├── README.md ├── attributes.bro ├── bloomfilter_examples.bro ├── datatypes.bro ├── dbscan ├── README.md ├── dbscan.bro └── tester.bro ├── domain_fun ├── dns_conn_cache.bro └── ua_domain_counter.bro ├── frequency_module.bro ├── hello_http_world.bro ├── http_body_xtr.bro ├── http_url_params.bro ├── input_for_pcaps ├── README.md ├── blacklist.file ├── blacklist_builder.sh └── suspend_input_continue.bro ├── intel-extensions ├── dns-tld.bro ├── intel-1.dat └── public_suffix.bro ├── ip_location_stuff.bro ├── opaques_and_hooks.bro ├── order_of_ops.bro ├── owasp ├── __load__.bro ├── detect-response-splitting.bro ├── http_ext.bro └── url_decoder.bro ├── pcap_bro_es └── pcap2bro2es.py ├── protocol_confirmation_printer.bro ├── redirections ├── README.md ├── chains.bro └── urls.bro ├── rules ├── README.md ├── example_usage.bro ├── indicators.dat ├── rules.dat └── rules │ ├── __load__.bro │ ├── input.bro │ ├── main.bro │ └── seen │ ├── __load__.bro │ ├── http-status.bro │ ├── http-url-path.bro │ └── where-locations.bro ├── scriptland_analyzers ├── raw.bro └── scriptland_http_analyzer.bro ├── setup.sh ├── star_wars_greetings.bro ├── terminate_from_scriptland.bro ├── top_cc ├── README.md ├── pinger.py └── top_cc.bro └── txbaseline ├── README.md └── txbaseline.bro /README.md: -------------------------------------------------------------------------------- 1 | a collection of unorganized Bro code snippets 2 | -------------------------------------------------------------------------------- /attributes.bro: -------------------------------------------------------------------------------- 1 | # attributes... see here 2 | # The following attributes are deprecated 3 | # &rotate_interval 4 | # &rotate_size 5 | # &mergable 6 | # &synchronized 7 | # &persistent 8 | # &group 9 | # 10 | # The following attributes are used internally only 11 | # &type_column 12 | # &error_handler 13 | # 14 | # The following attribute seems to make Bro halt unexpectedly 15 | # &encrypt 16 | # bro -Ci eth0 -e 'global f1: file = open("out1.log") &encrypt; 17 | 18 | module GLOBAL; 19 | export { 20 | global string_printer: function(s1: string, s2: string): string; 21 | 22 | # &add_func likely wasn't designed with strings use in mind and 23 | # was likely intended for use with enums and records 24 | # because strings don't have a -= operator, we cannot set a &delete_func 25 | const gab: string = "gab" &redef &add_func=string_printer; 26 | } 27 | 28 | function string_printer(s1: string, s2: string): string 29 | { 30 | print fmt("s1: %s, s2: %s", s1, s2); 31 | return s1 + s2; 32 | } 33 | 34 | event bro_init() &priority=-10 35 | { 36 | print fmt("printing from GLOBAL space: %s", gab); 37 | } 38 | 39 | ################################################################################## 40 | 41 | module Attributes; 42 | export { 43 | global my_expire: function(tos: table[string] of string, s: string): interval; 44 | 45 | redef gab += "s"; 46 | global baz: function(s: string &default="DEFAULT VALUE"); 47 | 48 | global bar: table[string] of string &create_expire=0secs &expire_func=Attributes::my_expire; 49 | } 50 | 51 | event bro_init() &priority=0 52 | { 53 | Attributes::baz(); 54 | Attributes::baz(gab); 55 | } 56 | 57 | event bro_init() &priority=10 58 | { 59 | Attributes::bar["a"] = "1"; 60 | Attributes::bar["b"] = "2"; 61 | Attributes::bar["c"] = "3"; 62 | print Attributes::bar; 63 | } 64 | 65 | function Attributes::baz(s: string &default="DEFAULT VALUE") 66 | { 67 | print fmt ("printing from Attributes space: %s", s); 68 | } 69 | 70 | function Attributes::my_expire(tos: table[string] of string, s: string): interval 71 | { 72 | print fmt("the size of our table is %d", |tos|); 73 | 74 | if (s == "a") { 75 | print fmt("printing from my_expire, handling %s", s); 76 | return 0secs; 77 | } else if ( s == "b") { 78 | print fmt("printing from my_expire, handling %s", s); 79 | return 10secs; 80 | } else { 81 | print fmt("printing from my_expire, handling %s", s); 82 | return 0secs; 83 | } 84 | } 85 | 86 | ################################################################################## 87 | 88 | module FileThings; 89 | export { 90 | global print_something: event(fh: file, s: string, i: interval &default=0secs); 91 | 92 | global f1: file = open("out1.log") &raw_output; 93 | # global f2: file = open("out2.log") &encrypt; 94 | 95 | } 96 | 97 | event FileThings::print_something(fh: file, s: string, i: interval &default=0secs) 98 | { 99 | # print some string to some file and schedule it to happen again 100 | print fh, s; 101 | schedule i { FileThings::print_something(fh, s, i) }; 102 | } 103 | 104 | event bro_init() 105 | { 106 | schedule 0secs { FileThings::print_something(f1, "foo", 1secs) }; 107 | } 108 | 109 | event bro_done() 110 | { 111 | close(f1); 112 | } 113 | -------------------------------------------------------------------------------- /bloomfilter_examples.bro: -------------------------------------------------------------------------------- 1 | # data type of opaque is a type with internal structure intentionally hidden 2 | # opaque data types are of something 3 | # e.g. local handle: opaque of md5 = md5_hash_init(); 4 | 5 | #global foo: opaque of 6 | # md5 7 | # bloomfilter 8 | # sha1 9 | # sha256 10 | # entropy 11 | # topk 12 | # 13 | 14 | #bloomfilter_basic_init(fp: double, capacity: count, name: string &default = "" &optional) 15 | global my_bloom: opaque of bloomfilter = bloomfilter_basic_init(0.1, 10, "my_bloomfilter_name"); 16 | 17 | #bloomfilter_basic_init2(k: count, cells: count, name: string &default = "" &optional) 18 | global my_bloom2: opaque of bloomfilter = bloomfilter_basic_init2(3, 25, "my_bloomfilter2_name"); 19 | 20 | #bloomfilter_counting_init(k: count, cells: count, max: count, name: string &default = "" &optional) 21 | global my_counting_bloom = bloomfilter_counting_init(3, 10, 25, "my_counting_bloom"); 22 | 23 | global add_letters: string = "abcdefghijklmnopqrstu"; 24 | global test_letters: string = "abcdefghiwxzy"; 25 | 26 | for (l in add_letters) 27 | { 28 | bloomfilter_add(my_bloom, l); 29 | } 30 | 31 | for (l in test_letters) 32 | { 33 | # false positives are possible, but not false negatives 34 | # "inside set (may be wrong)" or "definitely not in set" 35 | 36 | print fmt("is letter '%s' in the bloomfilter? %d", l, bloomfilter_lookup(my_bloom, l) ); 37 | } 38 | 39 | 40 | -------------------------------------------------------------------------------- /datatypes.bro: -------------------------------------------------------------------------------- 1 | # Let's build a table of the data types and then print it 2 | # then let's try to flatten everything in the table and then print it 3 | 4 | module DataTypes; 5 | 6 | export { 7 | global f_void: function(); 8 | global f_string: function(): string; 9 | global t1: table[string] of any; 10 | global ev: event(); 11 | global h: hook(); 12 | 13 | type rec: record { 14 | s: string; 15 | n: count; 16 | i: int; 17 | } &redef; 18 | 19 | type e: enum {LARGE, MEDIUM, SMALL,}; 20 | } 21 | 22 | function f_void() 23 | { 24 | } 25 | 26 | function f_string(): string 27 | { 28 | return "f_string_return_value!!!"; 29 | } 30 | 31 | event ev() 32 | { 33 | local n: count = 2+2; 34 | } 35 | 36 | hook h() 37 | { 38 | local s: string = "foo"; 39 | } 40 | 41 | event bro_init() 42 | { 43 | local n: count = 1; 44 | local i: int = -1; 45 | local s: string = "abc"; 46 | local b: bool = F; 47 | local d: double = 1.111; 48 | local t: time = current_time(); 49 | local I: interval = 3.5 mins; 50 | local p: pattern = /foo|bar/; 51 | local P: port = 53/udp; 52 | local a: addr = 10.0.0.1; 53 | local S: subnet = 10.0.0.1/8; 54 | local o: opaque of md5 = md5_hash_init(); md5_hash_update(o, "test"); 55 | local f: file = open("foo.txt"); 56 | local r: rec = [$s="s", $n=10, $i=-10]; 57 | local en: e = LARGE; 58 | # local T: table = # table of what? 59 | # local ss: set = # set of what? 60 | # local v: vector = # vector of what? 61 | 62 | t1["count"] = n; 63 | t1["int"] = i; 64 | t1["string"] = s; 65 | t1["bool"] = b; 66 | t1["double"] = d; 67 | t1["time"] = t; 68 | t1["interval"] = I; 69 | t1["pattern"] = p; 70 | t1["port"] = P; 71 | t1["addr"] = a; 72 | t1["subnet"] = S; 73 | t1["opaque"] = md5_hash_finish(o); 74 | t1["record"] = r; 75 | t1["file"] = f; 76 | t1["f_void_call"] = f_void(); 77 | t1["f_void"] = f_void; 78 | t1["f_string_call"] = f_string(); 79 | t1["f_string"] = f_string; 80 | t1["event"] = ev; # what's weird is that the variable contains (or just points to?) the contents of the event 81 | # t1["event_call"] = ev(); # this won't ever work. You cannot call an event from an expression. Only from a statement. The same goes for hooks. 82 | # t1["hook_call"] = h(); # this won't ever work. You cannot call an event from an expression. Only from a statement. The same goes for hooks. 83 | t1["hook"] = h; 84 | # t1["enum"] = en; # there is no printable version of an enum 85 | 86 | print t1; 87 | print "#########################"; 88 | for (each in t1) 89 | { 90 | # ports have a strange flatten value... 91 | print fmt("%s = %d", each, |t1[each]|); 92 | } 93 | } 94 | -------------------------------------------------------------------------------- /dbscan/README.md: -------------------------------------------------------------------------------- 1 | An attempt to implement the dbscan algorithm in Bro script - currently not complete. 2 | -------------------------------------------------------------------------------- /dbscan/dbscan.bro: -------------------------------------------------------------------------------- 1 | module DBscan; 2 | export { 3 | type Point: record { 4 | x: double; 5 | y: double; 6 | } &redef; 7 | } 8 | 9 | redef record Point += { 10 | # noise is labeled as 0 11 | lbl: count &optional; 12 | visited: bool &default = F; 13 | neighbors: set[Point] &optional; 14 | }; 15 | 16 | function regionQuery(d: set[Point], p: Point, eps: double): set[Point] 17 | { 18 | local n: set[Point]; 19 | for (each in d) 20 | { 21 | local a: double = |each$x - p$x|; 22 | local b: double = |each$y - p$y|; 23 | 24 | if ( ((a*a)+(b*b)) <= sqrt(eps) ) 25 | { 26 | add n[each]; 27 | } 28 | } 29 | return n; 30 | } 31 | 32 | function expandCluster(d: set[Point], p: Point, cluster: count, eps: double, minpts: count) 33 | { 34 | p$lbl = cluster; 35 | for (np in p$neighbors) 36 | { 37 | if (d[np$visited] = F) 38 | { 39 | d[np$visited] = T; 40 | d[np$neighbors] = regionQuery(d, np, eps); 41 | if (d[np$neighbors] >= minpts) 42 | { 43 | for (each in d[np$neighbors]) 44 | { 45 | add p$neighbors[each]; 46 | } 47 | } 48 | } 49 | if ( (! d[np?$lbl]) || (d[np$lbl]=0) ) 50 | { 51 | d[np]$lbl = cluster; 52 | } 53 | } 54 | } 55 | 56 | function dbscan(d: set[Point], eps: double, minpts: count): set[Point] 57 | { 58 | local cluster: count = 0; 59 | for (p in d) 60 | { 61 | if (! p$visited) 62 | { 63 | p$visited = T; 64 | p$neighbors = regionQuery(d, p, eps); 65 | 66 | if ( (p?$neighbors) && (|p$neighbors| < minpts) ) 67 | { 68 | # mark the point as noise 69 | p$lbl = 0; 70 | } else { 71 | cluster += 1; 72 | # expandCluster(d, p, cluster, eps, minpts); 73 | } 74 | } 75 | print d; 76 | } 77 | return d; 78 | } 79 | 80 | global data: set[Point] = {[$x=1.0, $y=1.0], [$x=1.0, $y=2.0], [$x=2.0, $y=1.0], [$x=2.0, $y=2.0], [$x=10.0, $y=10.0]}; 81 | #print data; 82 | #print regionQuery(data, [$x=1.0, $y=1.0], 2.0); 83 | 84 | dbscan(data, 2.0, 2); 85 | 86 | -------------------------------------------------------------------------------- /dbscan/tester.bro: -------------------------------------------------------------------------------- 1 | type Ctype: record { 2 | c: count; 3 | }; 4 | 5 | global g: set[Ctype] = set([$c=1], [$c=1], [$c=1], [$c=1], [$c=1], [$c=1], [$c=1]); 6 | print g; 7 | 8 | for (each in g) 9 | { 10 | print each; 11 | each$c += 1; 12 | print each; 13 | } 14 | 15 | print g; 16 | -------------------------------------------------------------------------------- /domain_fun/dns_conn_cache.bro: -------------------------------------------------------------------------------- 1 | module DNS; 2 | 3 | export { 4 | type Cache_Object: record { 5 | dns_domain: string; 6 | dns_uid: string; 7 | }; 8 | 9 | redef record connection += { 10 | dns_uid: string &optional; 11 | dns_domain: string &optional; 12 | }; 13 | redef record Conn::Info += { 14 | dns_uid: string &optional &log; 15 | dns_domain: string &optional &log; 16 | }; 17 | 18 | type Asker_Index: table[addr] of Cache_Object; 19 | global dns_cache: table[addr] of Asker_Index &create_expire = 30 secs; 20 | } 21 | 22 | event dns_A_reply(c: connection, msg: dns_msg, ans: dns_answer, a: addr) 23 | { 24 | if (msg$num_answers < 1) 25 | { 26 | return; 27 | } 28 | 29 | local tmp_asker_index: DNS::Asker_Index; 30 | tmp_asker_index[c$id$orig_h] = [$dns_domain=ans$query, $dns_uid=c$uid]; 31 | DNS::dns_cache[a] = tmp_asker_index; 32 | } 33 | 34 | event new_connection(c: connection) 35 | { 36 | if (c$id$resp_h !in DNS::dns_cache) 37 | { 38 | return; 39 | } 40 | 41 | if (c$id$orig_h !in DNS::dns_cache[c$id$resp_h]) 42 | { 43 | return; 44 | } else 45 | { 46 | c$dns_uid = DNS::dns_cache[c$id$resp_h][c$id$orig_h]$dns_uid; 47 | c$dns_domain = DNS::dns_cache[c$id$resp_h][c$id$orig_h]$dns_domain; 48 | } 49 | } 50 | 51 | event connection_state_remove(c: connection) 52 | { 53 | if (! (c?$dns_uid || c?$dns_domain) ) 54 | { 55 | return; 56 | } 57 | c$conn$dns_uid = c$dns_uid; 58 | c$conn$dns_domain = c$dns_domain; 59 | } 60 | -------------------------------------------------------------------------------- /domain_fun/ua_domain_counter.bro: -------------------------------------------------------------------------------- 1 | # this script will count HTTP connections over 5 second intervals. HTTP connections are inspected for: 2 | # the domain from the DNS query preceding the HTTP connection 3 | # the host header field 4 | # the user-agent field 5 | # 6 | 7 | 8 | @load base/frameworks/sumstats 9 | @load ./dns_conn_cache 10 | 11 | module HttpDomains; 12 | 13 | export { 14 | 15 | # alter the interval time to make this script useful 16 | const hd_interval: interval = 5 secs; 17 | 18 | } 19 | 20 | event bro_init() &priority=5 21 | { 22 | local r1: SumStats::Reducer = [$stream="hd", $apply=set(SumStats::UNIQUE)]; 23 | 24 | SumStats::create( [$name="hd", 25 | $epoch=hd_interval, 26 | $reducers=set(r1), 27 | $epoch_result(ts: time, key: SumStats::Key, result: SumStats::Result) = 28 | { 29 | for (each in result) 30 | { 31 | local d: string = split(key$str, /:::/)[1]; 32 | local h: string = split(key$str, /:::/)[2]; 33 | print fmt("domain %s was visited: %d times (with host field %s)", d, result[each]$num, h); 34 | for (ua_each in result[each]$unique_vals) 35 | { 36 | print fmt(" with user_agent: %s", ua_each$str); 37 | } 38 | } 39 | }, 40 | $epoch_finished(ts: time) = 41 | { 42 | print fmt("=============NEXT %s TIME SLICE===============", hd_interval); 43 | } 44 | ] ); 45 | } 46 | 47 | event http_all_headers(c: connection, is_orig: bool, hlist: mime_header_list) 48 | { 49 | # if this is a server response, we don't care about it 50 | if (! is_orig) 51 | { 52 | return; 53 | } 54 | 55 | # if this http stuff was generated without an associated domain or user-agent, we don't care about it 56 | if ( (c?$dns_domain) && (c?$http) && (c$http?$user_agent) ) 57 | { 58 | SumStats::observe("hd", [$str=fmt("%s:::%s", c$dns_domain, c$http$host)], [$str=c$http$user_agent]); 59 | } 60 | } 61 | 62 | -------------------------------------------------------------------------------- /frequency_module.bro: -------------------------------------------------------------------------------- 1 | ##! This code is obsoleted by the SumStats framework 2 | ##! 3 | ##! This module will count the frequencies of connections from an origin to a responder 4 | ##! As the source port of a client usually changes each connection it is not included in the Freq::Info enum 5 | ##! 6 | ##! This script does not count responses. Ever. For anything. If a connection originator (as seen by Bro) is not 7 | ##! a true connection originator, this script lies to you. 8 | ##! This script, as with all of Bro, sees UDP and ICMP is terms of connections, remember that when considering 9 | ##! stats about an originator when port types are /udp or /icmp 10 | ##! 11 | 12 | module Freq; 13 | export { 14 | # redef enum Log::ID += { LOG }; 15 | type Info: record { 16 | orig_h: addr &log; 17 | resp_h: addr &log; 18 | resp_p: port &log; 19 | }; 20 | type Stats: record { 21 | conns: count &log; 22 | orig_bytes_ip: count &log; 23 | orig_pkts: count &log; 24 | }; 25 | # global log_freq: event(rec: Info); 26 | } 27 | 28 | # This global table contains indices of Freq::Info (sip, dip, dport) which yield a frequency count 29 | global conn_freq: table[Freq::Info] of Freq::Stats &redef; 30 | # This makes counting packets by endpoints something something 31 | # http://bro-project.org/documentation/scripts/base/init-bare.html#id-use_conn_size_analyzer 32 | redef use_conn_size_analyzer = T; 33 | 34 | event connection_state_remove(c: connection) 35 | { 36 | local temp_info: Freq::Info = [$orig_h = c$id$orig_h, $resp_h = c$id$resp_h, $resp_p = c$id$resp_p]; 37 | local temp_stats: Freq::Stats = [$conns = 1, $orig_bytes_ip = c$orig$num_bytes_ip , $orig_pkts = c$orig$num_pkts ]; 38 | if (temp_info in conn_freq) { 39 | conn_freq[temp_info]$conns += temp_stats$conns; 40 | conn_freq[temp_info]$orig_bytes_ip += temp_stats$orig_bytes_ip; 41 | conn_freq[temp_info]$orig_pkts += temp_stats$orig_pkts; 42 | } 43 | else { 44 | conn_freq[temp_info] = temp_stats; 45 | } 46 | 47 | } 48 | 49 | #event bro_init() &priority=5 50 | #{ 51 | # Log::create_stream(Freq::LOG, [$column=Info, $ev=log_freq]); 52 | #} 53 | 54 | event bro_done() 55 | { 56 | local conn_freq_size: count = |conn_freq|; 57 | print fmt("the unique client to server:port connections is %d", conn_freq_size); 58 | for (each in conn_freq) { 59 | print fmt( 60 | "%s connected to port %s on %s: %d time, sent %d pkts, which totalled %d (IP and above) bytes.", 61 | each$orig_h, each$resp_p, each$resp_h, 62 | conn_freq[each]$conns, conn_freq[each]$orig_pkts, conn_freq[each]$orig_bytes_ip 63 | ); 64 | } 65 | } 66 | -------------------------------------------------------------------------------- /hello_http_world.bro: -------------------------------------------------------------------------------- 1 | ##! This is a basic Bro script that uses HTTP requests seen by Bro to print something to STDOUT 2 | ##! Printing to STOUT is generally not done (use notices instead). This program is intended for instructional uses only. 3 | ##! To use this program, ensure Bro sees an HTTP reuqest with a URI consisting of multiple levels ('/'). 