX Timestamp"
]
},
{
"Name": "Recent Unix Millisecond Timestamp",
"Regex": "^([0-9]{13})$",
"plural_name": false,
"Description": "Milliseconds elapsed since unix epoch: 1970, between year 2001 and 2286",
"Rarity": 0.2,
"URL": null,
"Tags": [
"UNIX Timestamp"
]
},
{
"Name": "Unix Timestamp",
"Regex": "^([0-9]{8,10})$",
"plural_name": false,
"Description": "Seconds elapsed since unix epoch: 1970",
"Rarity": 0.2,
"URL": null,
"Tags": [
"UNIX Timestamp"
]
},
{
"Name": "Unix Millisecond Timestamp",
"Regex": "^([0-9]{11,13})$",
"plural_name": false,
"Description": "Milliseconds elapsed since unix epoch: 1970",
"Rarity": 0.2,
"URL": null,
"Tags": [
"UNIX Timestamp"
]
},
{
"Name": "Key:Value Pair",
"Regex": "^([^:\\s]+[ ]?:[ ]?[^:\\s]+)$",
"plural_name": false,
"Description": null,
"Rarity": 0,
"URL": null,
"Tags": [
"Credentials"
]
}
]