Only check domain if uri doesn't contain an IP

jsjaws.py

@@ -505,15 +505,17 @@ def _extract_iocs_from_text_blob(self, blob: str, result_section: ResultSection,
             ioc_extracted = True
             result_section.add_tag("network.dynamic.domain", safe_domain)
         for uri in uris:
-            try:
-                if not any(protocol in uri for protocol in ["http", "ftp", "icmp", "ssh"]):
-                    tld = get_tld(f"http://{uri}", fail_silently=True)
-                else:
-                    tld = get_tld(uri, fail_silently=True)
-            except ValueError:
-                continue
-            if tld is None or f".{tld}" == file_ext:
-                continue
+            # If there is a domain in the uri, then do
+            if not any(ip in uri for ip in ips):
+                try:
+                    if not any(protocol in uri for protocol in ["http", "ftp", "icmp", "ssh"]):
+                        tld = get_tld(f"http://{uri}", fail_silently=True)
+                    else:
+                        tld = get_tld(uri, fail_silently=True)
+                except ValueError:
+                    continue
+                if tld is None or f".{tld}" == file_ext:
+                    continue
             safe_uri = safe_str(uri)
             ioc_extracted = True
             result_section.add_tag("network.dynamic.uri", safe_uri)

test/test_jsjaws.py

@@ -481,6 +481,7 @@ def test_extract_supplementary(jsjaws_class_instance):
             ("evil.ca/some/thing/bad.exe", "", {"network.dynamic.domain": ["evil.ca"], "network.dynamic.uri": ["evil.ca/some/thing/bad.exe"], "network.dynamic.uri_path": ["/some/thing/bad.exe"]}),
             ("wscript.shell", "", {}),
             ("blah.ca", ".ca", {}),
+            ("http://1.1.1.1/blah.exe", "", {'network.dynamic.ip': ['1.1.1.1'], 'network.dynamic.uri': ['http://1.1.1.1/blah.exe'], 'network.dynamic.uri_path': ['/blah.exe']}),
         ]
     )
     def test_extract_iocs_from_text_blob(blob, file_ext, correct_tags, jsjaws_class_instance):