4 | 5 | # This is a function declaration. The name of the function is greeting. The function has a single parameter. 6 | # The name of the parameter is name and the type of the parameter is string. 7 | # The colon after the closing parenthesis followed by the word string indicates the function is defined to return a string. 8 | function greeting(name: string): string 9 | { 10 | # This function concatenates the string passed to it with static strings and returns the results 11 | return "Hello, " + name + " you smell of elderberries"; 12 | } 13 | 14 | # Below is an event handler. This is a block of code that will execute when Bro witnesses an HTTP request. 15 | # More information about this, and other events types Bro has built in by default can be found here: 16 | # http://www.bro.org/documentation/scripts/base/event.bif.html 17 | event http_request(c: connection, method: string, original_URI: string, unescaped_URI: string, version: string) 18 | { 19 | # This is an if statement. This if statement checks the contents of a string named method. 20 | # method contains the HTTP method used in the HTTP request which raised this event. 21 | # Bro handles passing the proper values to events for the programmer. 22 | # Given that the HTTP request which raised this event does not use the GET verb, this block of code will no do anything 23 | if (method != "GET") 24 | # Bro follows conventions of other languages in that the line following an if statement is executed if 25 | # the statement is true. To execute more than one line of code after an if statement, place the code 26 | # in curly brackets {} 27 | return; 28 | # At this point in the HTTP request event, the greeting function is invoked and the unescaped URI from the HTTP 29 | # request is passed to it. The returned results are then printed to STDOUT. 30 | print greeting(unescaped_URI); 31 | 32 | # This is a local variable declaration. The variable named path of type string_array is set to equal the 33 | # returned value of the split function. 34 | # The split function is passed the value returned from the strip function. 35 | # The strip function is passed a string, the unesacped_URI variable, and a patern to split the string on. 36 | # Variables of type pattern hold regular expressions. 37 | # More information on pattern type variables in Bro can be found here: 38 | # http://www.bro.org/documentation/scripts/builtins.html#type-pattern 39 | # More information on string manipulation functions in Bro can be found here: 40 | # http://www.bro.org/documentation/scripts/base/strings.bif.html 41 | local path: string_array = split( strip(unescaped_URI), /\// ); 42 | 43 | # This is an invocation of a for loop. 44 | # The variable p is set to each index of the string array named path and the block of code below is then executed 45 | # For loops, such as this one, do not consider the index of the variable being iterated over. Order is never guaranteed when 46 | # iterating complex Bro data structures. 47 | # See subexercise part 4 from the 2011 Bro workshop for an additional example of this: 48 | # http://www.bro.org/bro-workshop-2011/solutions/prog-primer/part1.bro 49 | # Because of this, loops must be used carefully 50 | for (p in path){ 51 | # As p is set only to an index, we must use it so. 52 | # This if statement checks to see if each string in the string array path equals an empty string. 53 | if (path[p] == "") 54 | # If the condition is true, the current iteration of the loop is ended. 55 | next; 56 | # The value of each index of the string array is printed to STOUT. 57 | print (path[p]); 58 | } 59 | } 60 | 61 | -------------------------------------------------------------------------------- /http_body_xtr.bro: -------------------------------------------------------------------------------- 1 | ## Extensions to the HTTP module can be made by refering to it 2 | ## this is a mdified version of the script found here: 3 | ## http://mailman.icsi.berkeley.edu/pipermail/bro/2012-March/005413.html 4 | module HTTP; 5 | export { 6 | # redefine the HTTP::Info type to include a string named post_body. The variable is to be logged and is optional 7 | # placing this within an export block makes the changes global 8 | redef record Info += { 9 | # the += above extends the HTTP::Info type instead of overwriting it 10 | body_length: count &log &optional; 11 | body_data: string &log &optional; 12 | }; 13 | } 14 | 15 | # this event is raised when an HTTP body is being parsed 16 | # this event concatenates the body section of an HTTP entity into the connection's HTTP::Info$post_body variable defined in the previous export block 17 | event http_entity_data(c: connection, is_orig: bool, length: count, data: string) 18 | { 19 | # check if the HTTP entity being examined was generated by the originator (creator) of the connection 20 | # if the HTTP entity was from the responder (most likely the server) of the connection, do nothing 21 | if (is_orig) 22 | { 23 | # check if the entity's body variable exists 24 | if (!c$http?$body_data) 25 | { 26 | # if not, set the post_body value to the data of the entity (in ascii hex format) 27 | c$http$body_data = string_to_ascii_hex(data); 28 | # also set the post_body_length value to the length of the post_body_data 29 | c$http$body_length = length; 30 | } 31 | else 32 | { 33 | # if the body already exists, add the data to it (in ascii hex format) 34 | # i don't think the += operator works on strings, so we must use the string_cat function 35 | c$http$body_data = string_cat( c$http$body_data, string_to_ascii_hex(data) ); 36 | c$http$body_length += length; 37 | } 38 | } 39 | } 40 | 41 | # this event is raise when bro initializes 42 | event bro_init() 43 | { 44 | # this is a declaration of a local filter 45 | # the filter will be used on a Log stream 46 | # the filter is named post_data and will create a new log output file named post_body.log 47 | # the filter includes the values listed 48 | local filter: Log::Filter = [$name="http_body", $path="http_data", $include=set("ts", "id.orig_h", "method", "host", "uri", "user-agent", "body_length", "body_data")]; 49 | # the filter is applied to the HTTP::LOG stream 50 | Log::add_filter(HTTP::LOG, filter); 51 | # Because the default Log filter was not disabled from the HTTP::LOG stream, Bro will output both http.log and post_body.log, essentially splitting the HTTP::Log stream 52 | } 53 | 54 | -------------------------------------------------------------------------------- /http_url_params.bro: -------------------------------------------------------------------------------- 1 | ## Monitor HTTP requests for a specific set of unordered parameters 2 | # 3 | # RFC 3986 reserved URI characters (must be encoded if not used as delims) 4 | # : / ? # [ ] @ 5 | # ! $ & ' ( ) * + , ; = 6 | 7 | module HTTP; 8 | 9 | export { 10 | type ss_t: record { 11 | params: set[string]; 12 | }; 13 | 14 | global parameters: table[ss_t] of string; 15 | } 16 | 17 | event bro_init() 18 | { 19 | parameters [ [$params = set("one", "two", "three")] ] = "numbers_spelled_out"; 20 | parameters [ [$params = set("foo", "bar")] ] = "foo_AND_bar"; 21 | parameters [ [$params = set("foo", "bar", "baz")] ] = "foo_AND_bar_AND_baz"; 22 | } 23 | 24 | function extract_params(uri: string): set[string] 25 | { 26 | local p: set[string] = set(); 27 | 28 | if ( strstr(uri, "?") == 0) 29 | return p; 30 | 31 | local query: string = split1(uri, /\?/)[2]; 32 | local opv: table[count] of string = split(query, /&/); 33 | 34 | # This function could easily be altered to keep order of parameter occurance by 35 | # altering the return type of the function and returning opv here 36 | #return opv; 37 | 38 | for (each in opv) 39 | { 40 | add p[ split1(opv[each], /=/)[1] ]; 41 | } 42 | return p; 43 | } 44 | 45 | event http_request(c: connection, method: string, original_URI: string, unescaped_URI: string, version: string) 46 | { 47 | local ss: set[string] = extract_params(original_URI); 48 | 49 | if ([$params=ss] in parameters) 50 | print parameters[ [$params=ss] ]; 51 | } 52 | -------------------------------------------------------------------------------- /input_for_pcaps/README.md: -------------------------------------------------------------------------------- 1 | Bro's input framework reads files asynchronously. See [here](http://www.bro.org/sphinx/input.html) 2 | 3 | If using the input framework within a Bro script and running Bro against a small PCAP, often Bro will terminate before the input framework finishes reading in whatever file. 4 | suspend_input_continue is an example script that solves this problem. 5 | 6 | Usage 7 | ==== 8 | Suspend packet processing until the input framework completes, then continue packet processing. 9 | 10 | chmod +x blacklist_builder.sh 11 | ./blacklist_builder.sh > blacklist.file 12 | bro -r small.pcap suspend_input_continue.bro 13 | -------------------------------------------------------------------------------- /input_for_pcaps/blacklist_builder.sh: -------------------------------------------------------------------------------- 1 | echo -e "#fields\tip\ttimestamp\treason" 2 | 3 | for i in {1..1}; do 4 | for j in {1..5}; do 5 | for k in {1..255}; do 6 | for l in {1..255}; do 7 | echo -e "$i.$j.$k.$l\t1324567890\tbadIP" 8 | done 9 | done 10 | done 11 | done 12 | -------------------------------------------------------------------------------- /input_for_pcaps/suspend_input_continue.bro: -------------------------------------------------------------------------------- 1 | type Idx: record { 2 | ip: addr; 3 | }; 4 | type Val: record { 5 | timestamp: time; 6 | reason: string; 7 | }; 8 | global blacklist: table[addr] of Val = table(); 9 | 10 | event bro_init() 11 | { 12 | suspend_processing(); 13 | 14 | Input::add_table( [$source="blacklist.file", $name="blacklist", $idx=Idx, $val=Val, $destination=blacklist] ); 15 | Input::remove("blacklist"); 16 | 17 | when (|blacklist| > 0) 18 | { 19 | continue_processing(); 20 | } 21 | } 22 | 23 | event new_connection(c: connection) 24 | { 25 | if (c$id$resp_h in blacklist) 26 | { 27 | print "connection to blacklisted IP"; 28 | } 29 | } 30 | -------------------------------------------------------------------------------- /intel-extensions/dns-tld.bro: -------------------------------------------------------------------------------- 1 | @load frameworks/intel/seen 2 | @load base/frameworks/intel 3 | @load frameworks/intel/seen/where-locations 4 | 5 | # public_suffix.bro should probably be read in with the input framework instead of loaded like it is 6 | @load public_suffix 7 | 8 | function tldr(s: string): string 9 | { 10 | if ( (/\./ !in s) || (s in suffixes) ) 11 | return s; 12 | 13 | return tldr( split1(s, /\./)[2] ); 14 | } 15 | 16 | redef Intel::read_files += { 17 | fmt("%s/intel-1.dat", @DIR) 18 | }; 19 | 20 | event dns_request(c: connection, msg: dns_msg, query: string, qtype: count, qclass: count) 21 | { 22 | Intel::seen([$indicator=tldr(query), 23 | $indicator_type=Intel::DOMAIN, 24 | $conn=c, 25 | $where=DNS::IN_REQUEST]); 26 | } 27 | 28 | -------------------------------------------------------------------------------- /intel-extensions/intel-1.dat: -------------------------------------------------------------------------------- 1 | #fields indicator indicator_type meta.source 2 | com Intel::DOMAIN my_source 3 | org Intel::DOMAIN my_source 4 | -------------------------------------------------------------------------------- /intel-extensions/public_suffix.bro: -------------------------------------------------------------------------------- 1 | global suffixes: set[string] = { 2 | "ac", 3 | "com.ac", 4 | "edu.ac", 5 | "gov.ac", 6 | "net.ac", 7 | "mil.ac", 8 | "org.ac", 9 | "ad", 10 | "nom.ad", 11 | "ae", 12 | "co.ae", 13 | "net.ae", 14 | "org.ae", 15 | "sch.ae", 16 | "ac.ae", 17 | "gov.ae", 18 | "mil.ae", 19 | "aero", 20 | "accident-investigation.aero", 21 | "accident-prevention.aero", 22 | "aerobatic.aero", 23 | "aeroclub.aero", 24 | "aerodrome.aero", 25 | "agents.aero", 26 | "aircraft.aero", 27 | "airline.aero", 28 | "airport.aero", 29 | "air-surveillance.aero", 30 | "airtraffic.aero", 31 | "air-traffic-control.aero", 32 | "ambulance.aero", 33 | "amusement.aero", 34 | "association.aero", 35 | "author.aero", 36 | "ballooning.aero", 37 | "broker.aero", 38 | "caa.aero", 39 | "cargo.aero", 40 | "catering.aero", 41 | "certification.aero", 42 | "championship.aero", 43 | "charter.aero", 44 | "civilaviation.aero", 45 | "club.aero", 46 | "conference.aero", 47 | "consultant.aero", 48 | "consulting.aero", 49 | "control.aero", 50 | "council.aero", 51 | "crew.aero", 52 | "design.aero", 53 | "dgca.aero", 54 | "educator.aero", 55 | "emergency.aero", 56 | "engine.aero", 57 | "engineer.aero", 58 | "entertainment.aero", 59 | "equipment.aero", 60 | "exchange.aero", 61 | "express.aero", 62 | "federation.aero", 63 | "flight.aero", 64 | "freight.aero", 65 | "fuel.aero", 66 | "gliding.aero", 67 | "government.aero", 68 | "groundhandling.aero", 69 | "group.aero", 70 | "hanggliding.aero", 71 | "homebuilt.aero", 72 | "insurance.aero", 73 | "journal.aero", 74 | "journalist.aero", 75 | "leasing.aero", 76 | "logistics.aero", 77 | "magazine.aero", 78 | "maintenance.aero", 79 | "marketplace.aero", 80 | "media.aero", 81 | "microlight.aero", 82 | "modelling.aero", 83 | "navigation.aero", 84 | "parachuting.aero", 85 | "paragliding.aero", 86 | "passenger-association.aero", 87 | "pilot.aero", 88 | "press.aero", 89 | "production.aero", 90 | "recreation.aero", 91 | "repbody.aero", 92 | "res.aero", 93 | "research.aero", 94 | "rotorcraft.aero", 95 | "safety.aero", 96 | "scientist.aero", 97 | "services.aero", 98 | "show.aero", 99 | "skydiving.aero", 100 | "software.aero", 101 | "student.aero", 102 | "taxi.aero", 103 | "trader.aero", 104 | "trading.aero", 105 | "trainer.aero", 106 | "union.aero", 107 | "workinggroup.aero", 108 | "works.aero", 109 | "af", 110 | "gov.af", 111 | "com.af", 112 | "org.af", 113 | "net.af", 114 | "edu.af", 115 | "ag", 116 | "com.ag", 117 | "org.ag", 118 | "net.ag", 119 | "co.ag", 120 | "nom.ag", 121 | "ai", 122 | "off.ai", 123 | "com.ai", 124 | "net.ai", 125 | "org.ai", 126 | "al", 127 | "com.al", 128 | "edu.al", 129 | "gov.al", 130 | "mil.al", 131 | "net.al", 132 | "org.al", 133 | "am", 134 | "an", 135 | "com.an", 136 | "net.an", 137 | "org.an", 138 | "edu.an", 139 | "ao", 140 | "ed.ao", 141 | "gv.ao", 142 | "og.ao", 143 | "co.ao", 144 | "pb.ao", 145 | "it.ao", 146 | "aq", 147 | "ar", 148 | "congresodelalengua3.ar", 149 | "educ.ar", 150 | "gobiernoelectronico.ar", 151 | "mecon.ar", 152 | "nacion.ar", 153 | "nic.ar", 154 | "promocion.ar", 155 | "retina.ar", 156 | "uba.ar", 157 | "e164.arpa", 158 | "in-addr.arpa", 159 | "ip6.arpa", 160 | "iris.arpa", 161 | "uri.arpa", 162 | "urn.arpa", 163 | "as", 164 | "gov.as", 165 | "asia", 166 | "at", 167 | "ac.at", 168 | "co.at", 169 | "gv.at", 170 | "or.at", 171 | "com.au", 172 | "net.au", 173 | "org.au", 174 | "edu.au", 175 | "gov.au", 176 | "asn.au", 177 | "id.au", 178 | "csiro.au", 179 | "info.au", 180 | "conf.au", 181 | "oz.au", 182 | "act.au", 183 | "nsw.au", 184 | "nt.au", 185 | "qld.au", 186 | "sa.au", 187 | "tas.au", 188 | "vic.au", 189 | "wa.au", 190 | "act.edu.au", 191 | "nsw.edu.au", 192 | "nt.edu.au", 193 | "qld.edu.au", 194 | "sa.edu.au", 195 | "tas.edu.au", 196 | "vic.edu.au", 197 | "wa.edu.au", 198 | "act.gov.au", 199 | "nt.gov.au", 200 | "qld.gov.au", 201 | "sa.gov.au", 202 | "tas.gov.au", 203 | "vic.gov.au", 204 | "wa.gov.au", 205 | "aw", 206 | "com.aw", 207 | "ax", 208 | "az", 209 | "com.az", 210 | "net.az", 211 | "int.az", 212 | "gov.az", 213 | "org.az", 214 | "edu.az", 215 | "info.az", 216 | "pp.az", 217 | "mil.az", 218 | "name.az", 219 | "pro.az", 220 | "biz.az", 221 | "ba", 222 | "org.ba", 223 | "net.ba", 224 | "edu.ba", 225 | "gov.ba", 226 | "mil.ba", 227 | "unsa.ba", 228 | "unbi.ba", 229 | "co.ba", 230 | "com.ba", 231 | "rs.ba", 232 | "bb", 233 | "biz.bb", 234 | "com.bb", 235 | "edu.bb", 236 | "gov.bb", 237 | "info.bb", 238 | "net.bb", 239 | "org.bb", 240 | "store.bb", 241 | "bd", 242 | "be", 243 | "ac.be", 244 | "bf", 245 | "gov.bf", 246 | "bg", 247 | "a.bg", 248 | "b.bg", 249 | "c.bg", 250 | "d.bg", 251 | "e.bg", 252 | "f.bg", 253 | "g.bg", 254 | "h.bg", 255 | "i.bg", 256 | "j.bg", 257 | "k.bg", 258 | "l.bg", 259 | "m.bg", 260 | "n.bg", 261 | "o.bg", 262 | "p.bg", 263 | "q.bg", 264 | "r.bg", 265 | "s.bg", 266 | "t.bg", 267 | "u.bg", 268 | "v.bg", 269 | "w.bg", 270 | "x.bg", 271 | "y.bg", 272 | "z.bg", 273 | "0.bg", 274 | "1.bg", 275 | "2.bg", 276 | "3.bg", 277 | "4.bg", 278 | "5.bg", 279 | "6.bg", 280 | "7.bg", 281 | "8.bg", 282 | "9.bg", 283 | "bh", 284 | "com.bh", 285 | "edu.bh", 286 | "net.bh", 287 | "org.bh", 288 | "gov.bh", 289 | "bi", 290 | "co.bi", 291 | "com.bi", 292 | "edu.bi", 293 | "or.bi", 294 | "org.bi", 295 | "biz", 296 | "bj", 297 | "asso.bj", 298 | "barreau.bj", 299 | "gouv.bj", 300 | "bm", 301 | "com.bm", 302 | "edu.bm", 303 | "gov.bm", 304 | "net.bm", 305 | "org.bm", 306 | "bn", 307 | "bo", 308 | "com.bo", 309 | "edu.bo", 310 | "gov.bo", 311 | "gob.bo", 312 | "int.bo", 313 | "org.bo", 314 | "net.bo", 315 | "mil.bo", 316 | "tv.bo", 317 | "br", 318 | "adm.br", 319 | "adv.br", 320 | "agr.br", 321 | "am.br", 322 | "arq.br", 323 | "art.br", 324 | "ato.br", 325 | "b.br", 326 | "bio.br", 327 | "blog.br", 328 | "bmd.br", 329 | "cim.br", 330 | "cng.br", 331 | "cnt.br", 332 | "com.br", 333 | "coop.br", 334 | "ecn.br", 335 | "eco.br", 336 | "edu.br", 337 | "emp.br", 338 | "eng.br", 339 | "esp.br", 340 | "etc.br", 341 | "eti.br", 342 | "far.br", 343 | "flog.br", 344 | "fm.br", 345 | "fnd.br", 346 | "fot.br", 347 | "fst.br", 348 | "g12.br", 349 | "ggf.br", 350 | "gov.br", 351 | "imb.br", 352 | "ind.br", 353 | "inf.br", 354 | "jor.br", 355 | "jus.br", 356 | "leg.br", 357 | "lel.br", 358 | "mat.br", 359 | "med.br", 360 | "mil.br", 361 | "mus.br", 362 | "net.br", 363 | "nom.br", 364 | "not.br", 365 | "ntr.br", 366 | "odo.br", 367 | "org.br", 368 | "ppg.br", 369 | "pro.br", 370 | "psc.br", 371 | "psi.br", 372 | "qsl.br", 373 | "radio.br", 374 | "rec.br", 375 | "slg.br", 376 | "srv.br", 377 | "taxi.br", 378 | "teo.br", 379 | "tmp.br", 380 | "trd.br", 381 | "tur.br", 382 | "tv.br", 383 | "vet.br", 384 | "vlog.br", 385 | "wiki.br", 386 | "zlg.br", 387 | "bs", 388 | "com.bs", 389 | "net.bs", 390 | "org.bs", 391 | "edu.bs", 392 | "gov.bs", 393 | "bt", 394 | "com.bt", 395 | "edu.bt", 396 | "gov.bt", 397 | "net.bt", 398 | "org.bt", 399 | "bw", 400 | "co.bw", 401 | "org.bw", 402 | "by", 403 | "gov.by", 404 | "mil.by", 405 | "com.by", 406 | "of.by", 407 | "bz", 408 | "com.bz", 409 | "net.bz", 410 | "org.bz", 411 | "edu.bz", 412 | "gov.bz", 413 | "ca", 414 | "ab.ca", 415 | "bc.ca", 416 | "mb.ca", 417 | "nb.ca", 418 | "nf.ca", 419 | "nl.ca", 420 | "ns.ca", 421 | "nt.ca", 422 | "nu.ca", 423 | "on.ca", 424 | "pe.ca", 425 | "qc.ca", 426 | "sk.ca", 427 | "yk.ca", 428 | "gc.ca", 429 | "cat", 430 | "cc", 431 | "cd", 432 | "gov.cd", 433 | "cf", 434 | "cg", 435 | "ch", 436 | "ci", 437 | "org.ci", 438 | "or.ci", 439 | "com.ci", 440 | "co.ci", 441 | "edu.ci", 442 | "ed.ci", 443 | "ac.ci", 444 | "net.ci", 445 | "go.ci", 446 | "asso.ci", 447 | "aéroport.ci", 448 | "int.ci", 449 | "presse.ci", 450 | "md.ci", 451 | "gouv.ci", 452 | "ck", 453 | "www.ck", 454 | "cl", 455 | "gov.cl", 456 | "gob.cl", 457 | "co.cl", 458 | "mil.cl", 459 | "cm", 460 | "gov.cm", 461 | "cn", 462 | "ac.cn", 463 | "com.cn", 464 | "edu.cn", 465 | "gov.cn", 466 | "net.cn", 467 | "org.cn", 468 | "mil.cn", 469 | "公司.cn", 470 | "网络.cn", 471 | "網絡.cn", 472 | "ah.cn", 473 | "bj.cn", 474 | "cq.cn", 475 | "fj.cn", 476 | "gd.cn", 477 | "gs.cn", 478 | "gz.cn", 479 | "gx.cn", 480 | "ha.cn", 481 | "hb.cn", 482 | "he.cn", 483 | "hi.cn", 484 | "hl.cn", 485 | "hn.cn", 486 | "jl.cn", 487 | "js.cn", 488 | "jx.cn", 489 | "ln.cn", 490 | "nm.cn", 491 | "nx.cn", 492 | "qh.cn", 493 | "sc.cn", 494 | "sd.cn", 495 | "sh.cn", 496 | "sn.cn", 497 | "sx.cn", 498 | "tj.cn", 499 | "xj.cn", 500 | "xz.cn", 501 | "yn.cn", 502 | "zj.cn", 503 | "hk.cn", 504 | "mo.cn", 505 | "tw.cn", 506 | "co", 507 | "arts.co", 508 | "com.co", 509 | "edu.co", 510 | "firm.co", 511 | "gov.co", 512 | "info.co", 513 | "int.co", 514 | "mil.co", 515 | "net.co", 516 | "nom.co", 517 | "org.co", 518 | "rec.co", 519 | "web.co", 520 | "com", 521 | "coop", 522 | "cr", 523 | "ac.cr", 524 | "co.cr", 525 | "ed.cr", 526 | "fi.cr", 527 | "go.cr", 528 | "or.cr", 529 | "sa.cr", 530 | "cu", 531 | "com.cu", 532 | "edu.cu", 533 | "org.cu", 534 | "net.cu", 535 | "gov.cu", 536 | "inf.cu", 537 | "cv", 538 | "cw", 539 | "com.cw", 540 | "edu.cw", 541 | "net.cw", 542 | "org.cw", 543 | "cx", 544 | "gov.cx", 545 | "cy", 546 | "cz", 547 | "de", 548 | "dj", 549 | "dk", 550 | "dm", 551 | "com.dm", 552 | "net.dm", 553 | "org.dm", 554 | "edu.dm", 555 | "gov.dm", 556 | "do", 557 | "art.do", 558 | "com.do", 559 | "edu.do", 560 | "gob.do", 561 | "gov.do", 562 | "mil.do", 563 | "net.do", 564 | "org.do", 565 | "sld.do", 566 | "web.do", 567 | "dz", 568 | "com.dz", 569 | "org.dz", 570 | "net.dz", 571 | "gov.dz", 572 | "edu.dz", 573 | "asso.dz", 574 | "pol.dz", 575 | "art.dz", 576 | "ec", 577 | "com.ec", 578 | "info.ec", 579 | "net.ec", 580 | "fin.ec", 581 | "k12.ec", 582 | "med.ec", 583 | "pro.ec", 584 | "org.ec", 585 | "edu.ec", 586 | "gov.ec", 587 | "gob.ec", 588 | "mil.ec", 589 | "edu", 590 | "ee", 591 | "edu.ee", 592 | "gov.ee", 593 | "riik.ee", 594 | "lib.ee", 595 | "med.ee", 596 | "com.ee", 597 | "pri.ee", 598 | "aip.ee", 599 | "org.ee", 600 | "fie.ee", 601 | "eg", 602 | "com.eg", 603 | "edu.eg", 604 | "eun.eg", 605 | "gov.eg", 606 | "mil.eg", 607 | "name.eg", 608 | "net.eg", 609 | "org.eg", 610 | "sci.eg", 611 | "er", 612 | "es", 613 | "com.es", 614 | "nom.es", 615 | "org.es", 616 | "gob.es", 617 | "edu.es", 618 | "et", 619 | "eu", 620 | "fi", 621 | "aland.fi", 622 | "fj", 623 | "fk", 624 | "fm", 625 | "fo", 626 | "fr", 627 | "com.fr", 628 | "asso.fr", 629 | "nom.fr", 630 | "prd.fr", 631 | "presse.fr", 632 | "tm.fr", 633 | "aeroport.fr", 634 | "assedic.fr", 635 | "avocat.fr", 636 | "avoues.fr", 637 | "cci.fr", 638 | "chambagri.fr", 639 | "chirurgiens-dentistes.fr", 640 | "experts-comptables.fr", 641 | "geometre-expert.fr", 642 | "gouv.fr", 643 | "greta.fr", 644 | "huissier-justice.fr", 645 | "medecin.fr", 646 | "notaires.fr", 647 | "pharmacien.fr", 648 | "port.fr", 649 | "veterinaire.fr", 650 | "ga", 651 | "gd", 652 | "ge", 653 | "com.ge", 654 | "edu.ge", 655 | "gov.ge", 656 | "org.ge", 657 | "mil.ge", 658 | "net.ge", 659 | "pvt.ge", 660 | "gf", 661 | "gg", 662 | "co.gg", 663 | "org.gg", 664 | "net.gg", 665 | "sch.gg", 666 | "gov.gg", 667 | "gh", 668 | "com.gh", 669 | "edu.gh", 670 | "gov.gh", 671 | "org.gh", 672 | "mil.gh", 673 | "gi", 674 | "com.gi", 675 | "ltd.gi", 676 | "gov.gi", 677 | "mod.gi", 678 | "edu.gi", 679 | "org.gi", 680 | "gl", 681 | "gm", 682 | "ac.gn", 683 | "com.gn", 684 | "edu.gn", 685 | "gov.gn", 686 | "org.gn", 687 | "net.gn", 688 | "gov", 689 | "gp", 690 | "com.gp", 691 | "net.gp", 692 | "mobi.gp", 693 | "edu.gp", 694 | "org.gp", 695 | "asso.gp", 696 | "gq", 697 | "gr", 698 | "com.gr", 699 | "edu.gr", 700 | "net.gr", 701 | "org.gr", 702 | "gov.gr", 703 | "gs", 704 | "gt", 705 | "com.gt", 706 | "edu.gt", 707 | "gob.gt", 708 | "ind.gt", 709 | "mil.gt", 710 | "net.gt", 711 | "org.gt", 712 | "gu", 713 | "gw", 714 | "gy", 715 | "co.gy", 716 | "com.gy", 717 | "net.gy", 718 | "hk", 719 | "com.hk", 720 | "edu.hk", 721 | "gov.hk", 722 | "idv.hk", 723 | "net.hk", 724 | "org.hk", 725 | "公司.hk", 726 | "教育.hk", 727 | "敎育.hk", 728 | "政府.hk", 729 | "個人.hk", 730 | "个人.hk", 731 | "箇人.hk", 732 | "網络.hk", 733 | "网络.hk", 734 | "组織.hk", 735 | "網絡.hk", 736 | "网絡.hk", 737 | "组织.hk", 738 | "組織.hk", 739 | "組织.hk", 740 | "hm", 741 | "hn", 742 | "com.hn", 743 | "edu.hn", 744 | "org.hn", 745 | "net.hn", 746 | "mil.hn", 747 | "gob.hn", 748 | "hr", 749 | "iz.hr", 750 | "from.hr", 751 | "name.hr", 752 | "com.hr", 753 | "ht", 754 | "com.ht", 755 | "shop.ht", 756 | "firm.ht", 757 | "info.ht", 758 | "adult.ht", 759 | "net.ht", 760 | "pro.ht", 761 | "org.ht", 762 | "med.ht", 763 | "art.ht", 764 | "coop.ht", 765 | "pol.ht", 766 | "asso.ht", 767 | "edu.ht", 768 | "rel.ht", 769 | "gouv.ht", 770 | "perso.ht", 771 | "hu", 772 | "co.hu", 773 | "info.hu", 774 | "org.hu", 775 | "priv.hu", 776 | "sport.hu", 777 | "tm.hu", 778 | "2000.hu", 779 | "agrar.hu", 780 | "bolt.hu", 781 | "casino.hu", 782 | "city.hu", 783 | "erotica.hu", 784 | "erotika.hu", 785 | "film.hu", 786 | "forum.hu", 787 | "games.hu", 788 | "hotel.hu", 789 | "ingatlan.hu", 790 | "jogasz.hu", 791 | "konyvelo.hu", 792 | "lakas.hu", 793 | "media.hu", 794 | "news.hu", 795 | "reklam.hu", 796 | "sex.hu", 797 | "shop.hu", 798 | "suli.hu", 799 | "szex.hu", 800 | "tozsde.hu", 801 | "utazas.hu", 802 | "video.hu", 803 | "id", 804 | "ac.id", 805 | "biz.id", 806 | "co.id", 807 | "go.id", 808 | "mil.id", 809 | "my.id", 810 | "net.id", 811 | "or.id", 812 | "sch.id", 813 | "web.id", 814 | "ie", 815 | "gov.ie", 816 | "il", 817 | "im", 818 | "co.im", 819 | "ltd.co.im", 820 | "plc.co.im", 821 | "net.im", 822 | "gov.im", 823 | "org.im", 824 | "nic.im", 825 | "ac.im", 826 | "in", 827 | "co.in", 828 | "firm.in", 829 | "net.in", 830 | "org.in", 831 | "gen.in", 832 | "ind.in", 833 | "nic.in", 834 | "ac.in", 835 | "edu.in", 836 | "res.in", 837 | "gov.in", 838 | "mil.in", 839 | "info", 840 | "int", 841 | "eu.int", 842 | "io", 843 | "com.io", 844 | "iq", 845 | "gov.iq", 846 | "edu.iq", 847 | "mil.iq", 848 | "com.iq", 849 | "org.iq", 850 | "net.iq", 851 | "ir", 852 | "ac.ir", 853 | "co.ir", 854 | "gov.ir", 855 | "id.ir", 856 | "net.ir", 857 | "org.ir", 858 | "sch.ir", 859 | "ایران.ir", 860 | "ايران.ir", 861 | "is", 862 | "net.is", 863 | "com.is", 864 | "edu.is", 865 | "gov.is", 866 | "org.is", 867 | "int.is", 868 | "it", 869 | "gov.it", 870 | "edu.it", 871 | "agrigento.it", 872 | "ag.it", 873 | "alessandria.it", 874 | "al.it", 875 | "ancona.it", 876 | "an.it", 877 | "aosta.it", 878 | "aoste.it", 879 | "ao.it", 880 | "arezzo.it", 881 | "ar.it", 882 | "ascoli-piceno.it", 883 | "ascolipiceno.it", 884 | "ap.it", 885 | "asti.it", 886 | "at.it", 887 | "avellino.it", 888 | "av.it", 889 | "bari.it", 890 | "ba.it", 891 | "andria-barletta-trani.it", 892 | "andriabarlettatrani.it", 893 | "trani-barletta-andria.it", 894 | "tranibarlettaandria.it", 895 | "barletta-trani-andria.it", 896 | "barlettatraniandria.it", 897 | "andria-trani-barletta.it", 898 | "andriatranibarletta.it", 899 | "trani-andria-barletta.it", 900 | "traniandriabarletta.it", 901 | "bt.it", 902 | "belluno.it", 903 | "bl.it", 904 | "benevento.it", 905 | "bn.it", 906 | "bergamo.it", 907 | "bg.it", 908 | "biella.it", 909 | "bi.it", 910 | "bologna.it", 911 | "bo.it", 912 | "bolzano.it", 913 | "bozen.it", 914 | "balsan.it", 915 | "alto-adige.it", 916 | "altoadige.it", 917 | "suedtirol.it", 918 | "bz.it", 919 | "brescia.it", 920 | "bs.it", 921 | "brindisi.it", 922 | "br.it", 923 | "cagliari.it", 924 | "ca.it", 925 | "caltanissetta.it", 926 | "cl.it", 927 | "campobasso.it", 928 | "cb.it", 929 | "carboniaiglesias.it", 930 | "carbonia-iglesias.it", 931 | "iglesias-carbonia.it", 932 | "iglesiascarbonia.it", 933 | "ci.it", 934 | "caserta.it", 935 | "ce.it", 936 | "catania.it", 937 | "ct.it", 938 | "catanzaro.it", 939 | "cz.it", 940 | "chieti.it", 941 | "ch.it", 942 | "como.it", 943 | "co.it", 944 | "cosenza.it", 945 | "cs.it", 946 | "cremona.it", 947 | "cr.it", 948 | "crotone.it", 949 | "kr.it", 950 | "cuneo.it", 951 | "cn.it", 952 | "dell-ogliastra.it", 953 | "dellogliastra.it", 954 | "ogliastra.it", 955 | "og.it", 956 | "enna.it", 957 | "en.it", 958 | "ferrara.it", 959 | "fe.it", 960 | "fermo.it", 961 | "fm.it", 962 | "firenze.it", 963 | "florence.it", 964 | "fi.it", 965 | "foggia.it", 966 | "fg.it", 967 | "forli-cesena.it", 968 | "forlicesena.it", 969 | "cesena-forli.it", 970 | "cesenaforli.it", 971 | "fc.it", 972 | "frosinone.it", 973 | "fr.it", 974 | "genova.it", 975 | "genoa.it", 976 | "ge.it", 977 | "gorizia.it", 978 | "go.it", 979 | "grosseto.it", 980 | "gr.it", 981 | "imperia.it", 982 | "im.it", 983 | "isernia.it", 984 | "is.it", 985 | "laquila.it", 986 | "aquila.it", 987 | "aq.it", 988 | "la-spezia.it", 989 | "laspezia.it", 990 | "sp.it", 991 | "latina.it", 992 | "lt.it", 993 | "lecce.it", 994 | "le.it", 995 | "lecco.it", 996 | "lc.it", 997 | "livorno.it", 998 | "li.it", 999 | "lodi.it", 1000 | "lo.it", 1001 | "lucca.it", 1002 | "lu.it", 1003 | "macerata.it", 1004 | "mc.it", 1005 | "mantova.it", 1006 | "mn.it", 1007 | "massa-carrara.it", 1008 | "massacarrara.it", 1009 | "carrara-massa.it", 1010 | "carraramassa.it", 1011 | "ms.it", 1012 | "matera.it", 1013 | "mt.it", 1014 | "medio-campidano.it", 1015 | "mediocampidano.it", 1016 | "campidano-medio.it", 1017 | "campidanomedio.it", 1018 | "vs.it", 1019 | "messina.it", 1020 | "me.it", 1021 | "milano.it", 1022 | "milan.it", 1023 | "mi.it", 1024 | "modena.it", 1025 | "mo.it", 1026 | "monza.it", 1027 | "monza-brianza.it", 1028 | "monzabrianza.it", 1029 | "monzaebrianza.it", 1030 | "monzaedellabrianza.it", 1031 | "monza-e-della-brianza.it", 1032 | "mb.it", 1033 | "napoli.it", 1034 | "naples.it", 1035 | "na.it", 1036 | "novara.it", 1037 | "no.it", 1038 | "nuoro.it", 1039 | "nu.it", 1040 | "oristano.it", 1041 | "or.it", 1042 | "padova.it", 1043 | "padua.it", 1044 | "pd.it", 1045 | "palermo.it", 1046 | "pa.it", 1047 | "parma.it", 1048 | "pr.it", 1049 | "pavia.it", 1050 | "pv.it", 1051 | "perugia.it", 1052 | "pg.it", 1053 | "pescara.it", 1054 | "pe.it", 1055 | "pesaro-urbino.it", 1056 | "pesarourbino.it", 1057 | "urbino-pesaro.it", 1058 | "urbinopesaro.it", 1059 | "pu.it", 1060 | "piacenza.it", 1061 | "pc.it", 1062 | "pisa.it", 1063 | "pi.it", 1064 | "pistoia.it", 1065 | "pt.it", 1066 | "pordenone.it", 1067 | "pn.it", 1068 | "potenza.it", 1069 | "pz.it", 1070 | "prato.it", 1071 | "po.it", 1072 | "ragusa.it", 1073 | "rg.it", 1074 | "ravenna.it", 1075 | "ra.it", 1076 | "reggio-calabria.it", 1077 | "reggiocalabria.it", 1078 | "rc.it", 1079 | "reggio-emilia.it", 1080 | "reggioemilia.it", 1081 | "re.it", 1082 | "rieti.it", 1083 | "ri.it", 1084 | "rimini.it", 1085 | "rn.it", 1086 | "roma.it", 1087 | "rome.it", 1088 | "rm.it", 1089 | "rovigo.it", 1090 | "ro.it", 1091 | "salerno.it", 1092 | "sa.it", 1093 | "sassari.it", 1094 | "ss.it", 1095 | "savona.it", 1096 | "sv.it", 1097 | "siena.it", 1098 | "si.it", 1099 | "siracusa.it", 1100 | "sr.it", 1101 | "sondrio.it", 1102 | "so.it", 1103 | "taranto.it", 1104 | "ta.it", 1105 | "tempio-olbia.it", 1106 | "tempioolbia.it", 1107 | "olbia-tempio.it", 1108 | "olbiatempio.it", 1109 | "ot.it", 1110 | "teramo.it", 1111 | "te.it", 1112 | "terni.it", 1113 | "tr.it", 1114 | "torino.it", 1115 | "turin.it", 1116 | "to.it", 1117 | "trapani.it", 1118 | "tp.it", 1119 | "trento.it", 1120 | "trentino.it", 1121 | "tn.it", 1122 | "treviso.it", 1123 | "tv.it", 1124 | "trieste.it", 1125 | "ts.it", 1126 | "udine.it", 1127 | "ud.it", 1128 | "varese.it", 1129 | "va.it", 1130 | "venezia.it", 1131 | "venice.it", 1132 | "ve.it", 1133 | "verbania.it", 1134 | "vb.it", 1135 | "vercelli.it", 1136 | "vc.it", 1137 | "verona.it", 1138 | "vr.it", 1139 | "vibo-valentia.it", 1140 | "vibovalentia.it", 1141 | "vv.it", 1142 | "vicenza.it", 1143 | "vi.it", 1144 | "viterbo.it", 1145 | "vt.it", 1146 | "je", 1147 | "co.je", 1148 | "org.je", 1149 | "net.je", 1150 | "sch.je", 1151 | "gov.je", 1152 | "jm", 1153 | "jo", 1154 | "com.jo", 1155 | "org.jo", 1156 | "net.jo", 1157 | "edu.jo", 1158 | "sch.jo", 1159 | "gov.jo", 1160 | "mil.jo", 1161 | "name.jo", 1162 | "jobs", 1163 | "jp", 1164 | "ac.jp", 1165 | "ad.jp", 1166 | "co.jp", 1167 | "ed.jp", 1168 | "go.jp", 1169 | "gr.jp", 1170 | "lg.jp", 1171 | "ne.jp", 1172 | "or.jp", 1173 | "aichi.jp", 1174 | "akita.jp", 1175 | "aomori.jp", 1176 | "chiba.jp", 1177 | "ehime.jp", 1178 | "fukui.jp", 1179 | "fukuoka.jp", 1180 | "fukushima.jp", 1181 | "gifu.jp", 1182 | "gunma.jp", 1183 | "hiroshima.jp", 1184 | "hokkaido.jp", 1185 | "hyogo.jp", 1186 | "ibaraki.jp", 1187 | "ishikawa.jp", 1188 | "iwate.jp", 1189 | "kagawa.jp", 1190 | "kagoshima.jp", 1191 | "kanagawa.jp", 1192 | "kochi.jp", 1193 | "kumamoto.jp", 1194 | "kyoto.jp", 1195 | "mie.jp", 1196 | "miyagi.jp", 1197 | "miyazaki.jp", 1198 | "nagano.jp", 1199 | "nagasaki.jp", 1200 | "nara.jp", 1201 | "niigata.jp", 1202 | "oita.jp", 1203 | "okayama.jp", 1204 | "okinawa.jp", 1205 | "osaka.jp", 1206 | "saga.jp", 1207 | "saitama.jp", 1208 | "shiga.jp", 1209 | "shimane.jp", 1210 | "shizuoka.jp", 1211 | "tochigi.jp", 1212 | "tokushima.jp", 1213 | "tokyo.jp", 1214 | "tottori.jp", 1215 | "toyama.jp", 1216 | "wakayama.jp", 1217 | "yamagata.jp", 1218 | "yamaguchi.jp", 1219 | "yamanashi.jp", 1220 | "kawasaki.jp", 1221 | "kitakyushu.jp", 1222 | "kobe.jp", 1223 | "nagoya.jp", 1224 | "sapporo.jp", 1225 | "sendai.jp", 1226 | "yokohama.jp", 1227 | "city.kawasaki.jp", 1228 | "city.kitakyushu.jp", 1229 | "city.kobe.jp", 1230 | "city.nagoya.jp", 1231 | "city.sapporo.jp", 1232 | "city.sendai.jp", 1233 | "city.yokohama.jp", 1234 | "aisai.aichi.jp", 1235 | "ama.aichi.jp", 1236 | "anjo.aichi.jp", 1237 | "asuke.aichi.jp", 1238 | "chiryu.aichi.jp", 1239 | "chita.aichi.jp", 1240 | "fuso.aichi.jp", 1241 | "gamagori.aichi.jp", 1242 | "handa.aichi.jp", 1243 | "hazu.aichi.jp", 1244 | "hekinan.aichi.jp", 1245 | "higashiura.aichi.jp", 1246 | "ichinomiya.aichi.jp", 1247 | "inazawa.aichi.jp", 1248 | "inuyama.aichi.jp", 1249 | "isshiki.aichi.jp", 1250 | "iwakura.aichi.jp", 1251 | "kanie.aichi.jp", 1252 | "kariya.aichi.jp", 1253 | "kasugai.aichi.jp", 1254 | "kira.aichi.jp", 1255 | "kiyosu.aichi.jp", 1256 | "komaki.aichi.jp", 1257 | "konan.aichi.jp", 1258 | "kota.aichi.jp", 1259 | "mihama.aichi.jp", 1260 | "miyoshi.aichi.jp", 1261 | "nagakute.aichi.jp", 1262 | "nishio.aichi.jp", 1263 | "nisshin.aichi.jp", 1264 | "obu.aichi.jp", 1265 | "oguchi.aichi.jp", 1266 | "oharu.aichi.jp", 1267 | "okazaki.aichi.jp", 1268 | "owariasahi.aichi.jp", 1269 | "seto.aichi.jp", 1270 | "shikatsu.aichi.jp", 1271 | "shinshiro.aichi.jp", 1272 | "shitara.aichi.jp", 1273 | "tahara.aichi.jp", 1274 | "takahama.aichi.jp", 1275 | "tobishima.aichi.jp", 1276 | "toei.aichi.jp", 1277 | "togo.aichi.jp", 1278 | "tokai.aichi.jp", 1279 | "tokoname.aichi.jp", 1280 | "toyoake.aichi.jp", 1281 | "toyohashi.aichi.jp", 1282 | "toyokawa.aichi.jp", 1283 | "toyone.aichi.jp", 1284 | "toyota.aichi.jp", 1285 | "tsushima.aichi.jp", 1286 | "yatomi.aichi.jp", 1287 | "akita.akita.jp", 1288 | "daisen.akita.jp", 1289 | "fujisato.akita.jp", 1290 | "gojome.akita.jp", 1291 | "hachirogata.akita.jp", 1292 | "happou.akita.jp", 1293 | "higashinaruse.akita.jp", 1294 | "honjo.akita.jp", 1295 | "honjyo.akita.jp", 1296 | "ikawa.akita.jp", 1297 | "kamikoani.akita.jp", 1298 | "kamioka.akita.jp", 1299 | "katagami.akita.jp", 1300 | "kazuno.akita.jp", 1301 | "kitaakita.akita.jp", 1302 | "kosaka.akita.jp", 1303 | "kyowa.akita.jp", 1304 | "misato.akita.jp", 1305 | "mitane.akita.jp", 1306 | "moriyoshi.akita.jp", 1307 | "nikaho.akita.jp", 1308 | "noshiro.akita.jp", 1309 | "odate.akita.jp", 1310 | "oga.akita.jp", 1311 | "ogata.akita.jp", 1312 | "semboku.akita.jp", 1313 | "yokote.akita.jp", 1314 | "yurihonjo.akita.jp", 1315 | "aomori.aomori.jp", 1316 | "gonohe.aomori.jp", 1317 | "hachinohe.aomori.jp", 1318 | "hashikami.aomori.jp", 1319 | "hiranai.aomori.jp", 1320 | "hirosaki.aomori.jp", 1321 | "itayanagi.aomori.jp", 1322 | "kuroishi.aomori.jp", 1323 | "misawa.aomori.jp", 1324 | "mutsu.aomori.jp", 1325 | "nakadomari.aomori.jp", 1326 | "noheji.aomori.jp", 1327 | "oirase.aomori.jp", 1328 | "owani.aomori.jp", 1329 | "rokunohe.aomori.jp", 1330 | "sannohe.aomori.jp", 1331 | "shichinohe.aomori.jp", 1332 | "shingo.aomori.jp", 1333 | "takko.aomori.jp", 1334 | "towada.aomori.jp", 1335 | "tsugaru.aomori.jp", 1336 | "tsuruta.aomori.jp", 1337 | "abiko.chiba.jp", 1338 | "asahi.chiba.jp", 1339 | "chonan.chiba.jp", 1340 | "chosei.chiba.jp", 1341 | "choshi.chiba.jp", 1342 | "chuo.chiba.jp", 1343 | "funabashi.chiba.jp", 1344 | "futtsu.chiba.jp", 1345 | "hanamigawa.chiba.jp", 1346 | "ichihara.chiba.jp", 1347 | "ichikawa.chiba.jp", 1348 | "ichinomiya.chiba.jp", 1349 | "inzai.chiba.jp", 1350 | "isumi.chiba.jp", 1351 | "kamagaya.chiba.jp", 1352 | "kamogawa.chiba.jp", 1353 | "kashiwa.chiba.jp", 1354 | "katori.chiba.jp", 1355 | "katsuura.chiba.jp", 1356 | "kimitsu.chiba.jp", 1357 | "kisarazu.chiba.jp", 1358 | "kozaki.chiba.jp", 1359 | "kujukuri.chiba.jp", 1360 | "kyonan.chiba.jp", 1361 | "matsudo.chiba.jp", 1362 | "midori.chiba.jp", 1363 | "mihama.chiba.jp", 1364 | "minamiboso.chiba.jp", 1365 | "mobara.chiba.jp", 1366 | "mutsuzawa.chiba.jp", 1367 | "nagara.chiba.jp", 1368 | "nagareyama.chiba.jp", 1369 | "narashino.chiba.jp", 1370 | "narita.chiba.jp", 1371 | "noda.chiba.jp", 1372 | "oamishirasato.chiba.jp", 1373 | "omigawa.chiba.jp", 1374 | "onjuku.chiba.jp", 1375 | "otaki.chiba.jp", 1376 | "sakae.chiba.jp", 1377 | "sakura.chiba.jp", 1378 | "shimofusa.chiba.jp", 1379 | "shirako.chiba.jp", 1380 | "shiroi.chiba.jp", 1381 | "shisui.chiba.jp", 1382 | "sodegaura.chiba.jp", 1383 | "sosa.chiba.jp", 1384 | "tako.chiba.jp", 1385 | "tateyama.chiba.jp", 1386 | "togane.chiba.jp", 1387 | "tohnosho.chiba.jp", 1388 | "tomisato.chiba.jp", 1389 | "urayasu.chiba.jp", 1390 | "yachimata.chiba.jp", 1391 | "yachiyo.chiba.jp", 1392 | "yokaichiba.chiba.jp", 1393 | "yokoshibahikari.chiba.jp", 1394 | "yotsukaido.chiba.jp", 1395 | "ainan.ehime.jp", 1396 | "honai.ehime.jp", 1397 | "ikata.ehime.jp", 1398 | "imabari.ehime.jp", 1399 | "iyo.ehime.jp", 1400 | "kamijima.ehime.jp", 1401 | "kihoku.ehime.jp", 1402 | "kumakogen.ehime.jp", 1403 | "masaki.ehime.jp", 1404 | "matsuno.ehime.jp", 1405 | "matsuyama.ehime.jp", 1406 | "namikata.ehime.jp", 1407 | "niihama.ehime.jp", 1408 | "ozu.ehime.jp", 1409 | "saijo.ehime.jp", 1410 | "seiyo.ehime.jp", 1411 | "shikokuchuo.ehime.jp", 1412 | "tobe.ehime.jp", 1413 | "toon.ehime.jp", 1414 | "uchiko.ehime.jp", 1415 | "uwajima.ehime.jp", 1416 | "yawatahama.ehime.jp", 1417 | "echizen.fukui.jp", 1418 | "eiheiji.fukui.jp", 1419 | "fukui.fukui.jp", 1420 | "ikeda.fukui.jp", 1421 | "katsuyama.fukui.jp", 1422 | "mihama.fukui.jp", 1423 | "minamiechizen.fukui.jp", 1424 | "obama.fukui.jp", 1425 | "ohi.fukui.jp", 1426 | "ono.fukui.jp", 1427 | "sabae.fukui.jp", 1428 | "sakai.fukui.jp", 1429 | "takahama.fukui.jp", 1430 | "tsuruga.fukui.jp", 1431 | "wakasa.fukui.jp", 1432 | "ashiya.fukuoka.jp", 1433 | "buzen.fukuoka.jp", 1434 | "chikugo.fukuoka.jp", 1435 | "chikuho.fukuoka.jp", 1436 | "chikujo.fukuoka.jp", 1437 | "chikushino.fukuoka.jp", 1438 | "chikuzen.fukuoka.jp", 1439 | "chuo.fukuoka.jp", 1440 | "dazaifu.fukuoka.jp", 1441 | "fukuchi.fukuoka.jp", 1442 | "hakata.fukuoka.jp", 1443 | "higashi.fukuoka.jp", 1444 | "hirokawa.fukuoka.jp", 1445 | "hisayama.fukuoka.jp", 1446 | "iizuka.fukuoka.jp", 1447 | "inatsuki.fukuoka.jp", 1448 | "kaho.fukuoka.jp", 1449 | "kasuga.fukuoka.jp", 1450 | "kasuya.fukuoka.jp", 1451 | "kawara.fukuoka.jp", 1452 | "keisen.fukuoka.jp", 1453 | "koga.fukuoka.jp", 1454 | "kurate.fukuoka.jp", 1455 | "kurogi.fukuoka.jp", 1456 | "kurume.fukuoka.jp", 1457 | "minami.fukuoka.jp", 1458 | "miyako.fukuoka.jp", 1459 | "miyama.fukuoka.jp", 1460 | "miyawaka.fukuoka.jp", 1461 | "mizumaki.fukuoka.jp", 1462 | "munakata.fukuoka.jp", 1463 | "nakagawa.fukuoka.jp", 1464 | "nakama.fukuoka.jp", 1465 | "nishi.fukuoka.jp", 1466 | "nogata.fukuoka.jp", 1467 | "ogori.fukuoka.jp", 1468 | "okagaki.fukuoka.jp", 1469 | "okawa.fukuoka.jp", 1470 | "oki.fukuoka.jp", 1471 | "omuta.fukuoka.jp", 1472 | "onga.fukuoka.jp", 1473 | "onojo.fukuoka.jp", 1474 | "oto.fukuoka.jp", 1475 | "saigawa.fukuoka.jp", 1476 | "sasaguri.fukuoka.jp", 1477 | "shingu.fukuoka.jp", 1478 | "shinyoshitomi.fukuoka.jp", 1479 | "shonai.fukuoka.jp", 1480 | "soeda.fukuoka.jp", 1481 | "sue.fukuoka.jp", 1482 | "tachiarai.fukuoka.jp", 1483 | "tagawa.fukuoka.jp", 1484 | "takata.fukuoka.jp", 1485 | "toho.fukuoka.jp", 1486 | "toyotsu.fukuoka.jp", 1487 | "tsuiki.fukuoka.jp", 1488 | "ukiha.fukuoka.jp", 1489 | "umi.fukuoka.jp", 1490 | "usui.fukuoka.jp", 1491 | "yamada.fukuoka.jp", 1492 | "yame.fukuoka.jp", 1493 | "yanagawa.fukuoka.jp", 1494 | "yukuhashi.fukuoka.jp", 1495 | "aizubange.fukushima.jp", 1496 | "aizumisato.fukushima.jp", 1497 | "aizuwakamatsu.fukushima.jp", 1498 | "asakawa.fukushima.jp", 1499 | "bandai.fukushima.jp", 1500 | "date.fukushima.jp", 1501 | "fukushima.fukushima.jp", 1502 | "furudono.fukushima.jp", 1503 | "futaba.fukushima.jp", 1504 | "hanawa.fukushima.jp", 1505 | "higashi.fukushima.jp", 1506 | "hirata.fukushima.jp", 1507 | "hirono.fukushima.jp", 1508 | "iitate.fukushima.jp", 1509 | "inawashiro.fukushima.jp", 1510 | "ishikawa.fukushima.jp", 1511 | "iwaki.fukushima.jp", 1512 | "izumizaki.fukushima.jp", 1513 | "kagamiishi.fukushima.jp", 1514 | "kaneyama.fukushima.jp", 1515 | "kawamata.fukushima.jp", 1516 | "kitakata.fukushima.jp", 1517 | "kitashiobara.fukushima.jp", 1518 | "koori.fukushima.jp", 1519 | "koriyama.fukushima.jp", 1520 | "kunimi.fukushima.jp", 1521 | "miharu.fukushima.jp", 1522 | "mishima.fukushima.jp", 1523 | "namie.fukushima.jp", 1524 | "nango.fukushima.jp", 1525 | "nishiaizu.fukushima.jp", 1526 | "nishigo.fukushima.jp", 1527 | "okuma.fukushima.jp", 1528 | "omotego.fukushima.jp", 1529 | "ono.fukushima.jp", 1530 | "otama.fukushima.jp", 1531 | "samegawa.fukushima.jp", 1532 | "shimogo.fukushima.jp", 1533 | "shirakawa.fukushima.jp", 1534 | "showa.fukushima.jp", 1535 | "soma.fukushima.jp", 1536 | "sukagawa.fukushima.jp", 1537 | "taishin.fukushima.jp", 1538 | "tamakawa.fukushima.jp", 1539 | "tanagura.fukushima.jp", 1540 | "tenei.fukushima.jp", 1541 | "yabuki.fukushima.jp", 1542 | "yamato.fukushima.jp", 1543 | "yamatsuri.fukushima.jp", 1544 | "yanaizu.fukushima.jp", 1545 | "yugawa.fukushima.jp", 1546 | "anpachi.gifu.jp", 1547 | "ena.gifu.jp", 1548 | "gifu.gifu.jp", 1549 | "ginan.gifu.jp", 1550 | "godo.gifu.jp", 1551 | "gujo.gifu.jp", 1552 | "hashima.gifu.jp", 1553 | "hichiso.gifu.jp", 1554 | "hida.gifu.jp", 1555 | "higashishirakawa.gifu.jp", 1556 | "ibigawa.gifu.jp", 1557 | "ikeda.gifu.jp", 1558 | "kakamigahara.gifu.jp", 1559 | "kani.gifu.jp", 1560 | "kasahara.gifu.jp", 1561 | "kasamatsu.gifu.jp", 1562 | "kawaue.gifu.jp", 1563 | "kitagata.gifu.jp", 1564 | "mino.gifu.jp", 1565 | "minokamo.gifu.jp", 1566 | "mitake.gifu.jp", 1567 | "mizunami.gifu.jp", 1568 | "motosu.gifu.jp", 1569 | "nakatsugawa.gifu.jp", 1570 | "ogaki.gifu.jp", 1571 | "sakahogi.gifu.jp", 1572 | "seki.gifu.jp", 1573 | "sekigahara.gifu.jp", 1574 | "shirakawa.gifu.jp", 1575 | "tajimi.gifu.jp", 1576 | "takayama.gifu.jp", 1577 | "tarui.gifu.jp", 1578 | "toki.gifu.jp", 1579 | "tomika.gifu.jp", 1580 | "wanouchi.gifu.jp", 1581 | "yamagata.gifu.jp", 1582 | "yaotsu.gifu.jp", 1583 | "yoro.gifu.jp", 1584 | "annaka.gunma.jp", 1585 | "chiyoda.gunma.jp", 1586 | "fujioka.gunma.jp", 1587 | "higashiagatsuma.gunma.jp", 1588 | "isesaki.gunma.jp", 1589 | "itakura.gunma.jp", 1590 | "kanna.gunma.jp", 1591 | "kanra.gunma.jp", 1592 | "katashina.gunma.jp", 1593 | "kawaba.gunma.jp", 1594 | "kiryu.gunma.jp", 1595 | "kusatsu.gunma.jp", 1596 | "maebashi.gunma.jp", 1597 | "meiwa.gunma.jp", 1598 | "midori.gunma.jp", 1599 | "minakami.gunma.jp", 1600 | "naganohara.gunma.jp", 1601 | "nakanojo.gunma.jp", 1602 | "nanmoku.gunma.jp", 1603 | "numata.gunma.jp", 1604 | "oizumi.gunma.jp", 1605 | "ora.gunma.jp", 1606 | "ota.gunma.jp", 1607 | "shibukawa.gunma.jp", 1608 | "shimonita.gunma.jp", 1609 | "shinto.gunma.jp", 1610 | "showa.gunma.jp", 1611 | "takasaki.gunma.jp", 1612 | "takayama.gunma.jp", 1613 | "tamamura.gunma.jp", 1614 | "tatebayashi.gunma.jp", 1615 | "tomioka.gunma.jp", 1616 | "tsukiyono.gunma.jp", 1617 | "tsumagoi.gunma.jp", 1618 | "ueno.gunma.jp", 1619 | "yoshioka.gunma.jp", 1620 | "asaminami.hiroshima.jp", 1621 | "daiwa.hiroshima.jp", 1622 | "etajima.hiroshima.jp", 1623 | "fuchu.hiroshima.jp", 1624 | "fukuyama.hiroshima.jp", 1625 | "hatsukaichi.hiroshima.jp", 1626 | "higashihiroshima.hiroshima.jp", 1627 | "hongo.hiroshima.jp", 1628 | "jinsekikogen.hiroshima.jp", 1629 | "kaita.hiroshima.jp", 1630 | "kui.hiroshima.jp", 1631 | "kumano.hiroshima.jp", 1632 | "kure.hiroshima.jp", 1633 | "mihara.hiroshima.jp", 1634 | "miyoshi.hiroshima.jp", 1635 | "naka.hiroshima.jp", 1636 | "onomichi.hiroshima.jp", 1637 | "osakikamijima.hiroshima.jp", 1638 | "otake.hiroshima.jp", 1639 | "saka.hiroshima.jp", 1640 | "sera.hiroshima.jp", 1641 | "seranishi.hiroshima.jp", 1642 | "shinichi.hiroshima.jp", 1643 | "shobara.hiroshima.jp", 1644 | "takehara.hiroshima.jp", 1645 | "abashiri.hokkaido.jp", 1646 | "abira.hokkaido.jp", 1647 | "aibetsu.hokkaido.jp", 1648 | "akabira.hokkaido.jp", 1649 | "akkeshi.hokkaido.jp", 1650 | "asahikawa.hokkaido.jp", 1651 | "ashibetsu.hokkaido.jp", 1652 | "ashoro.hokkaido.jp", 1653 | "assabu.hokkaido.jp", 1654 | "atsuma.hokkaido.jp", 1655 | "bibai.hokkaido.jp", 1656 | "biei.hokkaido.jp", 1657 | "bifuka.hokkaido.jp", 1658 | "bihoro.hokkaido.jp", 1659 | "biratori.hokkaido.jp", 1660 | "chippubetsu.hokkaido.jp", 1661 | "chitose.hokkaido.jp", 1662 | "date.hokkaido.jp", 1663 | "ebetsu.hokkaido.jp", 1664 | "embetsu.hokkaido.jp", 1665 | "eniwa.hokkaido.jp", 1666 | "erimo.hokkaido.jp", 1667 | "esan.hokkaido.jp", 1668 | "esashi.hokkaido.jp", 1669 | "fukagawa.hokkaido.jp", 1670 | "fukushima.hokkaido.jp", 1671 | "furano.hokkaido.jp", 1672 | "furubira.hokkaido.jp", 1673 | "haboro.hokkaido.jp", 1674 | "hakodate.hokkaido.jp", 1675 | "hamatonbetsu.hokkaido.jp", 1676 | "hidaka.hokkaido.jp", 1677 | "higashikagura.hokkaido.jp", 1678 | "higashikawa.hokkaido.jp", 1679 | "hiroo.hokkaido.jp", 1680 | "hokuryu.hokkaido.jp", 1681 | "hokuto.hokkaido.jp", 1682 | "honbetsu.hokkaido.jp", 1683 | "horokanai.hokkaido.jp", 1684 | "horonobe.hokkaido.jp", 1685 | "ikeda.hokkaido.jp", 1686 | "imakane.hokkaido.jp", 1687 | "ishikari.hokkaido.jp", 1688 | "iwamizawa.hokkaido.jp", 1689 | "iwanai.hokkaido.jp", 1690 | "kamifurano.hokkaido.jp", 1691 | "kamikawa.hokkaido.jp", 1692 | "kamishihoro.hokkaido.jp", 1693 | "kamisunagawa.hokkaido.jp", 1694 | "kamoenai.hokkaido.jp", 1695 | "kayabe.hokkaido.jp", 1696 | "kembuchi.hokkaido.jp", 1697 | "kikonai.hokkaido.jp", 1698 | "kimobetsu.hokkaido.jp", 1699 | "kitahiroshima.hokkaido.jp", 1700 | "kitami.hokkaido.jp", 1701 | "kiyosato.hokkaido.jp", 1702 | "koshimizu.hokkaido.jp", 1703 | "kunneppu.hokkaido.jp", 1704 | "kuriyama.hokkaido.jp", 1705 | "kuromatsunai.hokkaido.jp", 1706 | "kushiro.hokkaido.jp", 1707 | "kutchan.hokkaido.jp", 1708 | "kyowa.hokkaido.jp", 1709 | "mashike.hokkaido.jp", 1710 | "matsumae.hokkaido.jp", 1711 | "mikasa.hokkaido.jp", 1712 | "minamifurano.hokkaido.jp", 1713 | "mombetsu.hokkaido.jp", 1714 | "moseushi.hokkaido.jp", 1715 | "mukawa.hokkaido.jp", 1716 | "muroran.hokkaido.jp", 1717 | "naie.hokkaido.jp", 1718 | "nakagawa.hokkaido.jp", 1719 | "nakasatsunai.hokkaido.jp", 1720 | "nakatombetsu.hokkaido.jp", 1721 | "nanae.hokkaido.jp", 1722 | "nanporo.hokkaido.jp", 1723 | "nayoro.hokkaido.jp", 1724 | "nemuro.hokkaido.jp", 1725 | "niikappu.hokkaido.jp", 1726 | "niki.hokkaido.jp", 1727 | "nishiokoppe.hokkaido.jp", 1728 | "noboribetsu.hokkaido.jp", 1729 | "numata.hokkaido.jp", 1730 | "obihiro.hokkaido.jp", 1731 | "obira.hokkaido.jp", 1732 | "oketo.hokkaido.jp", 1733 | "okoppe.hokkaido.jp", 1734 | "otaru.hokkaido.jp", 1735 | "otobe.hokkaido.jp", 1736 | "otofuke.hokkaido.jp", 1737 | "otoineppu.hokkaido.jp", 1738 | "oumu.hokkaido.jp", 1739 | "ozora.hokkaido.jp", 1740 | "pippu.hokkaido.jp", 1741 | "rankoshi.hokkaido.jp", 1742 | "rebun.hokkaido.jp", 1743 | "rikubetsu.hokkaido.jp", 1744 | "rishiri.hokkaido.jp", 1745 | "rishirifuji.hokkaido.jp", 1746 | "saroma.hokkaido.jp", 1747 | "sarufutsu.hokkaido.jp", 1748 | "shakotan.hokkaido.jp", 1749 | "shari.hokkaido.jp", 1750 | "shibecha.hokkaido.jp", 1751 | "shibetsu.hokkaido.jp", 1752 | "shikabe.hokkaido.jp", 1753 | "shikaoi.hokkaido.jp", 1754 | "shimamaki.hokkaido.jp", 1755 | "shimizu.hokkaido.jp", 1756 | "shimokawa.hokkaido.jp", 1757 | "shinshinotsu.hokkaido.jp", 1758 | "shintoku.hokkaido.jp", 1759 | "shiranuka.hokkaido.jp", 1760 | "shiraoi.hokkaido.jp", 1761 | "shiriuchi.hokkaido.jp", 1762 | "sobetsu.hokkaido.jp", 1763 | "sunagawa.hokkaido.jp", 1764 | "taiki.hokkaido.jp", 1765 | "takasu.hokkaido.jp", 1766 | "takikawa.hokkaido.jp", 1767 | "takinoue.hokkaido.jp", 1768 | "teshikaga.hokkaido.jp", 1769 | "tobetsu.hokkaido.jp", 1770 | "tohma.hokkaido.jp", 1771 | "tomakomai.hokkaido.jp", 1772 | "tomari.hokkaido.jp", 1773 | "toya.hokkaido.jp", 1774 | "toyako.hokkaido.jp", 1775 | "toyotomi.hokkaido.jp", 1776 | "toyoura.hokkaido.jp", 1777 | "tsubetsu.hokkaido.jp", 1778 | "tsukigata.hokkaido.jp", 1779 | "urakawa.hokkaido.jp", 1780 | "urausu.hokkaido.jp", 1781 | "uryu.hokkaido.jp", 1782 | "utashinai.hokkaido.jp", 1783 | "wakkanai.hokkaido.jp", 1784 | "wassamu.hokkaido.jp", 1785 | "yakumo.hokkaido.jp", 1786 | "yoichi.hokkaido.jp", 1787 | "aioi.hyogo.jp", 1788 | "akashi.hyogo.jp", 1789 | "ako.hyogo.jp", 1790 | "amagasaki.hyogo.jp", 1791 | "aogaki.hyogo.jp", 1792 | "asago.hyogo.jp", 1793 | "ashiya.hyogo.jp", 1794 | "awaji.hyogo.jp", 1795 | "fukusaki.hyogo.jp", 1796 | "goshiki.hyogo.jp", 1797 | "harima.hyogo.jp", 1798 | "himeji.hyogo.jp", 1799 | "ichikawa.hyogo.jp", 1800 | "inagawa.hyogo.jp", 1801 | "itami.hyogo.jp", 1802 | "kakogawa.hyogo.jp", 1803 | "kamigori.hyogo.jp", 1804 | "kamikawa.hyogo.jp", 1805 | "kasai.hyogo.jp", 1806 | "kasuga.hyogo.jp", 1807 | "kawanishi.hyogo.jp", 1808 | "miki.hyogo.jp", 1809 | "minamiawaji.hyogo.jp", 1810 | "nishinomiya.hyogo.jp", 1811 | "nishiwaki.hyogo.jp", 1812 | "ono.hyogo.jp", 1813 | "sanda.hyogo.jp", 1814 | "sannan.hyogo.jp", 1815 | "sasayama.hyogo.jp", 1816 | "sayo.hyogo.jp", 1817 | "shingu.hyogo.jp", 1818 | "shinonsen.hyogo.jp", 1819 | "shiso.hyogo.jp", 1820 | "sumoto.hyogo.jp", 1821 | "taishi.hyogo.jp", 1822 | "taka.hyogo.jp", 1823 | "takarazuka.hyogo.jp", 1824 | "takasago.hyogo.jp", 1825 | "takino.hyogo.jp", 1826 | "tamba.hyogo.jp", 1827 | "tatsuno.hyogo.jp", 1828 | "toyooka.hyogo.jp", 1829 | "yabu.hyogo.jp", 1830 | "yashiro.hyogo.jp", 1831 | "yoka.hyogo.jp", 1832 | "yokawa.hyogo.jp", 1833 | "ami.ibaraki.jp", 1834 | "asahi.ibaraki.jp", 1835 | "bando.ibaraki.jp", 1836 | "chikusei.ibaraki.jp", 1837 | "daigo.ibaraki.jp", 1838 | "fujishiro.ibaraki.jp", 1839 | "hitachi.ibaraki.jp", 1840 | "hitachinaka.ibaraki.jp", 1841 | "hitachiomiya.ibaraki.jp", 1842 | "hitachiota.ibaraki.jp", 1843 | "ibaraki.ibaraki.jp", 1844 | "ina.ibaraki.jp", 1845 | "inashiki.ibaraki.jp", 1846 | "itako.ibaraki.jp", 1847 | "iwama.ibaraki.jp", 1848 | "joso.ibaraki.jp", 1849 | "kamisu.ibaraki.jp", 1850 | "kasama.ibaraki.jp", 1851 | "kashima.ibaraki.jp", 1852 | "kasumigaura.ibaraki.jp", 1853 | "koga.ibaraki.jp", 1854 | "miho.ibaraki.jp", 1855 | "mito.ibaraki.jp", 1856 | "moriya.ibaraki.jp", 1857 | "naka.ibaraki.jp", 1858 | "namegata.ibaraki.jp", 1859 | "oarai.ibaraki.jp", 1860 | "ogawa.ibaraki.jp", 1861 | "omitama.ibaraki.jp", 1862 | "ryugasaki.ibaraki.jp", 1863 | "sakai.ibaraki.jp", 1864 | "sakuragawa.ibaraki.jp", 1865 | "shimodate.ibaraki.jp", 1866 | "shimotsuma.ibaraki.jp", 1867 | "shirosato.ibaraki.jp", 1868 | "sowa.ibaraki.jp", 1869 | "suifu.ibaraki.jp", 1870 | "takahagi.ibaraki.jp", 1871 | "tamatsukuri.ibaraki.jp", 1872 | "tokai.ibaraki.jp", 1873 | "tomobe.ibaraki.jp", 1874 | "tone.ibaraki.jp", 1875 | "toride.ibaraki.jp", 1876 | "tsuchiura.ibaraki.jp", 1877 | "tsukuba.ibaraki.jp", 1878 | "uchihara.ibaraki.jp", 1879 | "ushiku.ibaraki.jp", 1880 | "yachiyo.ibaraki.jp", 1881 | "yamagata.ibaraki.jp", 1882 | "yawara.ibaraki.jp", 1883 | "yuki.ibaraki.jp", 1884 | "anamizu.ishikawa.jp", 1885 | "hakui.ishikawa.jp", 1886 | "hakusan.ishikawa.jp", 1887 | "kaga.ishikawa.jp", 1888 | "kahoku.ishikawa.jp", 1889 | "kanazawa.ishikawa.jp", 1890 | "kawakita.ishikawa.jp", 1891 | "komatsu.ishikawa.jp", 1892 | "nakanoto.ishikawa.jp", 1893 | "nanao.ishikawa.jp", 1894 | "nomi.ishikawa.jp", 1895 | "nonoichi.ishikawa.jp", 1896 | "noto.ishikawa.jp", 1897 | "shika.ishikawa.jp", 1898 | "suzu.ishikawa.jp", 1899 | "tsubata.ishikawa.jp", 1900 | "tsurugi.ishikawa.jp", 1901 | "uchinada.ishikawa.jp", 1902 | "wajima.ishikawa.jp", 1903 | "fudai.iwate.jp", 1904 | "fujisawa.iwate.jp", 1905 | "hanamaki.iwate.jp", 1906 | "hiraizumi.iwate.jp", 1907 | "hirono.iwate.jp", 1908 | "ichinohe.iwate.jp", 1909 | "ichinoseki.iwate.jp", 1910 | "iwaizumi.iwate.jp", 1911 | "iwate.iwate.jp", 1912 | "joboji.iwate.jp", 1913 | "kamaishi.iwate.jp", 1914 | "kanegasaki.iwate.jp", 1915 | "karumai.iwate.jp", 1916 | "kawai.iwate.jp", 1917 | "kitakami.iwate.jp", 1918 | "kuji.iwate.jp", 1919 | "kunohe.iwate.jp", 1920 | "kuzumaki.iwate.jp", 1921 | "miyako.iwate.jp", 1922 | "mizusawa.iwate.jp", 1923 | "morioka.iwate.jp", 1924 | "ninohe.iwate.jp", 1925 | "noda.iwate.jp", 1926 | "ofunato.iwate.jp", 1927 | "oshu.iwate.jp", 1928 | "otsuchi.iwate.jp", 1929 | "rikuzentakata.iwate.jp", 1930 | "shiwa.iwate.jp", 1931 | "shizukuishi.iwate.jp", 1932 | "sumita.iwate.jp", 1933 | "takizawa.iwate.jp", 1934 | "tanohata.iwate.jp", 1935 | "tono.iwate.jp", 1936 | "yahaba.iwate.jp", 1937 | "yamada.iwate.jp", 1938 | "ayagawa.kagawa.jp", 1939 | "higashikagawa.kagawa.jp", 1940 | "kanonji.kagawa.jp", 1941 | "kotohira.kagawa.jp", 1942 | "manno.kagawa.jp", 1943 | "marugame.kagawa.jp", 1944 | "mitoyo.kagawa.jp", 1945 | "naoshima.kagawa.jp", 1946 | "sanuki.kagawa.jp", 1947 | "tadotsu.kagawa.jp", 1948 | "takamatsu.kagawa.jp", 1949 | "tonosho.kagawa.jp", 1950 | "uchinomi.kagawa.jp", 1951 | "utazu.kagawa.jp", 1952 | "zentsuji.kagawa.jp", 1953 | "akune.kagoshima.jp", 1954 | "amami.kagoshima.jp", 1955 | "hioki.kagoshima.jp", 1956 | "isa.kagoshima.jp", 1957 | "isen.kagoshima.jp", 1958 | "izumi.kagoshima.jp", 1959 | "kagoshima.kagoshima.jp", 1960 | "kanoya.kagoshima.jp", 1961 | "kawanabe.kagoshima.jp", 1962 | "kinko.kagoshima.jp", 1963 | "kouyama.kagoshima.jp", 1964 | "makurazaki.kagoshima.jp", 1965 | "matsumoto.kagoshima.jp", 1966 | "minamitane.kagoshima.jp", 1967 | "nakatane.kagoshima.jp", 1968 | "nishinoomote.kagoshima.jp", 1969 | "satsumasendai.kagoshima.jp", 1970 | "soo.kagoshima.jp", 1971 | "tarumizu.kagoshima.jp", 1972 | "yusui.kagoshima.jp", 1973 | "aikawa.kanagawa.jp", 1974 | "atsugi.kanagawa.jp", 1975 | "ayase.kanagawa.jp", 1976 | "chigasaki.kanagawa.jp", 1977 | "ebina.kanagawa.jp", 1978 | "fujisawa.kanagawa.jp", 1979 | "hadano.kanagawa.jp", 1980 | "hakone.kanagawa.jp", 1981 | "hiratsuka.kanagawa.jp", 1982 | "isehara.kanagawa.jp", 1983 | "kaisei.kanagawa.jp", 1984 | "kamakura.kanagawa.jp", 1985 | "kiyokawa.kanagawa.jp", 1986 | "matsuda.kanagawa.jp", 1987 | "minamiashigara.kanagawa.jp", 1988 | "miura.kanagawa.jp", 1989 | "nakai.kanagawa.jp", 1990 | "ninomiya.kanagawa.jp", 1991 | "odawara.kanagawa.jp", 1992 | "oi.kanagawa.jp", 1993 | "oiso.kanagawa.jp", 1994 | "sagamihara.kanagawa.jp", 1995 | "samukawa.kanagawa.jp", 1996 | "tsukui.kanagawa.jp", 1997 | "yamakita.kanagawa.jp", 1998 | "yamato.kanagawa.jp", 1999 | "yokosuka.kanagawa.jp", 2000 | "yugawara.kanagawa.jp", 2001 | "zama.kanagawa.jp", 2002 | "zushi.kanagawa.jp", 2003 | "aki.kochi.jp", 2004 | "geisei.kochi.jp", 2005 | "hidaka.kochi.jp", 2006 | "higashitsuno.kochi.jp", 2007 | "ino.kochi.jp", 2008 | "kagami.kochi.jp", 2009 | "kami.kochi.jp", 2010 | "kitagawa.kochi.jp", 2011 | "kochi.kochi.jp", 2012 | "mihara.kochi.jp", 2013 | "motoyama.kochi.jp", 2014 | "muroto.kochi.jp", 2015 | "nahari.kochi.jp", 2016 | "nakamura.kochi.jp", 2017 | "nankoku.kochi.jp", 2018 | "nishitosa.kochi.jp", 2019 | "niyodogawa.kochi.jp", 2020 | "ochi.kochi.jp", 2021 | "okawa.kochi.jp", 2022 | "otoyo.kochi.jp", 2023 | "otsuki.kochi.jp", 2024 | "sakawa.kochi.jp", 2025 | "sukumo.kochi.jp", 2026 | "susaki.kochi.jp", 2027 | "tosa.kochi.jp", 2028 | "tosashimizu.kochi.jp", 2029 | "toyo.kochi.jp", 2030 | "tsuno.kochi.jp", 2031 | "umaji.kochi.jp", 2032 | "yasuda.kochi.jp", 2033 | "yusuhara.kochi.jp", 2034 | "amakusa.kumamoto.jp", 2035 | "arao.kumamoto.jp", 2036 | "aso.kumamoto.jp", 2037 | "choyo.kumamoto.jp", 2038 | "gyokuto.kumamoto.jp", 2039 | "hitoyoshi.kumamoto.jp", 2040 | "kamiamakusa.kumamoto.jp", 2041 | "kashima.kumamoto.jp", 2042 | "kikuchi.kumamoto.jp", 2043 | "kosa.kumamoto.jp", 2044 | "kumamoto.kumamoto.jp", 2045 | "mashiki.kumamoto.jp", 2046 | "mifune.kumamoto.jp", 2047 | "minamata.kumamoto.jp", 2048 | "minamioguni.kumamoto.jp", 2049 | "nagasu.kumamoto.jp", 2050 | "nishihara.kumamoto.jp", 2051 | "oguni.kumamoto.jp", 2052 | "ozu.kumamoto.jp", 2053 | "sumoto.kumamoto.jp", 2054 | "takamori.kumamoto.jp", 2055 | "uki.kumamoto.jp", 2056 | "uto.kumamoto.jp", 2057 | "yamaga.kumamoto.jp", 2058 | "yamato.kumamoto.jp", 2059 | "yatsushiro.kumamoto.jp", 2060 | "ayabe.kyoto.jp", 2061 | "fukuchiyama.kyoto.jp", 2062 | "higashiyama.kyoto.jp", 2063 | "ide.kyoto.jp", 2064 | "ine.kyoto.jp", 2065 | "joyo.kyoto.jp", 2066 | "kameoka.kyoto.jp", 2067 | "kamo.kyoto.jp", 2068 | "kita.kyoto.jp", 2069 | "kizu.kyoto.jp", 2070 | "kumiyama.kyoto.jp", 2071 | "kyotamba.kyoto.jp", 2072 | "kyotanabe.kyoto.jp", 2073 | "kyotango.kyoto.jp", 2074 | "maizuru.kyoto.jp", 2075 | "minami.kyoto.jp", 2076 | "minamiyamashiro.kyoto.jp", 2077 | "miyazu.kyoto.jp", 2078 | "muko.kyoto.jp", 2079 | "nagaokakyo.kyoto.jp", 2080 | "nakagyo.kyoto.jp", 2081 | "nantan.kyoto.jp", 2082 | "oyamazaki.kyoto.jp", 2083 | "sakyo.kyoto.jp", 2084 | "seika.kyoto.jp", 2085 | "tanabe.kyoto.jp", 2086 | "uji.kyoto.jp", 2087 | "ujitawara.kyoto.jp", 2088 | "wazuka.kyoto.jp", 2089 | "yamashina.kyoto.jp", 2090 | "yawata.kyoto.jp", 2091 | "asahi.mie.jp", 2092 | "inabe.mie.jp", 2093 | "ise.mie.jp", 2094 | "kameyama.mie.jp", 2095 | "kawagoe.mie.jp", 2096 | "kiho.mie.jp", 2097 | "kisosaki.mie.jp", 2098 | "kiwa.mie.jp", 2099 | "komono.mie.jp", 2100 | "kumano.mie.jp", 2101 | "kuwana.mie.jp", 2102 | "matsusaka.mie.jp", 2103 | "meiwa.mie.jp", 2104 | "mihama.mie.jp", 2105 | "minamiise.mie.jp", 2106 | "misugi.mie.jp", 2107 | "miyama.mie.jp", 2108 | "nabari.mie.jp", 2109 | "shima.mie.jp", 2110 | "suzuka.mie.jp", 2111 | "tado.mie.jp", 2112 | "taiki.mie.jp", 2113 | "taki.mie.jp", 2114 | "tamaki.mie.jp", 2115 | "toba.mie.jp", 2116 | "tsu.mie.jp", 2117 | "udono.mie.jp", 2118 | "ureshino.mie.jp", 2119 | "watarai.mie.jp", 2120 | "yokkaichi.mie.jp", 2121 | "furukawa.miyagi.jp", 2122 | "higashimatsushima.miyagi.jp", 2123 | "ishinomaki.miyagi.jp", 2124 | "iwanuma.miyagi.jp", 2125 | "kakuda.miyagi.jp", 2126 | "kami.miyagi.jp", 2127 | "kawasaki.miyagi.jp", 2128 | "kesennuma.miyagi.jp", 2129 | "marumori.miyagi.jp", 2130 | "matsushima.miyagi.jp", 2131 | "minamisanriku.miyagi.jp", 2132 | "misato.miyagi.jp", 2133 | "murata.miyagi.jp", 2134 | "natori.miyagi.jp", 2135 | "ogawara.miyagi.jp", 2136 | "ohira.miyagi.jp", 2137 | "onagawa.miyagi.jp", 2138 | "osaki.miyagi.jp", 2139 | "rifu.miyagi.jp", 2140 | "semine.miyagi.jp", 2141 | "shibata.miyagi.jp", 2142 | "shichikashuku.miyagi.jp", 2143 | "shikama.miyagi.jp", 2144 | "shiogama.miyagi.jp", 2145 | "shiroishi.miyagi.jp", 2146 | "tagajo.miyagi.jp", 2147 | "taiwa.miyagi.jp", 2148 | "tome.miyagi.jp", 2149 | "tomiya.miyagi.jp", 2150 | "wakuya.miyagi.jp", 2151 | "watari.miyagi.jp", 2152 | "yamamoto.miyagi.jp", 2153 | "zao.miyagi.jp", 2154 | "aya.miyazaki.jp", 2155 | "ebino.miyazaki.jp", 2156 | "gokase.miyazaki.jp", 2157 | "hyuga.miyazaki.jp", 2158 | "kadogawa.miyazaki.jp", 2159 | "kawaminami.miyazaki.jp", 2160 | "kijo.miyazaki.jp", 2161 | "kitagawa.miyazaki.jp", 2162 | "kitakata.miyazaki.jp", 2163 | "kitaura.miyazaki.jp", 2164 | "kobayashi.miyazaki.jp", 2165 | "kunitomi.miyazaki.jp", 2166 | "kushima.miyazaki.jp", 2167 | "mimata.miyazaki.jp", 2168 | "miyakonojo.miyazaki.jp", 2169 | "miyazaki.miyazaki.jp", 2170 | "morotsuka.miyazaki.jp", 2171 | "nichinan.miyazaki.jp", 2172 | "nishimera.miyazaki.jp", 2173 | "nobeoka.miyazaki.jp", 2174 | "saito.miyazaki.jp", 2175 | "shiiba.miyazaki.jp", 2176 | "shintomi.miyazaki.jp", 2177 | "takaharu.miyazaki.jp", 2178 | "takanabe.miyazaki.jp", 2179 | "takazaki.miyazaki.jp", 2180 | "tsuno.miyazaki.jp", 2181 | "achi.nagano.jp", 2182 | "agematsu.nagano.jp", 2183 | "anan.nagano.jp", 2184 | "aoki.nagano.jp", 2185 | "asahi.nagano.jp", 2186 | "azumino.nagano.jp", 2187 | "chikuhoku.nagano.jp", 2188 | "chikuma.nagano.jp", 2189 | "chino.nagano.jp", 2190 | "fujimi.nagano.jp", 2191 | "hakuba.nagano.jp", 2192 | "hara.nagano.jp", 2193 | "hiraya.nagano.jp", 2194 | "iida.nagano.jp", 2195 | "iijima.nagano.jp", 2196 | "iiyama.nagano.jp", 2197 | "iizuna.nagano.jp", 2198 | "ikeda.nagano.jp", 2199 | "ikusaka.nagano.jp", 2200 | "ina.nagano.jp", 2201 | "karuizawa.nagano.jp", 2202 | "kawakami.nagano.jp", 2203 | "kiso.nagano.jp", 2204 | "kisofukushima.nagano.jp", 2205 | "kitaaiki.nagano.jp", 2206 | "komagane.nagano.jp", 2207 | "komoro.nagano.jp", 2208 | "matsukawa.nagano.jp", 2209 | "matsumoto.nagano.jp", 2210 | "miasa.nagano.jp", 2211 | "minamiaiki.nagano.jp", 2212 | "minamimaki.nagano.jp", 2213 | "minamiminowa.nagano.jp", 2214 | "minowa.nagano.jp", 2215 | "miyada.nagano.jp", 2216 | "miyota.nagano.jp", 2217 | "mochizuki.nagano.jp", 2218 | "nagano.nagano.jp", 2219 | "nagawa.nagano.jp", 2220 | "nagiso.nagano.jp", 2221 | "nakagawa.nagano.jp", 2222 | "nakano.nagano.jp", 2223 | "nozawaonsen.nagano.jp", 2224 | "obuse.nagano.jp", 2225 | "ogawa.nagano.jp", 2226 | "okaya.nagano.jp", 2227 | "omachi.nagano.jp", 2228 | "omi.nagano.jp", 2229 | "ookuwa.nagano.jp", 2230 | "ooshika.nagano.jp", 2231 | "otaki.nagano.jp", 2232 | "otari.nagano.jp", 2233 | "sakae.nagano.jp", 2234 | "sakaki.nagano.jp", 2235 | "saku.nagano.jp", 2236 | "sakuho.nagano.jp", 2237 | "shimosuwa.nagano.jp", 2238 | "shinanomachi.nagano.jp", 2239 | "shiojiri.nagano.jp", 2240 | "suwa.nagano.jp", 2241 | "suzaka.nagano.jp", 2242 | "takagi.nagano.jp", 2243 | "takamori.nagano.jp", 2244 | "takayama.nagano.jp", 2245 | "tateshina.nagano.jp", 2246 | "tatsuno.nagano.jp", 2247 | "togakushi.nagano.jp", 2248 | "togura.nagano.jp", 2249 | "tomi.nagano.jp", 2250 | "ueda.nagano.jp", 2251 | "wada.nagano.jp", 2252 | "yamagata.nagano.jp", 2253 | "yamanouchi.nagano.jp", 2254 | "yasaka.nagano.jp", 2255 | "yasuoka.nagano.jp", 2256 | "chijiwa.nagasaki.jp", 2257 | "futsu.nagasaki.jp", 2258 | "goto.nagasaki.jp", 2259 | "hasami.nagasaki.jp", 2260 | "hirado.nagasaki.jp", 2261 | "iki.nagasaki.jp", 2262 | "isahaya.nagasaki.jp", 2263 | "kawatana.nagasaki.jp", 2264 | "kuchinotsu.nagasaki.jp", 2265 | "matsuura.nagasaki.jp", 2266 | "nagasaki.nagasaki.jp", 2267 | "obama.nagasaki.jp", 2268 | "omura.nagasaki.jp", 2269 | "oseto.nagasaki.jp", 2270 | "saikai.nagasaki.jp", 2271 | "sasebo.nagasaki.jp", 2272 | "seihi.nagasaki.jp", 2273 | "shimabara.nagasaki.jp", 2274 | "shinkamigoto.nagasaki.jp", 2275 | "togitsu.nagasaki.jp", 2276 | "tsushima.nagasaki.jp", 2277 | "unzen.nagasaki.jp", 2278 | "ando.nara.jp", 2279 | "gose.nara.jp", 2280 | "heguri.nara.jp", 2281 | "higashiyoshino.nara.jp", 2282 | "ikaruga.nara.jp", 2283 | "ikoma.nara.jp", 2284 | "kamikitayama.nara.jp", 2285 | "kanmaki.nara.jp", 2286 | "kashiba.nara.jp", 2287 | "kashihara.nara.jp", 2288 | "katsuragi.nara.jp", 2289 | "kawai.nara.jp", 2290 | "kawakami.nara.jp", 2291 | "kawanishi.nara.jp", 2292 | "koryo.nara.jp", 2293 | "kurotaki.nara.jp", 2294 | "mitsue.nara.jp", 2295 | "miyake.nara.jp", 2296 | "nara.nara.jp", 2297 | "nosegawa.nara.jp", 2298 | "oji.nara.jp", 2299 | "ouda.nara.jp", 2300 | "oyodo.nara.jp", 2301 | "sakurai.nara.jp", 2302 | "sango.nara.jp", 2303 | "shimoichi.nara.jp", 2304 | "shimokitayama.nara.jp", 2305 | "shinjo.nara.jp", 2306 | "soni.nara.jp", 2307 | "takatori.nara.jp", 2308 | "tawaramoto.nara.jp", 2309 | "tenkawa.nara.jp", 2310 | "tenri.nara.jp", 2311 | "uda.nara.jp", 2312 | "yamatokoriyama.nara.jp", 2313 | "yamatotakada.nara.jp", 2314 | "yamazoe.nara.jp", 2315 | "yoshino.nara.jp", 2316 | "aga.niigata.jp", 2317 | "agano.niigata.jp", 2318 | "gosen.niigata.jp", 2319 | "itoigawa.niigata.jp", 2320 | "izumozaki.niigata.jp", 2321 | "joetsu.niigata.jp", 2322 | "kamo.niigata.jp", 2323 | "kariwa.niigata.jp", 2324 | "kashiwazaki.niigata.jp", 2325 | "minamiuonuma.niigata.jp", 2326 | "mitsuke.niigata.jp", 2327 | "muika.niigata.jp", 2328 | "murakami.niigata.jp", 2329 | "myoko.niigata.jp", 2330 | "nagaoka.niigata.jp", 2331 | "niigata.niigata.jp", 2332 | "ojiya.niigata.jp", 2333 | "omi.niigata.jp", 2334 | "sado.niigata.jp", 2335 | "sanjo.niigata.jp", 2336 | "seiro.niigata.jp", 2337 | "seirou.niigata.jp", 2338 | "sekikawa.niigata.jp", 2339 | "shibata.niigata.jp", 2340 | "tagami.niigata.jp", 2341 | "tainai.niigata.jp", 2342 | "tochio.niigata.jp", 2343 | "tokamachi.niigata.jp", 2344 | "tsubame.niigata.jp", 2345 | "tsunan.niigata.jp", 2346 | "uonuma.niigata.jp", 2347 | "yahiko.niigata.jp", 2348 | "yoita.niigata.jp", 2349 | "yuzawa.niigata.jp", 2350 | "beppu.oita.jp", 2351 | "bungoono.oita.jp", 2352 | "bungotakada.oita.jp", 2353 | "hasama.oita.jp", 2354 | "hiji.oita.jp", 2355 | "himeshima.oita.jp", 2356 | "hita.oita.jp", 2357 | "kamitsue.oita.jp", 2358 | "kokonoe.oita.jp", 2359 | "kuju.oita.jp", 2360 | "kunisaki.oita.jp", 2361 | "kusu.oita.jp", 2362 | "oita.oita.jp", 2363 | "saiki.oita.jp", 2364 | "taketa.oita.jp", 2365 | "tsukumi.oita.jp", 2366 | "usa.oita.jp", 2367 | "usuki.oita.jp", 2368 | "yufu.oita.jp", 2369 | "akaiwa.okayama.jp", 2370 | "asakuchi.okayama.jp", 2371 | "bizen.okayama.jp", 2372 | "hayashima.okayama.jp", 2373 | "ibara.okayama.jp", 2374 | "kagamino.okayama.jp", 2375 | "kasaoka.okayama.jp", 2376 | "kibichuo.okayama.jp", 2377 | "kumenan.okayama.jp", 2378 | "kurashiki.okayama.jp", 2379 | "maniwa.okayama.jp", 2380 | "misaki.okayama.jp", 2381 | "nagi.okayama.jp", 2382 | "niimi.okayama.jp", 2383 | "nishiawakura.okayama.jp", 2384 | "okayama.okayama.jp", 2385 | "satosho.okayama.jp", 2386 | "setouchi.okayama.jp", 2387 | "shinjo.okayama.jp", 2388 | "shoo.okayama.jp", 2389 | "soja.okayama.jp", 2390 | "takahashi.okayama.jp", 2391 | "tamano.okayama.jp", 2392 | "tsuyama.okayama.jp", 2393 | "wake.okayama.jp", 2394 | "yakage.okayama.jp", 2395 | "aguni.okinawa.jp", 2396 | "ginowan.okinawa.jp", 2397 | "ginoza.okinawa.jp", 2398 | "gushikami.okinawa.jp", 2399 | "haebaru.okinawa.jp", 2400 | "higashi.okinawa.jp", 2401 | "hirara.okinawa.jp", 2402 | "iheya.okinawa.jp", 2403 | "ishigaki.okinawa.jp", 2404 | "ishikawa.okinawa.jp", 2405 | "itoman.okinawa.jp", 2406 | "izena.okinawa.jp", 2407 | "kadena.okinawa.jp", 2408 | "kin.okinawa.jp", 2409 | "kitadaito.okinawa.jp", 2410 | "kitanakagusuku.okinawa.jp", 2411 | "kumejima.okinawa.jp", 2412 | "kunigami.okinawa.jp", 2413 | "minamidaito.okinawa.jp", 2414 | "motobu.okinawa.jp", 2415 | "nago.okinawa.jp", 2416 | "naha.okinawa.jp", 2417 | "nakagusuku.okinawa.jp", 2418 | "nakijin.okinawa.jp", 2419 | "nanjo.okinawa.jp", 2420 | "nishihara.okinawa.jp", 2421 | "ogimi.okinawa.jp", 2422 | "okinawa.okinawa.jp", 2423 | "onna.okinawa.jp", 2424 | "shimoji.okinawa.jp", 2425 | "taketomi.okinawa.jp", 2426 | "tarama.okinawa.jp", 2427 | "tokashiki.okinawa.jp", 2428 | "tomigusuku.okinawa.jp", 2429 | "tonaki.okinawa.jp", 2430 | "urasoe.okinawa.jp", 2431 | "uruma.okinawa.jp", 2432 | "yaese.okinawa.jp", 2433 | "yomitan.okinawa.jp", 2434 | "yonabaru.okinawa.jp", 2435 | "yonaguni.okinawa.jp", 2436 | "zamami.okinawa.jp", 2437 | "abeno.osaka.jp", 2438 | "chihayaakasaka.osaka.jp", 2439 | "chuo.osaka.jp", 2440 | "daito.osaka.jp", 2441 | "fujiidera.osaka.jp", 2442 | "habikino.osaka.jp", 2443 | "hannan.osaka.jp", 2444 | "higashiosaka.osaka.jp", 2445 | "higashisumiyoshi.osaka.jp", 2446 | "higashiyodogawa.osaka.jp", 2447 | "hirakata.osaka.jp", 2448 | "ibaraki.osaka.jp", 2449 | "ikeda.osaka.jp", 2450 | "izumi.osaka.jp", 2451 | "izumiotsu.osaka.jp", 2452 | "izumisano.osaka.jp", 2453 | "kadoma.osaka.jp", 2454 | "kaizuka.osaka.jp", 2455 | "kanan.osaka.jp", 2456 | "kashiwara.osaka.jp", 2457 | "katano.osaka.jp", 2458 | "kawachinagano.osaka.jp", 2459 | "kishiwada.osaka.jp", 2460 | "kita.osaka.jp", 2461 | "kumatori.osaka.jp", 2462 | "matsubara.osaka.jp", 2463 | "minato.osaka.jp", 2464 | "minoh.osaka.jp", 2465 | "misaki.osaka.jp", 2466 | "moriguchi.osaka.jp", 2467 | "neyagawa.osaka.jp", 2468 | "nishi.osaka.jp", 2469 | "nose.osaka.jp", 2470 | "osakasayama.osaka.jp", 2471 | "sakai.osaka.jp", 2472 | "sayama.osaka.jp", 2473 | "sennan.osaka.jp", 2474 | "settsu.osaka.jp", 2475 | "shijonawate.osaka.jp", 2476 | "shimamoto.osaka.jp", 2477 | "suita.osaka.jp", 2478 | "tadaoka.osaka.jp", 2479 | "taishi.osaka.jp", 2480 | "tajiri.osaka.jp", 2481 | "takaishi.osaka.jp", 2482 | "takatsuki.osaka.jp", 2483 | "tondabayashi.osaka.jp", 2484 | "toyonaka.osaka.jp", 2485 | "toyono.osaka.jp", 2486 | "yao.osaka.jp", 2487 | "ariake.saga.jp", 2488 | "arita.saga.jp", 2489 | "fukudomi.saga.jp", 2490 | "genkai.saga.jp", 2491 | "hamatama.saga.jp", 2492 | "hizen.saga.jp", 2493 | "imari.saga.jp", 2494 | "kamimine.saga.jp", 2495 | "kanzaki.saga.jp", 2496 | "karatsu.saga.jp", 2497 | "kashima.saga.jp", 2498 | "kitagata.saga.jp", 2499 | "kitahata.saga.jp", 2500 | "kiyama.saga.jp", 2501 | "kouhoku.saga.jp", 2502 | "kyuragi.saga.jp", 2503 | "nishiarita.saga.jp", 2504 | "ogi.saga.jp", 2505 | "omachi.saga.jp", 2506 | "ouchi.saga.jp", 2507 | "saga.saga.jp", 2508 | "shiroishi.saga.jp", 2509 | "taku.saga.jp", 2510 | "tara.saga.jp", 2511 | "tosu.saga.jp", 2512 | "yoshinogari.saga.jp", 2513 | "arakawa.saitama.jp", 2514 | "asaka.saitama.jp", 2515 | "chichibu.saitama.jp", 2516 | "fujimi.saitama.jp", 2517 | "fujimino.saitama.jp", 2518 | "fukaya.saitama.jp", 2519 | "hanno.saitama.jp", 2520 | "hanyu.saitama.jp", 2521 | "hasuda.saitama.jp", 2522 | "hatogaya.saitama.jp", 2523 | "hatoyama.saitama.jp", 2524 | "hidaka.saitama.jp", 2525 | "higashichichibu.saitama.jp", 2526 | "higashimatsuyama.saitama.jp", 2527 | "honjo.saitama.jp", 2528 | "ina.saitama.jp", 2529 | "iruma.saitama.jp", 2530 | "iwatsuki.saitama.jp", 2531 | "kamiizumi.saitama.jp", 2532 | "kamikawa.saitama.jp", 2533 | "kamisato.saitama.jp", 2534 | "kasukabe.saitama.jp", 2535 | "kawagoe.saitama.jp", 2536 | "kawaguchi.saitama.jp", 2537 | "kawajima.saitama.jp", 2538 | "kazo.saitama.jp", 2539 | "kitamoto.saitama.jp", 2540 | "koshigaya.saitama.jp", 2541 | "kounosu.saitama.jp", 2542 | "kuki.saitama.jp", 2543 | "kumagaya.saitama.jp", 2544 | "matsubushi.saitama.jp", 2545 | "minano.saitama.jp", 2546 | "misato.saitama.jp", 2547 | "miyashiro.saitama.jp", 2548 | "miyoshi.saitama.jp", 2549 | "moroyama.saitama.jp", 2550 | "nagatoro.saitama.jp", 2551 | "namegawa.saitama.jp", 2552 | "niiza.saitama.jp", 2553 | "ogano.saitama.jp", 2554 | "ogawa.saitama.jp", 2555 | "ogose.saitama.jp", 2556 | "okegawa.saitama.jp", 2557 | "omiya.saitama.jp", 2558 | "otaki.saitama.jp", 2559 | "ranzan.saitama.jp", 2560 | "ryokami.saitama.jp", 2561 | "saitama.saitama.jp", 2562 | "sakado.saitama.jp", 2563 | "satte.saitama.jp", 2564 | "sayama.saitama.jp", 2565 | "shiki.saitama.jp", 2566 | "shiraoka.saitama.jp", 2567 | "soka.saitama.jp", 2568 | "sugito.saitama.jp", 2569 | "toda.saitama.jp", 2570 | "tokigawa.saitama.jp", 2571 | "tokorozawa.saitama.jp", 2572 | "tsurugashima.saitama.jp", 2573 | "urawa.saitama.jp", 2574 | "warabi.saitama.jp", 2575 | "yashio.saitama.jp", 2576 | "yokoze.saitama.jp", 2577 | "yono.saitama.jp", 2578 | "yorii.saitama.jp", 2579 | "yoshida.saitama.jp", 2580 | "yoshikawa.saitama.jp", 2581 | "yoshimi.saitama.jp", 2582 | "aisho.shiga.jp", 2583 | "gamo.shiga.jp", 2584 | "higashiomi.shiga.jp", 2585 | "hikone.shiga.jp", 2586 | "koka.shiga.jp", 2587 | "konan.shiga.jp", 2588 | "kosei.shiga.jp", 2589 | "koto.shiga.jp", 2590 | "kusatsu.shiga.jp", 2591 | "maibara.shiga.jp", 2592 | "moriyama.shiga.jp", 2593 | "nagahama.shiga.jp", 2594 | "nishiazai.shiga.jp", 2595 | "notogawa.shiga.jp", 2596 | "omihachiman.shiga.jp", 2597 | "otsu.shiga.jp", 2598 | "ritto.shiga.jp", 2599 | "ryuoh.shiga.jp", 2600 | "takashima.shiga.jp", 2601 | "takatsuki.shiga.jp", 2602 | "torahime.shiga.jp", 2603 | "toyosato.shiga.jp", 2604 | "yasu.shiga.jp", 2605 | "akagi.shimane.jp", 2606 | "ama.shimane.jp", 2607 | "gotsu.shimane.jp", 2608 | "hamada.shimane.jp", 2609 | "higashiizumo.shimane.jp", 2610 | "hikawa.shimane.jp", 2611 | "hikimi.shimane.jp", 2612 | "izumo.shimane.jp", 2613 | "kakinoki.shimane.jp", 2614 | "masuda.shimane.jp", 2615 | "matsue.shimane.jp", 2616 | "misato.shimane.jp", 2617 | "nishinoshima.shimane.jp", 2618 | "ohda.shimane.jp", 2619 | "okinoshima.shimane.jp", 2620 | "okuizumo.shimane.jp", 2621 | "shimane.shimane.jp", 2622 | "tamayu.shimane.jp", 2623 | "tsuwano.shimane.jp", 2624 | "unnan.shimane.jp", 2625 | "yakumo.shimane.jp", 2626 | "yasugi.shimane.jp", 2627 | "yatsuka.shimane.jp", 2628 | "arai.shizuoka.jp", 2629 | "atami.shizuoka.jp", 2630 | "fuji.shizuoka.jp", 2631 | "fujieda.shizuoka.jp", 2632 | "fujikawa.shizuoka.jp", 2633 | "fujinomiya.shizuoka.jp", 2634 | "fukuroi.shizuoka.jp", 2635 | "gotemba.shizuoka.jp", 2636 | "haibara.shizuoka.jp", 2637 | "hamamatsu.shizuoka.jp", 2638 | "higashiizu.shizuoka.jp", 2639 | "ito.shizuoka.jp", 2640 | "iwata.shizuoka.jp", 2641 | "izu.shizuoka.jp", 2642 | "izunokuni.shizuoka.jp", 2643 | "kakegawa.shizuoka.jp", 2644 | "kannami.shizuoka.jp", 2645 | "kawanehon.shizuoka.jp", 2646 | "kawazu.shizuoka.jp", 2647 | "kikugawa.shizuoka.jp", 2648 | "kosai.shizuoka.jp", 2649 | "makinohara.shizuoka.jp", 2650 | "matsuzaki.shizuoka.jp", 2651 | "minamiizu.shizuoka.jp", 2652 | "mishima.shizuoka.jp", 2653 | "morimachi.shizuoka.jp", 2654 | "nishiizu.shizuoka.jp", 2655 | "numazu.shizuoka.jp", 2656 | "omaezaki.shizuoka.jp", 2657 | "shimada.shizuoka.jp", 2658 | "shimizu.shizuoka.jp", 2659 | "shimoda.shizuoka.jp", 2660 | "shizuoka.shizuoka.jp", 2661 | "susono.shizuoka.jp", 2662 | "yaizu.shizuoka.jp", 2663 | "yoshida.shizuoka.jp", 2664 | "ashikaga.tochigi.jp", 2665 | "bato.tochigi.jp", 2666 | "haga.tochigi.jp", 2667 | "ichikai.tochigi.jp", 2668 | "iwafune.tochigi.jp", 2669 | "kaminokawa.tochigi.jp", 2670 | "kanuma.tochigi.jp", 2671 | "karasuyama.tochigi.jp", 2672 | "kuroiso.tochigi.jp", 2673 | "mashiko.tochigi.jp", 2674 | "mibu.tochigi.jp", 2675 | "moka.tochigi.jp", 2676 | "motegi.tochigi.jp", 2677 | "nasu.tochigi.jp", 2678 | "nasushiobara.tochigi.jp", 2679 | "nikko.tochigi.jp", 2680 | "nishikata.tochigi.jp", 2681 | "nogi.tochigi.jp", 2682 | "ohira.tochigi.jp", 2683 | "ohtawara.tochigi.jp", 2684 | "oyama.tochigi.jp", 2685 | "sakura.tochigi.jp", 2686 | "sano.tochigi.jp", 2687 | "shimotsuke.tochigi.jp", 2688 | "shioya.tochigi.jp", 2689 | "takanezawa.tochigi.jp", 2690 | "tochigi.tochigi.jp", 2691 | "tsuga.tochigi.jp", 2692 | "ujiie.tochigi.jp", 2693 | "utsunomiya.tochigi.jp", 2694 | "yaita.tochigi.jp", 2695 | "aizumi.tokushima.jp", 2696 | "anan.tokushima.jp", 2697 | "ichiba.tokushima.jp", 2698 | "itano.tokushima.jp", 2699 | "kainan.tokushima.jp", 2700 | "komatsushima.tokushima.jp", 2701 | "matsushige.tokushima.jp", 2702 | "mima.tokushima.jp", 2703 | "minami.tokushima.jp", 2704 | "miyoshi.tokushima.jp", 2705 | "mugi.tokushima.jp", 2706 | "nakagawa.tokushima.jp", 2707 | "naruto.tokushima.jp", 2708 | "sanagochi.tokushima.jp", 2709 | "shishikui.tokushima.jp", 2710 | "tokushima.tokushima.jp", 2711 | "wajiki.tokushima.jp", 2712 | "adachi.tokyo.jp", 2713 | "akiruno.tokyo.jp", 2714 | "akishima.tokyo.jp", 2715 | "aogashima.tokyo.jp", 2716 | "arakawa.tokyo.jp", 2717 | "bunkyo.tokyo.jp", 2718 | "chiyoda.tokyo.jp", 2719 | "chofu.tokyo.jp", 2720 | "chuo.tokyo.jp", 2721 | "edogawa.tokyo.jp", 2722 | "fuchu.tokyo.jp", 2723 | "fussa.tokyo.jp", 2724 | "hachijo.tokyo.jp", 2725 | "hachioji.tokyo.jp", 2726 | "hamura.tokyo.jp", 2727 | "higashikurume.tokyo.jp", 2728 | "higashimurayama.tokyo.jp", 2729 | "higashiyamato.tokyo.jp", 2730 | "hino.tokyo.jp", 2731 | "hinode.tokyo.jp", 2732 | "hinohara.tokyo.jp", 2733 | "inagi.tokyo.jp", 2734 | "itabashi.tokyo.jp", 2735 | "katsushika.tokyo.jp", 2736 | "kita.tokyo.jp", 2737 | "kiyose.tokyo.jp", 2738 | "kodaira.tokyo.jp", 2739 | "koganei.tokyo.jp", 2740 | "kokubunji.tokyo.jp", 2741 | "komae.tokyo.jp", 2742 | "koto.tokyo.jp", 2743 | "kouzushima.tokyo.jp", 2744 | "kunitachi.tokyo.jp", 2745 | "machida.tokyo.jp", 2746 | "meguro.tokyo.jp", 2747 | "minato.tokyo.jp", 2748 | "mitaka.tokyo.jp", 2749 | "mizuho.tokyo.jp", 2750 | "musashimurayama.tokyo.jp", 2751 | "musashino.tokyo.jp", 2752 | "nakano.tokyo.jp", 2753 | "nerima.tokyo.jp", 2754 | "ogasawara.tokyo.jp", 2755 | "okutama.tokyo.jp", 2756 | "ome.tokyo.jp", 2757 | "oshima.tokyo.jp", 2758 | "ota.tokyo.jp", 2759 | "setagaya.tokyo.jp", 2760 | "shibuya.tokyo.jp", 2761 | "shinagawa.tokyo.jp", 2762 | "shinjuku.tokyo.jp", 2763 | "suginami.tokyo.jp", 2764 | "sumida.tokyo.jp", 2765 | "tachikawa.tokyo.jp", 2766 | "taito.tokyo.jp", 2767 | "tama.tokyo.jp", 2768 | "toshima.tokyo.jp", 2769 | "chizu.tottori.jp", 2770 | "hino.tottori.jp", 2771 | "kawahara.tottori.jp", 2772 | "koge.tottori.jp", 2773 | "kotoura.tottori.jp", 2774 | "misasa.tottori.jp", 2775 | "nanbu.tottori.jp", 2776 | "nichinan.tottori.jp", 2777 | "sakaiminato.tottori.jp", 2778 | "tottori.tottori.jp", 2779 | "wakasa.tottori.jp", 2780 | "yazu.tottori.jp", 2781 | "yonago.tottori.jp", 2782 | "asahi.toyama.jp", 2783 | "fuchu.toyama.jp", 2784 | "fukumitsu.toyama.jp", 2785 | "funahashi.toyama.jp", 2786 | "himi.toyama.jp", 2787 | "imizu.toyama.jp", 2788 | "inami.toyama.jp", 2789 | "johana.toyama.jp", 2790 | "kamiichi.toyama.jp", 2791 | "kurobe.toyama.jp", 2792 | "nakaniikawa.toyama.jp", 2793 | "namerikawa.toyama.jp", 2794 | "nanto.toyama.jp", 2795 | "nyuzen.toyama.jp", 2796 | "oyabe.toyama.jp", 2797 | "taira.toyama.jp", 2798 | "takaoka.toyama.jp", 2799 | "tateyama.toyama.jp", 2800 | "toga.toyama.jp", 2801 | "tonami.toyama.jp", 2802 | "toyama.toyama.jp", 2803 | "unazuki.toyama.jp", 2804 | "uozu.toyama.jp", 2805 | "yamada.toyama.jp", 2806 | "arida.wakayama.jp", 2807 | "aridagawa.wakayama.jp", 2808 | "gobo.wakayama.jp", 2809 | "hashimoto.wakayama.jp", 2810 | "hidaka.wakayama.jp", 2811 | "hirogawa.wakayama.jp", 2812 | "inami.wakayama.jp", 2813 | "iwade.wakayama.jp", 2814 | "kainan.wakayama.jp", 2815 | "kamitonda.wakayama.jp", 2816 | "katsuragi.wakayama.jp", 2817 | "kimino.wakayama.jp", 2818 | "kinokawa.wakayama.jp", 2819 | "kitayama.wakayama.jp", 2820 | "koya.wakayama.jp", 2821 | "koza.wakayama.jp", 2822 | "kozagawa.wakayama.jp", 2823 | "kudoyama.wakayama.jp", 2824 | "kushimoto.wakayama.jp", 2825 | "mihama.wakayama.jp", 2826 | "misato.wakayama.jp", 2827 | "nachikatsuura.wakayama.jp", 2828 | "shingu.wakayama.jp", 2829 | "shirahama.wakayama.jp", 2830 | "taiji.wakayama.jp", 2831 | "tanabe.wakayama.jp", 2832 | "wakayama.wakayama.jp", 2833 | "yuasa.wakayama.jp", 2834 | "yura.wakayama.jp", 2835 | "asahi.yamagata.jp", 2836 | "funagata.yamagata.jp", 2837 | "higashine.yamagata.jp", 2838 | "iide.yamagata.jp", 2839 | "kahoku.yamagata.jp", 2840 | "kaminoyama.yamagata.jp", 2841 | "kaneyama.yamagata.jp", 2842 | "kawanishi.yamagata.jp", 2843 | "mamurogawa.yamagata.jp", 2844 | "mikawa.yamagata.jp", 2845 | "murayama.yamagata.jp", 2846 | "nagai.yamagata.jp", 2847 | "nakayama.yamagata.jp", 2848 | "nanyo.yamagata.jp", 2849 | "nishikawa.yamagata.jp", 2850 | "obanazawa.yamagata.jp", 2851 | "oe.yamagata.jp", 2852 | "oguni.yamagata.jp", 2853 | "ohkura.yamagata.jp", 2854 | "oishida.yamagata.jp", 2855 | "sagae.yamagata.jp", 2856 | "sakata.yamagata.jp", 2857 | "sakegawa.yamagata.jp", 2858 | "shinjo.yamagata.jp", 2859 | "shirataka.yamagata.jp", 2860 | "shonai.yamagata.jp", 2861 | "takahata.yamagata.jp", 2862 | "tendo.yamagata.jp", 2863 | "tozawa.yamagata.jp", 2864 | "tsuruoka.yamagata.jp", 2865 | "yamagata.yamagata.jp", 2866 | "yamanobe.yamagata.jp", 2867 | "yonezawa.yamagata.jp", 2868 | "yuza.yamagata.jp", 2869 | "abu.yamaguchi.jp", 2870 | "hagi.yamaguchi.jp", 2871 | "hikari.yamaguchi.jp", 2872 | "hofu.yamaguchi.jp", 2873 | "iwakuni.yamaguchi.jp", 2874 | "kudamatsu.yamaguchi.jp", 2875 | "mitou.yamaguchi.jp", 2876 | "nagato.yamaguchi.jp", 2877 | "oshima.yamaguchi.jp", 2878 | "shimonoseki.yamaguchi.jp", 2879 | "shunan.yamaguchi.jp", 2880 | "tabuse.yamaguchi.jp", 2881 | "tokuyama.yamaguchi.jp", 2882 | "toyota.yamaguchi.jp", 2883 | "ube.yamaguchi.jp", 2884 | "yuu.yamaguchi.jp", 2885 | "chuo.yamanashi.jp", 2886 | "doshi.yamanashi.jp", 2887 | "fuefuki.yamanashi.jp", 2888 | "fujikawa.yamanashi.jp", 2889 | "fujikawaguchiko.yamanashi.jp", 2890 | "fujiyoshida.yamanashi.jp", 2891 | "hayakawa.yamanashi.jp", 2892 | "hokuto.yamanashi.jp", 2893 | "ichikawamisato.yamanashi.jp", 2894 | "kai.yamanashi.jp", 2895 | "kofu.yamanashi.jp", 2896 | "koshu.yamanashi.jp", 2897 | "kosuge.yamanashi.jp", 2898 | "minami-alps.yamanashi.jp", 2899 | "minobu.yamanashi.jp", 2900 | "nakamichi.yamanashi.jp", 2901 | "nanbu.yamanashi.jp", 2902 | "narusawa.yamanashi.jp", 2903 | "nirasaki.yamanashi.jp", 2904 | "nishikatsura.yamanashi.jp", 2905 | "oshino.yamanashi.jp", 2906 | "otsuki.yamanashi.jp", 2907 | "showa.yamanashi.jp", 2908 | "tabayama.yamanashi.jp", 2909 | "tsuru.yamanashi.jp", 2910 | "uenohara.yamanashi.jp", 2911 | "yamanakako.yamanashi.jp", 2912 | "yamanashi.yamanashi.jp", 2913 | "ke", 2914 | "kg", 2915 | "org.kg", 2916 | "net.kg", 2917 | "com.kg", 2918 | "edu.kg", 2919 | "gov.kg", 2920 | "mil.kg", 2921 | "kh", 2922 | "ki", 2923 | "edu.ki", 2924 | "biz.ki", 2925 | "net.ki", 2926 | "org.ki", 2927 | "gov.ki", 2928 | "info.ki", 2929 | "com.ki", 2930 | "km", 2931 | "org.km", 2932 | "nom.km", 2933 | "gov.km", 2934 | "prd.km", 2935 | "tm.km", 2936 | "edu.km", 2937 | "mil.km", 2938 | "ass.km", 2939 | "com.km", 2940 | "coop.km", 2941 | "asso.km", 2942 | "presse.km", 2943 | "medecin.km", 2944 | "notaires.km", 2945 | "pharmaciens.km", 2946 | "veterinaire.km", 2947 | "gouv.km", 2948 | "kn", 2949 | "net.kn", 2950 | "org.kn", 2951 | "edu.kn", 2952 | "gov.kn", 2953 | "com.kp", 2954 | "edu.kp", 2955 | "gov.kp", 2956 | "org.kp", 2957 | "rep.kp", 2958 | "tra.kp", 2959 | "kr", 2960 | "ac.kr", 2961 | "co.kr", 2962 | "es.kr", 2963 | "go.kr", 2964 | "hs.kr", 2965 | "kg.kr", 2966 | "mil.kr", 2967 | "ms.kr", 2968 | "ne.kr", 2969 | "or.kr", 2970 | "pe.kr", 2971 | "re.kr", 2972 | "sc.kr", 2973 | "busan.kr", 2974 | "chungbuk.kr", 2975 | "chungnam.kr", 2976 | "daegu.kr", 2977 | "daejeon.kr", 2978 | "gangwon.kr", 2979 | "gwangju.kr", 2980 | "gyeongbuk.kr", 2981 | "gyeonggi.kr", 2982 | "gyeongnam.kr", 2983 | "incheon.kr", 2984 | "jeju.kr", 2985 | "jeonbuk.kr", 2986 | "jeonnam.kr", 2987 | "seoul.kr", 2988 | "ulsan.kr", 2989 | "kw", 2990 | "ky", 2991 | "edu.ky", 2992 | "gov.ky", 2993 | "com.ky", 2994 | "org.ky", 2995 | "net.ky", 2996 | "kz", 2997 | "org.kz", 2998 | "edu.kz", 2999 | "net.kz", 3000 | "gov.kz", 3001 | "mil.kz", 3002 | "com.kz", 3003 | "la", 3004 | "int.la", 3005 | "net.la", 3006 | "info.la", 3007 | "edu.la", 3008 | "gov.la", 3009 | "per.la", 3010 | "com.la", 3011 | "org.la", 3012 | "com.lb", 3013 | "edu.lb", 3014 | "gov.lb", 3015 | "net.lb", 3016 | "org.lb", 3017 | "lc", 3018 | "com.lc", 3019 | "net.lc", 3020 | "co.lc", 3021 | "org.lc", 3022 | "edu.lc", 3023 | "gov.lc", 3024 | "li", 3025 | "lk", 3026 | "gov.lk", 3027 | "sch.lk", 3028 | "net.lk", 3029 | "int.lk", 3030 | "com.lk", 3031 | "org.lk", 3032 | "edu.lk", 3033 | "ngo.lk", 3034 | "soc.lk", 3035 | "web.lk", 3036 | "ltd.lk", 3037 | "assn.lk", 3038 | "grp.lk", 3039 | "hotel.lk", 3040 | "com.lr", 3041 | "edu.lr", 3042 | "gov.lr", 3043 | "org.lr", 3044 | "net.lr", 3045 | "ls", 3046 | "co.ls", 3047 | "org.ls", 3048 | "lt", 3049 | "gov.lt", 3050 | "lu", 3051 | "lv", 3052 | "com.lv", 3053 | "edu.lv", 3054 | "gov.lv", 3055 | "org.lv", 3056 | "mil.lv", 3057 | "id.lv", 3058 | "net.lv", 3059 | "asn.lv", 3060 | "conf.lv", 3061 | "ly", 3062 | "com.ly", 3063 | "net.ly", 3064 | "gov.ly", 3065 | "plc.ly", 3066 | "edu.ly", 3067 | "sch.ly", 3068 | "med.ly", 3069 | "org.ly", 3070 | "id.ly", 3071 | "ma", 3072 | "co.ma", 3073 | "net.ma", 3074 | "gov.ma", 3075 | "org.ma", 3076 | "ac.ma", 3077 | "press.ma", 3078 | "mc", 3079 | "tm.mc", 3080 | "asso.mc", 3081 | "md", 3082 | "me", 3083 | "co.me", 3084 | "net.me", 3085 | "org.me", 3086 | "edu.me", 3087 | "ac.me", 3088 | "gov.me", 3089 | "its.me", 3090 | "priv.me", 3091 | "mg", 3092 | "org.mg", 3093 | "nom.mg", 3094 | "gov.mg", 3095 | "prd.mg", 3096 | "tm.mg", 3097 | "edu.mg", 3098 | "mil.mg", 3099 | "com.mg", 3100 | "mh", 3101 | "mil", 3102 | "mk", 3103 | "com.mk", 3104 | "org.mk", 3105 | "net.mk", 3106 | "edu.mk", 3107 | "gov.mk", 3108 | "inf.mk", 3109 | "name.mk", 3110 | "ml", 3111 | "com.ml", 3112 | "edu.ml", 3113 | "gouv.ml", 3114 | "gov.ml", 3115 | "net.ml", 3116 | "org.ml", 3117 | "presse.ml", 3118 | "mm", 3119 | "mn", 3120 | "gov.mn", 3121 | "edu.mn", 3122 | "org.mn", 3123 | "mo", 3124 | "com.mo", 3125 | "net.mo", 3126 | "org.mo", 3127 | "edu.mo", 3128 | "gov.mo", 3129 | "mobi", 3130 | "mp", 3131 | "mq", 3132 | "mr", 3133 | "gov.mr", 3134 | "ms", 3135 | "mt", 3136 | "mu", 3137 | "com.mu", 3138 | "net.mu", 3139 | "org.mu", 3140 | "gov.mu", 3141 | "ac.mu", 3142 | "co.mu", 3143 | "or.mu", 3144 | "museum", 3145 | "academy.museum", 3146 | "agriculture.museum", 3147 | "air.museum", 3148 | "airguard.museum", 3149 | "alabama.museum", 3150 | "alaska.museum", 3151 | "amber.museum", 3152 | "ambulance.museum", 3153 | "american.museum", 3154 | "americana.museum", 3155 | "americanantiques.museum", 3156 | "americanart.museum", 3157 | "amsterdam.museum", 3158 | "and.museum", 3159 | "annefrank.museum", 3160 | "anthro.museum", 3161 | "anthropology.museum", 3162 | "antiques.museum", 3163 | "aquarium.museum", 3164 | "arboretum.museum", 3165 | "archaeological.museum", 3166 | "archaeology.museum", 3167 | "architecture.museum", 3168 | "art.museum", 3169 | "artanddesign.museum", 3170 | "artcenter.museum", 3171 | "artdeco.museum", 3172 | "arteducation.museum", 3173 | "artgallery.museum", 3174 | "arts.museum", 3175 | "artsandcrafts.museum", 3176 | "asmatart.museum", 3177 | "assassination.museum", 3178 | "assisi.museum", 3179 | "association.museum", 3180 | "astronomy.museum", 3181 | "atlanta.museum", 3182 | "austin.museum", 3183 | "australia.museum", 3184 | "automotive.museum", 3185 | "aviation.museum", 3186 | "axis.museum", 3187 | "badajoz.museum", 3188 | "baghdad.museum", 3189 | "bahn.museum", 3190 | "bale.museum", 3191 | "baltimore.museum", 3192 | "barcelona.museum", 3193 | "baseball.museum", 3194 | "basel.museum", 3195 | "baths.museum", 3196 | "bauern.museum", 3197 | "beauxarts.museum", 3198 | "beeldengeluid.museum", 3199 | "bellevue.museum", 3200 | "bergbau.museum", 3201 | "berkeley.museum", 3202 | "berlin.museum", 3203 | "bern.museum", 3204 | "bible.museum", 3205 | "bilbao.museum", 3206 | "bill.museum", 3207 | "birdart.museum", 3208 | "birthplace.museum", 3209 | "bonn.museum", 3210 | "boston.museum", 3211 | "botanical.museum", 3212 | "botanicalgarden.museum", 3213 | "botanicgarden.museum", 3214 | "botany.museum", 3215 | "brandywinevalley.museum", 3216 | "brasil.museum", 3217 | "bristol.museum", 3218 | "british.museum", 3219 | "britishcolumbia.museum", 3220 | "broadcast.museum", 3221 | "brunel.museum", 3222 | "brussel.museum", 3223 | "brussels.museum", 3224 | "bruxelles.museum", 3225 | "building.museum", 3226 | "burghof.museum", 3227 | "bus.museum", 3228 | "bushey.museum", 3229 | "cadaques.museum", 3230 | "california.museum", 3231 | "cambridge.museum", 3232 | "can.museum", 3233 | "canada.museum", 3234 | "capebreton.museum", 3235 | "carrier.museum", 3236 | "cartoonart.museum", 3237 | "casadelamoneda.museum", 3238 | "castle.museum", 3239 | "castres.museum", 3240 | "celtic.museum", 3241 | "center.museum", 3242 | "chattanooga.museum", 3243 | "cheltenham.museum", 3244 | "chesapeakebay.museum", 3245 | "chicago.museum", 3246 | "children.museum", 3247 | "childrens.museum", 3248 | "childrensgarden.museum", 3249 | "chiropractic.museum", 3250 | "chocolate.museum", 3251 | "christiansburg.museum", 3252 | "cincinnati.museum", 3253 | "cinema.museum", 3254 | "circus.museum", 3255 | "civilisation.museum", 3256 | "civilization.museum", 3257 | "civilwar.museum", 3258 | "clinton.museum", 3259 | "clock.museum", 3260 | "coal.museum", 3261 | "coastaldefence.museum", 3262 | "cody.museum", 3263 | "coldwar.museum", 3264 | "collection.museum", 3265 | "colonialwilliamsburg.museum", 3266 | "coloradoplateau.museum", 3267 | "columbia.museum", 3268 | "columbus.museum", 3269 | "communication.museum", 3270 | "communications.museum", 3271 | "community.museum", 3272 | "computer.museum", 3273 | "computerhistory.museum", 3274 | "comunicações.museum", 3275 | "contemporary.museum", 3276 | "contemporaryart.museum", 3277 | "convent.museum", 3278 | "copenhagen.museum", 3279 | "corporation.museum", 3280 | "correios-e-telecomunicações.museum", 3281 | "corvette.museum", 3282 | "costume.museum", 3283 | "countryestate.museum", 3284 | "county.museum", 3285 | "crafts.museum", 3286 | "cranbrook.museum", 3287 | "creation.museum", 3288 | "cultural.museum", 3289 | "culturalcenter.museum", 3290 | "culture.museum", 3291 | "cyber.museum", 3292 | "cymru.museum", 3293 | "dali.museum", 3294 | "dallas.museum", 3295 | "database.museum", 3296 | "ddr.museum", 3297 | "decorativearts.museum", 3298 | "delaware.museum", 3299 | "delmenhorst.museum", 3300 | "denmark.museum", 3301 | "depot.museum", 3302 | "design.museum", 3303 | "detroit.museum", 3304 | "dinosaur.museum", 3305 | "discovery.museum", 3306 | "dolls.museum", 3307 | "donostia.museum", 3308 | "durham.museum", 3309 | "eastafrica.museum", 3310 | "eastcoast.museum", 3311 | "education.museum", 3312 | "educational.museum", 3313 | "egyptian.museum", 3314 | "eisenbahn.museum", 3315 | "elburg.museum", 3316 | "elvendrell.museum", 3317 | "embroidery.museum", 3318 | "encyclopedic.museum", 3319 | "england.museum", 3320 | "entomology.museum", 3321 | "environment.museum", 3322 | "environmentalconservation.museum", 3323 | "epilepsy.museum", 3324 | "essex.museum", 3325 | "estate.museum", 3326 | "ethnology.museum", 3327 | "exeter.museum", 3328 | "exhibition.museum", 3329 | "family.museum", 3330 | "farm.museum", 3331 | "farmequipment.museum", 3332 | "farmers.museum", 3333 | "farmstead.museum", 3334 | "field.museum", 3335 | "figueres.museum", 3336 | "filatelia.museum", 3337 | "film.museum", 3338 | "fineart.museum", 3339 | "finearts.museum", 3340 | "finland.museum", 3341 | "flanders.museum", 3342 | "florida.museum", 3343 | "force.museum", 3344 | "fortmissoula.museum", 3345 | "fortworth.museum", 3346 | "foundation.museum", 3347 | "francaise.museum", 3348 | "frankfurt.museum", 3349 | "franziskaner.museum", 3350 | "freemasonry.museum", 3351 | "freiburg.museum", 3352 | "fribourg.museum", 3353 | "frog.museum", 3354 | "fundacio.museum", 3355 | "furniture.museum", 3356 | "gallery.museum", 3357 | "garden.museum", 3358 | "gateway.museum", 3359 | "geelvinck.museum", 3360 | "gemological.museum", 3361 | "geology.museum", 3362 | "georgia.museum", 3363 | "giessen.museum", 3364 | "glas.museum", 3365 | "glass.museum", 3366 | "gorge.museum", 3367 | "grandrapids.museum", 3368 | "graz.museum", 3369 | "guernsey.museum", 3370 | "halloffame.museum", 3371 | "hamburg.museum", 3372 | "handson.museum", 3373 | "harvestcelebration.museum", 3374 | "hawaii.museum", 3375 | "health.museum", 3376 | "heimatunduhren.museum", 3377 | "hellas.museum", 3378 | "helsinki.museum", 3379 | "hembygdsforbund.museum", 3380 | "heritage.museum", 3381 | "histoire.museum", 3382 | "historical.museum", 3383 | "historicalsociety.museum", 3384 | "historichouses.museum", 3385 | "historisch.museum", 3386 | "historisches.museum", 3387 | "history.museum", 3388 | "historyofscience.museum", 3389 | "horology.museum", 3390 | "house.museum", 3391 | "humanities.museum", 3392 | "illustration.museum", 3393 | "imageandsound.museum", 3394 | "indian.museum", 3395 | "indiana.museum", 3396 | "indianapolis.museum", 3397 | "indianmarket.museum", 3398 | "intelligence.museum", 3399 | "interactive.museum", 3400 | "iraq.museum", 3401 | "iron.museum", 3402 | "isleofman.museum", 3403 | "jamison.museum", 3404 | "jefferson.museum", 3405 | "jerusalem.museum", 3406 | "jewelry.museum", 3407 | "jewish.museum", 3408 | "jewishart.museum", 3409 | "jfk.museum", 3410 | "journalism.museum", 3411 | "judaica.museum", 3412 | "judygarland.museum", 3413 | "juedisches.museum", 3414 | "juif.museum", 3415 | "karate.museum", 3416 | "karikatur.museum", 3417 | "kids.museum", 3418 | "koebenhavn.museum", 3419 | "koeln.museum", 3420 | "kunst.museum", 3421 | "kunstsammlung.museum", 3422 | "kunstunddesign.museum", 3423 | "labor.museum", 3424 | "labour.museum", 3425 | "lajolla.museum", 3426 | "lancashire.museum", 3427 | "landes.museum", 3428 | "lans.museum", 3429 | "läns.museum", 3430 | "larsson.museum", 3431 | "lewismiller.museum", 3432 | "lincoln.museum", 3433 | "linz.museum", 3434 | "living.museum", 3435 | "livinghistory.museum", 3436 | "localhistory.museum", 3437 | "london.museum", 3438 | "losangeles.museum", 3439 | "louvre.museum", 3440 | "loyalist.museum", 3441 | "lucerne.museum", 3442 | "luxembourg.museum", 3443 | "luzern.museum", 3444 | "mad.museum", 3445 | "madrid.museum", 3446 | "mallorca.museum", 3447 | "manchester.museum", 3448 | "mansion.museum", 3449 | "mansions.museum", 3450 | "manx.museum", 3451 | "marburg.museum", 3452 | "maritime.museum", 3453 | "maritimo.museum", 3454 | "maryland.museum", 3455 | "marylhurst.museum", 3456 | "media.museum", 3457 | "medical.museum", 3458 | "medizinhistorisches.museum", 3459 | "meeres.museum", 3460 | "memorial.museum", 3461 | "mesaverde.museum", 3462 | "michigan.museum", 3463 | "midatlantic.museum", 3464 | "military.museum", 3465 | "mill.museum", 3466 | "miners.museum", 3467 | "mining.museum", 3468 | "minnesota.museum", 3469 | "missile.museum", 3470 | "missoula.museum", 3471 | "modern.museum", 3472 | "moma.museum", 3473 | "money.museum", 3474 | "monmouth.museum", 3475 | "monticello.museum", 3476 | "montreal.museum", 3477 | "moscow.museum", 3478 | "motorcycle.museum", 3479 | "muenchen.museum", 3480 | "muenster.museum", 3481 | "mulhouse.museum", 3482 | "muncie.museum", 3483 | "museet.museum", 3484 | "museumcenter.museum", 3485 | "museumvereniging.museum", 3486 | "music.museum", 3487 | "national.museum", 3488 | "nationalfirearms.museum", 3489 | "nationalheritage.museum", 3490 | "nativeamerican.museum", 3491 | "naturalhistory.museum", 3492 | "naturalhistorymuseum.museum", 3493 | "naturalsciences.museum", 3494 | "nature.museum", 3495 | "naturhistorisches.museum", 3496 | "natuurwetenschappen.museum", 3497 | "naumburg.museum", 3498 | "naval.museum", 3499 | "nebraska.museum", 3500 | "neues.museum", 3501 | "newhampshire.museum", 3502 | "newjersey.museum", 3503 | "newmexico.museum", 3504 | "newport.museum", 3505 | "newspaper.museum", 3506 | "newyork.museum", 3507 | "niepce.museum", 3508 | "norfolk.museum", 3509 | "north.museum", 3510 | "nrw.museum", 3511 | "nuernberg.museum", 3512 | "nuremberg.museum", 3513 | "nyc.museum", 3514 | "nyny.museum", 3515 | "oceanographic.museum", 3516 | "oceanographique.museum", 3517 | "omaha.museum", 3518 | "online.museum", 3519 | "ontario.museum", 3520 | "openair.museum", 3521 | "oregon.museum", 3522 | "oregontrail.museum", 3523 | "otago.museum", 3524 | "oxford.museum", 3525 | "pacific.museum", 3526 | "paderborn.museum", 3527 | "palace.museum", 3528 | "paleo.museum", 3529 | "palmsprings.museum", 3530 | "panama.museum", 3531 | "paris.museum", 3532 | "pasadena.museum", 3533 | "pharmacy.museum", 3534 | "philadelphia.museum", 3535 | "philadelphiaarea.museum", 3536 | "philately.museum", 3537 | "phoenix.museum", 3538 | "photography.museum", 3539 | "pilots.museum", 3540 | "pittsburgh.museum", 3541 | "planetarium.museum", 3542 | "plantation.museum", 3543 | "plants.museum", 3544 | "plaza.museum", 3545 | "portal.museum", 3546 | "portland.museum", 3547 | "portlligat.museum", 3548 | "posts-and-telecommunications.museum", 3549 | "preservation.museum", 3550 | "presidio.museum", 3551 | "press.museum", 3552 | "project.museum", 3553 | "public.museum", 3554 | "pubol.museum", 3555 | "quebec.museum", 3556 | "railroad.museum", 3557 | "railway.museum", 3558 | "research.museum", 3559 | "resistance.museum", 3560 | "riodejaneiro.museum", 3561 | "rochester.museum", 3562 | "rockart.museum", 3563 | "roma.museum", 3564 | "russia.museum", 3565 | "saintlouis.museum", 3566 | "salem.museum", 3567 | "salvadordali.museum", 3568 | "salzburg.museum", 3569 | "sandiego.museum", 3570 | "sanfrancisco.museum", 3571 | "santabarbara.museum", 3572 | "santacruz.museum", 3573 | "santafe.museum", 3574 | "saskatchewan.museum", 3575 | "satx.museum", 3576 | "savannahga.museum", 3577 | "schlesisches.museum", 3578 | "schoenbrunn.museum", 3579 | "schokoladen.museum", 3580 | "school.museum", 3581 | "schweiz.museum", 3582 | "science.museum", 3583 | "scienceandhistory.museum", 3584 | "scienceandindustry.museum", 3585 | "sciencecenter.museum", 3586 | "sciencecenters.museum", 3587 | "science-fiction.museum", 3588 | "sciencehistory.museum", 3589 | "sciences.museum", 3590 | "sciencesnaturelles.museum", 3591 | "scotland.museum", 3592 | "seaport.museum", 3593 | "settlement.museum", 3594 | "settlers.museum", 3595 | "shell.museum", 3596 | "sherbrooke.museum", 3597 | "sibenik.museum", 3598 | "silk.museum", 3599 | "ski.museum", 3600 | "skole.museum", 3601 | "society.museum", 3602 | "sologne.museum", 3603 | "soundandvision.museum", 3604 | "southcarolina.museum", 3605 | "southwest.museum", 3606 | "space.museum", 3607 | "spy.museum", 3608 | "square.museum", 3609 | "stadt.museum", 3610 | "stalbans.museum", 3611 | "starnberg.museum", 3612 | "state.museum", 3613 | "stateofdelaware.museum", 3614 | "station.museum", 3615 | "steam.museum", 3616 | "steiermark.museum", 3617 | "stjohn.museum", 3618 | "stockholm.museum", 3619 | "stpetersburg.museum", 3620 | "stuttgart.museum", 3621 | "suisse.museum", 3622 | "surgeonshall.museum", 3623 | "surrey.museum", 3624 | "svizzera.museum", 3625 | "sweden.museum", 3626 | "sydney.museum", 3627 | "tank.museum", 3628 | "tcm.museum", 3629 | "technology.museum", 3630 | "telekommunikation.museum", 3631 | "television.museum", 3632 | "texas.museum", 3633 | "textile.museum", 3634 | "theater.museum", 3635 | "time.museum", 3636 | "timekeeping.museum", 3637 | "topology.museum", 3638 | "torino.museum", 3639 | "touch.museum", 3640 | "town.museum", 3641 | "transport.museum", 3642 | "tree.museum", 3643 | "trolley.museum", 3644 | "trust.museum", 3645 | "trustee.museum", 3646 | "uhren.museum", 3647 | "ulm.museum", 3648 | "undersea.museum", 3649 | "university.museum", 3650 | "usa.museum", 3651 | "usantiques.museum", 3652 | "usarts.museum", 3653 | "uscountryestate.museum", 3654 | "usculture.museum", 3655 | "usdecorativearts.museum", 3656 | "usgarden.museum", 3657 | "ushistory.museum", 3658 | "ushuaia.museum", 3659 | "uslivinghistory.museum", 3660 | "utah.museum", 3661 | "uvic.museum", 3662 | "valley.museum", 3663 | "vantaa.museum", 3664 | "versailles.museum", 3665 | "viking.museum", 3666 | "village.museum", 3667 | "virginia.museum", 3668 | "virtual.museum", 3669 | "virtuel.museum", 3670 | "vlaanderen.museum", 3671 | "volkenkunde.museum", 3672 | "wales.museum", 3673 | "wallonie.museum", 3674 | "war.museum", 3675 | "washingtondc.museum", 3676 | "watchandclock.museum", 3677 | "watch-and-clock.museum", 3678 | "western.museum", 3679 | "westfalen.museum", 3680 | "whaling.museum", 3681 | "wildlife.museum", 3682 | "williamsburg.museum", 3683 | "windmill.museum", 3684 | "workshop.museum", 3685 | "york.museum", 3686 | "yorkshire.museum", 3687 | "yosemite.museum", 3688 | "youth.museum", 3689 | "zoological.museum", 3690 | "zoology.museum", 3691 | "ירושלים.museum", 3692 | "иком.museum", 3693 | "mv", 3694 | "aero.mv", 3695 | "biz.mv", 3696 | "com.mv", 3697 | "coop.mv", 3698 | "edu.mv", 3699 | "gov.mv", 3700 | "info.mv", 3701 | "int.mv", 3702 | "mil.mv", 3703 | "museum.mv", 3704 | "name.mv", 3705 | "net.mv", 3706 | "org.mv", 3707 | "pro.mv", 3708 | "mw", 3709 | "ac.mw", 3710 | "biz.mw", 3711 | "co.mw", 3712 | "com.mw", 3713 | "coop.mw", 3714 | "edu.mw", 3715 | "gov.mw", 3716 | "int.mw", 3717 | "museum.mw", 3718 | "net.mw", 3719 | "org.mw", 3720 | "mx", 3721 | "com.mx", 3722 | "org.mx", 3723 | "gob.mx", 3724 | "edu.mx", 3725 | "net.mx", 3726 | "my", 3727 | "com.my", 3728 | "net.my", 3729 | "org.my", 3730 | "gov.my", 3731 | "edu.my", 3732 | "mil.my", 3733 | "name.my", 3734 | "mz", 3735 | "teledata.mz", 3736 | "na", 3737 | "info.na", 3738 | "pro.na", 3739 | "name.na", 3740 | "school.na", 3741 | "or.na", 3742 | "dr.na", 3743 | "us.na", 3744 | "mx.na", 3745 | "ca.na", 3746 | "in.na", 3747 | "cc.na", 3748 | "tv.na", 3749 | "ws.na", 3750 | "mobi.na", 3751 | "co.na", 3752 | "com.na", 3753 | "org.na", 3754 | "name", 3755 | "nc", 3756 | "asso.nc", 3757 | "ne", 3758 | "net", 3759 | "nf", 3760 | "com.nf", 3761 | "net.nf", 3762 | "per.nf", 3763 | "rec.nf", 3764 | "web.nf", 3765 | "arts.nf", 3766 | "firm.nf", 3767 | "info.nf", 3768 | "other.nf", 3769 | "store.nf", 3770 | "ac.ng", 3771 | "com.ng", 3772 | "edu.ng", 3773 | "gov.ng", 3774 | "net.ng", 3775 | "org.ng", 3776 | "ni", 3777 | "nl", 3778 | "bv.nl", 3779 | "no", 3780 | "fhs.no", 3781 | "vgs.no", 3782 | "fylkesbibl.no", 3783 | "folkebibl.no", 3784 | "museum.no", 3785 | "idrett.no", 3786 | "priv.no", 3787 | "mil.no", 3788 | "stat.no", 3789 | "dep.no", 3790 | "kommune.no", 3791 | "herad.no", 3792 | "aa.no", 3793 | "ah.no", 3794 | "bu.no", 3795 | "fm.no", 3796 | "hl.no", 3797 | "hm.no", 3798 | "jan-mayen.no", 3799 | "mr.no", 3800 | "nl.no", 3801 | "nt.no", 3802 | "of.no", 3803 | "ol.no", 3804 | "oslo.no", 3805 | "rl.no", 3806 | "sf.no", 3807 | "st.no", 3808 | "svalbard.no", 3809 | "tm.no", 3810 | "tr.no", 3811 | "va.no", 3812 | "vf.no", 3813 | "gs.aa.no", 3814 | "gs.ah.no", 3815 | "gs.bu.no", 3816 | "gs.fm.no", 3817 | "gs.hl.no", 3818 | "gs.hm.no", 3819 | "gs.jan-mayen.no", 3820 | "gs.mr.no", 3821 | "gs.nl.no", 3822 | "gs.nt.no", 3823 | "gs.of.no", 3824 | "gs.ol.no", 3825 | "gs.oslo.no", 3826 | "gs.rl.no", 3827 | "gs.sf.no", 3828 | "gs.st.no", 3829 | "gs.svalbard.no", 3830 | "gs.tm.no", 3831 | "gs.tr.no", 3832 | "gs.va.no", 3833 | "gs.vf.no", 3834 | "akrehamn.no", 3835 | "åkrehamn.no", 3836 | "algard.no", 3837 | "ålgård.no", 3838 | "arna.no", 3839 | "brumunddal.no", 3840 | "bryne.no", 3841 | "bronnoysund.no", 3842 | "brønnøysund.no", 3843 | "drobak.no", 3844 | "drøbak.no", 3845 | "egersund.no", 3846 | "fetsund.no", 3847 | "floro.no", 3848 | "florø.no", 3849 | "fredrikstad.no", 3850 | "hokksund.no", 3851 | "honefoss.no", 3852 | "hønefoss.no", 3853 | "jessheim.no", 3854 | "jorpeland.no", 3855 | "jørpeland.no", 3856 | "kirkenes.no", 3857 | "kopervik.no", 3858 | "krokstadelva.no", 3859 | "langevag.no", 3860 | "langevåg.no", 3861 | "leirvik.no", 3862 | "mjondalen.no", 3863 | "mjøndalen.no", 3864 | "mo-i-rana.no", 3865 | "mosjoen.no", 3866 | "mosjøen.no", 3867 | "nesoddtangen.no", 3868 | "orkanger.no", 3869 | "osoyro.no", 3870 | "osøyro.no", 3871 | "raholt.no", 3872 | "råholt.no", 3873 | "sandnessjoen.no", 3874 | "sandnessjøen.no", 3875 | "skedsmokorset.no", 3876 | "slattum.no", 3877 | "spjelkavik.no", 3878 | "stathelle.no", 3879 | "stavern.no", 3880 | "stjordalshalsen.no", 3881 | "stjørdalshalsen.no", 3882 | "tananger.no", 3883 | "tranby.no", 3884 | "vossevangen.no", 3885 | "afjord.no", 3886 | "åfjord.no", 3887 | "agdenes.no", 3888 | "al.no", 3889 | "ål.no", 3890 | "alesund.no", 3891 | "ålesund.no", 3892 | "alstahaug.no", 3893 | "alta.no", 3894 | "áltá.no", 3895 | "alaheadju.no", 3896 | "álaheadju.no", 3897 | "alvdal.no", 3898 | "amli.no", 3899 | "åmli.no", 3900 | "amot.no", 3901 | "åmot.no", 3902 | "andebu.no", 3903 | "andoy.no", 3904 | "andøy.no", 3905 | "andasuolo.no", 3906 | "ardal.no", 3907 | "årdal.no", 3908 | "aremark.no", 3909 | "arendal.no", 3910 | "ås.no", 3911 | "aseral.no", 3912 | "åseral.no", 3913 | "asker.no", 3914 | "askim.no", 3915 | "askvoll.no", 3916 | "askoy.no", 3917 | "askøy.no", 3918 | "asnes.no", 3919 | "åsnes.no", 3920 | "audnedaln.no", 3921 | "aukra.no", 3922 | "aure.no", 3923 | "aurland.no", 3924 | "aurskog-holand.no", 3925 | "aurskog-høland.no", 3926 | "austevoll.no", 3927 | "austrheim.no", 3928 | "averoy.no", 3929 | "averøy.no", 3930 | "balestrand.no", 3931 | "ballangen.no", 3932 | "balat.no", 3933 | "bálát.no", 3934 | "balsfjord.no", 3935 | "bahccavuotna.no", 3936 | "báhccavuotna.no", 3937 | "bamble.no", 3938 | "bardu.no", 3939 | "beardu.no", 3940 | "beiarn.no", 3941 | "bajddar.no", 3942 | "bájddar.no", 3943 | "baidar.no", 3944 | "báidár.no", 3945 | "berg.no", 3946 | "bergen.no", 3947 | "berlevag.no", 3948 | "berlevåg.no", 3949 | "bearalvahki.no", 3950 | "bearalváhki.no", 3951 | "bindal.no", 3952 | "birkenes.no", 3953 | "bjarkoy.no", 3954 | "bjarkøy.no", 3955 | "bjerkreim.no", 3956 | "bjugn.no", 3957 | "bodo.no", 3958 | "bodø.no", 3959 | "badaddja.no", 3960 | "bådåddjå.no", 3961 | "budejju.no", 3962 | "bokn.no", 3963 | "bremanger.no", 3964 | "bronnoy.no", 3965 | "brønnøy.no", 3966 | "bygland.no", 3967 | "bykle.no", 3968 | "barum.no", 3969 | "bærum.no", 3970 | "bo.telemark.no", 3971 | "bø.telemark.no", 3972 | "bo.nordland.no", 3973 | "bø.nordland.no", 3974 | "bievat.no", 3975 | "bievát.no", 3976 | "bomlo.no", 3977 | "bømlo.no", 3978 | "batsfjord.no", 3979 | "båtsfjord.no", 3980 | "bahcavuotna.no", 3981 | "báhcavuotna.no", 3982 | "dovre.no", 3983 | "drammen.no", 3984 | "drangedal.no", 3985 | "dyroy.no", 3986 | "dyrøy.no", 3987 | "donna.no", 3988 | "dønna.no", 3989 | "eid.no", 3990 | "eidfjord.no", 3991 | "eidsberg.no", 3992 | "eidskog.no", 3993 | "eidsvoll.no", 3994 | "eigersund.no", 3995 | "elverum.no", 3996 | "enebakk.no", 3997 | "engerdal.no", 3998 | "etne.no", 3999 | "etnedal.no", 4000 | "evenes.no", 4001 | "evenassi.no", 4002 | "evenášši.no", 4003 | "evje-og-hornnes.no", 4004 | "farsund.no", 4005 | "fauske.no", 4006 | "fuossko.no", 4007 | "fuoisku.no", 4008 | "fedje.no", 4009 | "fet.no", 4010 | "finnoy.no", 4011 | "finnøy.no", 4012 | "fitjar.no", 4013 | "fjaler.no", 4014 | "fjell.no", 4015 | "flakstad.no", 4016 | "flatanger.no", 4017 | "flekkefjord.no", 4018 | "flesberg.no", 4019 | "flora.no", 4020 | "fla.no", 4021 | "flå.no", 4022 | "folldal.no", 4023 | "forsand.no", 4024 | "fosnes.no", 4025 | "frei.no", 4026 | "frogn.no", 4027 | "froland.no", 4028 | "frosta.no", 4029 | "frana.no", 4030 | "fræna.no", 4031 | "froya.no", 4032 | "frøya.no", 4033 | "fusa.no", 4034 | "fyresdal.no", 4035 | "forde.no", 4036 | "førde.no", 4037 | "gamvik.no", 4038 | "gangaviika.no", 4039 | "gáŋgaviika.no", 4040 | "gaular.no", 4041 | "gausdal.no", 4042 | "gildeskal.no", 4043 | "gildeskål.no", 4044 | "giske.no", 4045 | "gjemnes.no", 4046 | "gjerdrum.no", 4047 | "gjerstad.no", 4048 | "gjesdal.no", 4049 | "gjovik.no", 4050 | "gjøvik.no", 4051 | "gloppen.no", 4052 | "gol.no", 4053 | "gran.no", 4054 | "grane.no", 4055 | "granvin.no", 4056 | "gratangen.no", 4057 | "grimstad.no", 4058 | "grong.no", 4059 | "kraanghke.no", 4060 | "kråanghke.no", 4061 | "grue.no", 4062 | "gulen.no", 4063 | "hadsel.no", 4064 | "halden.no", 4065 | "halsa.no", 4066 | "hamar.no", 4067 | "hamaroy.no", 4068 | "habmer.no", 4069 | "hábmer.no", 4070 | "hapmir.no", 4071 | "hápmir.no", 4072 | "hammerfest.no", 4073 | "hammarfeasta.no", 4074 | "hámmárfeasta.no", 4075 | "haram.no", 4076 | "hareid.no", 4077 | "harstad.no", 4078 | "hasvik.no", 4079 | "aknoluokta.no", 4080 | "ákŋoluokta.no", 4081 | "hattfjelldal.no", 4082 | "aarborte.no", 4083 | "haugesund.no", 4084 | "hemne.no", 4085 | "hemnes.no", 4086 | "hemsedal.no", 4087 | "heroy.more-og-romsdal.no", 4088 | "herøy.møre-og-romsdal.no", 4089 | "heroy.nordland.no", 4090 | "herøy.nordland.no", 4091 | "hitra.no", 4092 | "hjartdal.no", 4093 | "hjelmeland.no", 4094 | "hobol.no", 4095 | "hobøl.no", 4096 | "hof.no", 4097 | "hol.no", 4098 | "hole.no", 4099 | "holmestrand.no", 4100 | "holtalen.no", 4101 | "holtålen.no", 4102 | "hornindal.no", 4103 | "horten.no", 4104 | "hurdal.no", 4105 | "hurum.no", 4106 | "hvaler.no", 4107 | "hyllestad.no", 4108 | "hagebostad.no", 4109 | "hægebostad.no", 4110 | "hoyanger.no", 4111 | "høyanger.no", 4112 | "hoylandet.no", 4113 | "høylandet.no", 4114 | "ha.no", 4115 | "hå.no", 4116 | "ibestad.no", 4117 | "inderoy.no", 4118 | "inderøy.no", 4119 | "iveland.no", 4120 | "jevnaker.no", 4121 | "jondal.no", 4122 | "jolster.no", 4123 | "jølster.no", 4124 | "karasjok.no", 4125 | "karasjohka.no", 4126 | "kárášjohka.no", 4127 | "karlsoy.no", 4128 | "galsa.no", 4129 | "gálsá.no", 4130 | "karmoy.no", 4131 | "karmøy.no", 4132 | "kautokeino.no", 4133 | "guovdageaidnu.no", 4134 | "klepp.no", 4135 | "klabu.no", 4136 | "klæbu.no", 4137 | "kongsberg.no", 4138 | "kongsvinger.no", 4139 | "kragero.no", 4140 | "kragerø.no", 4141 | "kristiansand.no", 4142 | "kristiansund.no", 4143 | "krodsherad.no", 4144 | "krødsherad.no", 4145 | "kvalsund.no", 4146 | "rahkkeravju.no", 4147 | "ráhkkerávju.no", 4148 | "kvam.no", 4149 | "kvinesdal.no", 4150 | "kvinnherad.no", 4151 | "kviteseid.no", 4152 | "kvitsoy.no", 4153 | "kvitsøy.no", 4154 | "kvafjord.no", 4155 | "kvæfjord.no", 4156 | "giehtavuoatna.no", 4157 | "kvanangen.no", 4158 | "kvænangen.no", 4159 | "navuotna.no", 4160 | "návuotna.no", 4161 | "kafjord.no", 4162 | "kåfjord.no", 4163 | "gaivuotna.no", 4164 | "gáivuotna.no", 4165 | "larvik.no", 4166 | "lavangen.no", 4167 | "lavagis.no", 4168 | "loabat.no", 4169 | "loabát.no", 4170 | "lebesby.no", 4171 | "davvesiida.no", 4172 | "leikanger.no", 4173 | "leirfjord.no", 4174 | "leka.no", 4175 | "leksvik.no", 4176 | "lenvik.no", 4177 | "leangaviika.no", 4178 | "leaŋgaviika.no", 4179 | "lesja.no", 4180 | "levanger.no", 4181 | "lier.no", 4182 | "lierne.no", 4183 | "lillehammer.no", 4184 | "lillesand.no", 4185 | "lindesnes.no", 4186 | "lindas.no", 4187 | "lindås.no", 4188 | "lom.no", 4189 | "loppa.no", 4190 | "lahppi.no", 4191 | "láhppi.no", 4192 | "lund.no", 4193 | "lunner.no", 4194 | "luroy.no", 4195 | "lurøy.no", 4196 | "luster.no", 4197 | "lyngdal.no", 4198 | "lyngen.no", 4199 | "ivgu.no", 4200 | "lardal.no", 4201 | "lerdal.no", 4202 | "lærdal.no", 4203 | "lodingen.no", 4204 | "lødingen.no", 4205 | "lorenskog.no", 4206 | "lørenskog.no", 4207 | "loten.no", 4208 | "løten.no", 4209 | "malvik.no", 4210 | "masoy.no", 4211 | "måsøy.no", 4212 | "muosat.no", 4213 | "muosát.no", 4214 | "mandal.no", 4215 | "marker.no", 4216 | "marnardal.no", 4217 | "masfjorden.no", 4218 | "meland.no", 4219 | "meldal.no", 4220 | "melhus.no", 4221 | "meloy.no", 4222 | "meløy.no", 4223 | "meraker.no", 4224 | "meråker.no", 4225 | "moareke.no", 4226 | "moåreke.no", 4227 | "midsund.no", 4228 | "midtre-gauldal.no", 4229 | "modalen.no", 4230 | "modum.no", 4231 | "molde.no", 4232 | "moskenes.no", 4233 | "moss.no", 4234 | "mosvik.no", 4235 | "malselv.no", 4236 | "målselv.no", 4237 | "malatvuopmi.no", 4238 | "málatvuopmi.no", 4239 | "namdalseid.no", 4240 | "aejrie.no", 4241 | "namsos.no", 4242 | "namsskogan.no", 4243 | "naamesjevuemie.no", 4244 | "nååmesjevuemie.no", 4245 | "laakesvuemie.no", 4246 | "nannestad.no", 4247 | "narvik.no", 4248 | "narviika.no", 4249 | "naustdal.no", 4250 | "nedre-eiker.no", 4251 | "nes.akershus.no", 4252 | "nes.buskerud.no", 4253 | "nesna.no", 4254 | "nesodden.no", 4255 | "nesseby.no", 4256 | "unjarga.no", 4257 | "unjárga.no", 4258 | "nesset.no", 4259 | "nissedal.no", 4260 | "nittedal.no", 4261 | "nord-aurdal.no", 4262 | "nord-fron.no", 4263 | "nord-odal.no", 4264 | "norddal.no", 4265 | "nordkapp.no", 4266 | "davvenjarga.no", 4267 | "davvenjárga.no", 4268 | "nordre-land.no", 4269 | "nordreisa.no", 4270 | "raisa.no", 4271 | "ráisa.no", 4272 | "nore-og-uvdal.no", 4273 | "notodden.no", 4274 | "naroy.no", 4275 | "nærøy.no", 4276 | "notteroy.no", 4277 | "nøtterøy.no", 4278 | "odda.no", 4279 | "oksnes.no", 4280 | "øksnes.no", 4281 | "oppdal.no", 4282 | "oppegard.no", 4283 | "oppegård.no", 4284 | "orkdal.no", 4285 | "orland.no", 4286 | "ørland.no", 4287 | "orskog.no", 4288 | "ørskog.no", 4289 | "orsta.no", 4290 | "ørsta.no", 4291 | "os.hedmark.no", 4292 | "os.hordaland.no", 4293 | "osen.no", 4294 | "osteroy.no", 4295 | "osterøy.no", 4296 | "ostre-toten.no", 4297 | "østre-toten.no", 4298 | "overhalla.no", 4299 | "ovre-eiker.no", 4300 | "øvre-eiker.no", 4301 | "oyer.no", 4302 | "øyer.no", 4303 | "oygarden.no", 4304 | "øygarden.no", 4305 | "oystre-slidre.no", 4306 | "øystre-slidre.no", 4307 | "porsanger.no", 4308 | "porsangu.no", 4309 | "porsáŋgu.no", 4310 | "porsgrunn.no", 4311 | "radoy.no", 4312 | "radøy.no", 4313 | "rakkestad.no", 4314 | "rana.no", 4315 | "ruovat.no", 4316 | "randaberg.no", 4317 | "rauma.no", 4318 | "rendalen.no", 4319 | "rennebu.no", 4320 | "rennesoy.no", 4321 | "rennesøy.no", 4322 | "rindal.no", 4323 | "ringebu.no", 4324 | "ringerike.no", 4325 | "ringsaker.no", 4326 | "rissa.no", 4327 | "risor.no", 4328 | "risør.no", 4329 | "roan.no", 4330 | "rollag.no", 4331 | "rygge.no", 4332 | "ralingen.no", 4333 | "rælingen.no", 4334 | "rodoy.no", 4335 | "rødøy.no", 4336 | "romskog.no", 4337 | "rømskog.no", 4338 | "roros.no", 4339 | "røros.no", 4340 | "rost.no", 4341 | "røst.no", 4342 | "royken.no", 4343 | "røyken.no", 4344 | "royrvik.no", 4345 | "røyrvik.no", 4346 | "rade.no", 4347 | "råde.no", 4348 | "salangen.no", 4349 | "siellak.no", 4350 | "saltdal.no", 4351 | "salat.no", 4352 | "sálát.no", 4353 | "sálat.no", 4354 | "samnanger.no", 4355 | "sande.more-og-romsdal.no", 4356 | "sande.møre-og-romsdal.no", 4357 | "sande.vestfold.no", 4358 | "sandefjord.no", 4359 | "sandnes.no", 4360 | "sandoy.no", 4361 | "sandøy.no", 4362 | "sarpsborg.no", 4363 | "sauda.no", 4364 | "sauherad.no", 4365 | "sel.no", 4366 | "selbu.no", 4367 | "selje.no", 4368 | "seljord.no", 4369 | "sigdal.no", 4370 | "siljan.no", 4371 | "sirdal.no", 4372 | "skaun.no", 4373 | "skedsmo.no", 4374 | "ski.no", 4375 | "skien.no", 4376 | "skiptvet.no", 4377 | "skjervoy.no", 4378 | "skjervøy.no", 4379 | "skierva.no", 4380 | "skiervá.no", 4381 | "skjak.no", 4382 | "skjåk.no", 4383 | "skodje.no", 4384 | "skanland.no", 4385 | "skånland.no", 4386 | "skanit.no", 4387 | "skánit.no", 4388 | "smola.no", 4389 | "smøla.no", 4390 | "snillfjord.no", 4391 | "snasa.no", 4392 | "snåsa.no", 4393 | "snoasa.no", 4394 | "snaase.no", 4395 | "snåase.no", 4396 | "sogndal.no", 4397 | "sokndal.no", 4398 | "sola.no", 4399 | "solund.no", 4400 | "songdalen.no", 4401 | "sortland.no", 4402 | "spydeberg.no", 4403 | "stange.no", 4404 | "stavanger.no", 4405 | "steigen.no", 4406 | "steinkjer.no", 4407 | "stjordal.no", 4408 | "stjørdal.no", 4409 | "stokke.no", 4410 | "stor-elvdal.no", 4411 | "stord.no", 4412 | "stordal.no", 4413 | "storfjord.no", 4414 | "omasvuotna.no", 4415 | "strand.no", 4416 | "stranda.no", 4417 | "stryn.no", 4418 | "sula.no", 4419 | "suldal.no", 4420 | "sund.no", 4421 | "sunndal.no", 4422 | "surnadal.no", 4423 | "sveio.no", 4424 | "svelvik.no", 4425 | "sykkylven.no", 4426 | "sogne.no", 4427 | "søgne.no", 4428 | "somna.no", 4429 | "sømna.no", 4430 | "sondre-land.no", 4431 | "søndre-land.no", 4432 | "sor-aurdal.no", 4433 | "sør-aurdal.no", 4434 | "sor-fron.no", 4435 | "sør-fron.no", 4436 | "sor-odal.no", 4437 | "sør-odal.no", 4438 | "sor-varanger.no", 4439 | "sør-varanger.no", 4440 | "matta-varjjat.no", 4441 | "mátta-várjjat.no", 4442 | "sorfold.no", 4443 | "sørfold.no", 4444 | "sorreisa.no", 4445 | "sørreisa.no", 4446 | "sorum.no", 4447 | "sørum.no", 4448 | "tana.no", 4449 | "deatnu.no", 4450 | "time.no", 4451 | "tingvoll.no", 4452 | "tinn.no", 4453 | "tjeldsund.no", 4454 | "dielddanuorri.no", 4455 | "tjome.no", 4456 | "tjøme.no", 4457 | "tokke.no", 4458 | "tolga.no", 4459 | "torsken.no", 4460 | "tranoy.no", 4461 | "tranøy.no", 4462 | "tromso.no", 4463 | "tromsø.no", 4464 | "tromsa.no", 4465 | "romsa.no", 4466 | "trondheim.no", 4467 | "troandin.no", 4468 | "trysil.no", 4469 | "trana.no", 4470 | "træna.no", 4471 | "trogstad.no", 4472 | "trøgstad.no", 4473 | "tvedestrand.no", 4474 | "tydal.no", 4475 | "tynset.no", 4476 | "tysfjord.no", 4477 | "divtasvuodna.no", 4478 | "divttasvuotna.no", 4479 | "tysnes.no", 4480 | "tysvar.no", 4481 | "tysvær.no", 4482 | "tonsberg.no", 4483 | "tønsberg.no", 4484 | "ullensaker.no", 4485 | "ullensvang.no", 4486 | "ulvik.no", 4487 | "utsira.no", 4488 | "vadso.no", 4489 | "vadsø.no", 4490 | "cahcesuolo.no", 4491 | "čáhcesuolo.no", 4492 | "vaksdal.no", 4493 | "valle.no", 4494 | "vang.no", 4495 | "vanylven.no", 4496 | "vardo.no", 4497 | "vardø.no", 4498 | "varggat.no", 4499 | "várggát.no", 4500 | "vefsn.no", 4501 | "vaapste.no", 4502 | "vega.no", 4503 | "vegarshei.no", 4504 | "vegårshei.no", 4505 | "vennesla.no", 4506 | "verdal.no", 4507 | "verran.no", 4508 | "vestby.no", 4509 | "vestnes.no", 4510 | "vestre-slidre.no", 4511 | "vestre-toten.no", 4512 | "vestvagoy.no", 4513 | "vestvågøy.no", 4514 | "vevelstad.no", 4515 | "vik.no", 4516 | "vikna.no", 4517 | "vindafjord.no", 4518 | "volda.no", 4519 | "voss.no", 4520 | "varoy.no", 4521 | "værøy.no", 4522 | "vagan.no", 4523 | "vågan.no", 4524 | "voagat.no", 4525 | "vagsoy.no", 4526 | "vågsøy.no", 4527 | "vaga.no", 4528 | "vågå.no", 4529 | "valer.ostfold.no", 4530 | "våler.østfold.no", 4531 | "valer.hedmark.no", 4532 | "våler.hedmark.no", 4533 | "np", 4534 | "nr", 4535 | "biz.nr", 4536 | "info.nr", 4537 | "gov.nr", 4538 | "edu.nr", 4539 | "org.nr", 4540 | "net.nr", 4541 | "com.nr", 4542 | "nu", 4543 | "nz", 4544 | "om", 4545 | "mediaphone.om", 4546 | "nawrastelecom.om", 4547 | "nawras.om", 4548 | "omanmobile.om", 4549 | "omanpost.om", 4550 | "omantel.om", 4551 | "rakpetroleum.om", 4552 | "siemens.om", 4553 | "songfest.om", 4554 | "statecouncil.om", 4555 | "org", 4556 | "pa", 4557 | "ac.pa", 4558 | "gob.pa", 4559 | "com.pa", 4560 | "org.pa", 4561 | "sld.pa", 4562 | "edu.pa", 4563 | "net.pa", 4564 | "ing.pa", 4565 | "abo.pa", 4566 | "med.pa", 4567 | "nom.pa", 4568 | "pe", 4569 | "edu.pe", 4570 | "gob.pe", 4571 | "nom.pe", 4572 | "mil.pe", 4573 | "org.pe", 4574 | "com.pe", 4575 | "net.pe", 4576 | "pf", 4577 | "com.pf", 4578 | "org.pf", 4579 | "edu.pf", 4580 | "pg", 4581 | "ph", 4582 | "com.ph", 4583 | "net.ph", 4584 | "org.ph", 4585 | "gov.ph", 4586 | "edu.ph", 4587 | "ngo.ph", 4588 | "mil.ph", 4589 | "i.ph", 4590 | "pk", 4591 | "com.pk", 4592 | "net.pk", 4593 | "edu.pk", 4594 | "org.pk", 4595 | "fam.pk", 4596 | "biz.pk", 4597 | "web.pk", 4598 | "gov.pk", 4599 | "gob.pk", 4600 | "gok.pk", 4601 | "gon.pk", 4602 | "gop.pk", 4603 | "gos.pk", 4604 | "info.pk", 4605 | "pl", 4606 | "aid.pl", 4607 | "agro.pl", 4608 | "atm.pl", 4609 | "auto.pl", 4610 | "biz.pl", 4611 | "com.pl", 4612 | "edu.pl", 4613 | "gmina.pl", 4614 | "gsm.pl", 4615 | "info.pl", 4616 | "mail.pl", 4617 | "miasta.pl", 4618 | "media.pl", 4619 | "mil.pl", 4620 | "net.pl", 4621 | "nieruchomosci.pl", 4622 | "nom.pl", 4623 | "org.pl", 4624 | "pc.pl", 4625 | "powiat.pl", 4626 | "priv.pl", 4627 | "realestate.pl", 4628 | "rel.pl", 4629 | "sex.pl", 4630 | "shop.pl", 4631 | "sklep.pl", 4632 | "sos.pl", 4633 | "szkola.pl", 4634 | "targi.pl", 4635 | "tm.pl", 4636 | "tourism.pl", 4637 | "travel.pl", 4638 | "turystyka.pl", 4639 | "6bone.pl", 4640 | "art.pl", 4641 | "mbone.pl", 4642 | "gov.pl", 4643 | "uw.gov.pl", 4644 | "um.gov.pl", 4645 | "ug.gov.pl", 4646 | "upow.gov.pl", 4647 | "starostwo.gov.pl", 4648 | "so.gov.pl", 4649 | "sr.gov.pl", 4650 | "po.gov.pl", 4651 | "pa.gov.pl", 4652 | "ngo.pl", 4653 | "irc.pl", 4654 | "usenet.pl", 4655 | "augustow.pl", 4656 | "babia-gora.pl", 4657 | "bedzin.pl", 4658 | "beskidy.pl", 4659 | "bialowieza.pl", 4660 | "bialystok.pl", 4661 | "bielawa.pl", 4662 | "bieszczady.pl", 4663 | "boleslawiec.pl", 4664 | "bydgoszcz.pl", 4665 | "bytom.pl", 4666 | "cieszyn.pl", 4667 | "czeladz.pl", 4668 | "czest.pl", 4669 | "dlugoleka.pl", 4670 | "elblag.pl", 4671 | "elk.pl", 4672 | "glogow.pl", 4673 | "gniezno.pl", 4674 | "gorlice.pl", 4675 | "grajewo.pl", 4676 | "ilawa.pl", 4677 | "jaworzno.pl", 4678 | "jelenia-gora.pl", 4679 | "jgora.pl", 4680 | "kalisz.pl", 4681 | "kazimierz-dolny.pl", 4682 | "karpacz.pl", 4683 | "kartuzy.pl", 4684 | "kaszuby.pl", 4685 | "katowice.pl", 4686 | "kepno.pl", 4687 | "ketrzyn.pl", 4688 | "klodzko.pl", 4689 | "kobierzyce.pl", 4690 | "kolobrzeg.pl", 4691 | "konin.pl", 4692 | "konskowola.pl", 4693 | "kutno.pl", 4694 | "lapy.pl", 4695 | "lebork.pl", 4696 | "legnica.pl", 4697 | "lezajsk.pl", 4698 | "limanowa.pl", 4699 | "lomza.pl", 4700 | "lowicz.pl", 4701 | "lubin.pl", 4702 | "lukow.pl", 4703 | "malbork.pl", 4704 | "malopolska.pl", 4705 | "mazowsze.pl", 4706 | "mazury.pl", 4707 | "mielec.pl", 4708 | "mielno.pl", 4709 | "mragowo.pl", 4710 | "naklo.pl", 4711 | "nowaruda.pl", 4712 | "nysa.pl", 4713 | "olawa.pl", 4714 | "olecko.pl", 4715 | "olkusz.pl", 4716 | "olsztyn.pl", 4717 | "opoczno.pl", 4718 | "opole.pl", 4719 | "ostroda.pl", 4720 | "ostroleka.pl", 4721 | "ostrowiec.pl", 4722 | "ostrowwlkp.pl", 4723 | "pila.pl", 4724 | "pisz.pl", 4725 | "podhale.pl", 4726 | "podlasie.pl", 4727 | "polkowice.pl", 4728 | "pomorze.pl", 4729 | "pomorskie.pl", 4730 | "prochowice.pl", 4731 | "pruszkow.pl", 4732 | "przeworsk.pl", 4733 | "pulawy.pl", 4734 | "radom.pl", 4735 | "rawa-maz.pl", 4736 | "rybnik.pl", 4737 | "rzeszow.pl", 4738 | "sanok.pl", 4739 | "sejny.pl", 4740 | "siedlce.pl", 4741 | "slask.pl", 4742 | "slupsk.pl", 4743 | "sosnowiec.pl", 4744 | "stalowa-wola.pl", 4745 | "skoczow.pl", 4746 | "starachowice.pl", 4747 | "stargard.pl", 4748 | "suwalki.pl", 4749 | "swidnica.pl", 4750 | "swiebodzin.pl", 4751 | "swinoujscie.pl", 4752 | "szczecin.pl", 4753 | "szczytno.pl", 4754 | "tarnobrzeg.pl", 4755 | "tgory.pl", 4756 | "turek.pl", 4757 | "tychy.pl", 4758 | "ustka.pl", 4759 | "walbrzych.pl", 4760 | "warmia.pl", 4761 | "warszawa.pl", 4762 | "waw.pl", 4763 | "wegrow.pl", 4764 | "wielun.pl", 4765 | "wlocl.pl", 4766 | "wloclawek.pl", 4767 | "wodzislaw.pl", 4768 | "wolomin.pl", 4769 | "wroclaw.pl", 4770 | "zachpomor.pl", 4771 | "zagan.pl", 4772 | "zarow.pl", 4773 | "zgora.pl", 4774 | "zgorzelec.pl", 4775 | "gda.pl", 4776 | "gdansk.pl", 4777 | "gdynia.pl", 4778 | "med.pl", 4779 | "sopot.pl", 4780 | "gliwice.pl", 4781 | "krakow.pl", 4782 | "poznan.pl", 4783 | "wroc.pl", 4784 | "zakopane.pl", 4785 | "pm", 4786 | "pn", 4787 | "gov.pn", 4788 | "co.pn", 4789 | "org.pn", 4790 | "edu.pn", 4791 | "net.pn", 4792 | "post", 4793 | "pr", 4794 | "com.pr", 4795 | "net.pr", 4796 | "org.pr", 4797 | "gov.pr", 4798 | "edu.pr", 4799 | "isla.pr", 4800 | "pro.pr", 4801 | "biz.pr", 4802 | "info.pr", 4803 | "name.pr", 4804 | "est.pr", 4805 | "prof.pr", 4806 | "ac.pr", 4807 | "pro", 4808 | "aca.pro", 4809 | "bar.pro", 4810 | "cpa.pro", 4811 | "jur.pro", 4812 | "law.pro", 4813 | "med.pro", 4814 | "eng.pro", 4815 | "ps", 4816 | "edu.ps", 4817 | "gov.ps", 4818 | "sec.ps", 4819 | "plo.ps", 4820 | "com.ps", 4821 | "org.ps", 4822 | "net.ps", 4823 | "pt", 4824 | "net.pt", 4825 | "gov.pt", 4826 | "org.pt", 4827 | "edu.pt", 4828 | "int.pt", 4829 | "publ.pt", 4830 | "com.pt", 4831 | "nome.pt", 4832 | "pw", 4833 | "co.pw", 4834 | "ne.pw", 4835 | "or.pw", 4836 | "ed.pw", 4837 | "go.pw", 4838 | "belau.pw", 4839 | "py", 4840 | "com.py", 4841 | "coop.py", 4842 | "edu.py", 4843 | "gov.py", 4844 | "mil.py", 4845 | "net.py", 4846 | "org.py", 4847 | "qa", 4848 | "com.qa", 4849 | "edu.qa", 4850 | "gov.qa", 4851 | "mil.qa", 4852 | "name.qa", 4853 | "net.qa", 4854 | "org.qa", 4855 | "sch.qa", 4856 | "re", 4857 | "com.re", 4858 | "asso.re", 4859 | "nom.re", 4860 | "ro", 4861 | "com.ro", 4862 | "org.ro", 4863 | "tm.ro", 4864 | "nt.ro", 4865 | "nom.ro", 4866 | "info.ro", 4867 | "rec.ro", 4868 | "arts.ro", 4869 | "firm.ro", 4870 | "store.ro", 4871 | "www.ro", 4872 | "rs", 4873 | "co.rs", 4874 | "org.rs", 4875 | "edu.rs", 4876 | "ac.rs", 4877 | "gov.rs", 4878 | "in.rs", 4879 | "ru", 4880 | "ac.ru", 4881 | "com.ru", 4882 | "edu.ru", 4883 | "int.ru", 4884 | "net.ru", 4885 | "org.ru", 4886 | "pp.ru", 4887 | "adygeya.ru", 4888 | "altai.ru", 4889 | "amur.ru", 4890 | "arkhangelsk.ru", 4891 | "astrakhan.ru", 4892 | "bashkiria.ru", 4893 | "belgorod.ru", 4894 | "bir.ru", 4895 | "bryansk.ru", 4896 | "buryatia.ru", 4897 | "cbg.ru", 4898 | "chel.ru", 4899 | "chelyabinsk.ru", 4900 | "chita.ru", 4901 | "chukotka.ru", 4902 | "chuvashia.ru", 4903 | "dagestan.ru", 4904 | "dudinka.ru", 4905 | "e-burg.ru", 4906 | "grozny.ru", 4907 | "irkutsk.ru", 4908 | "ivanovo.ru", 4909 | "izhevsk.ru", 4910 | "jar.ru", 4911 | "joshkar-ola.ru", 4912 | "kalmykia.ru", 4913 | "kaluga.ru", 4914 | "kamchatka.ru", 4915 | "karelia.ru", 4916 | "kazan.ru", 4917 | "kchr.ru", 4918 | "kemerovo.ru", 4919 | "khabarovsk.ru", 4920 | "khakassia.ru", 4921 | "khv.ru", 4922 | "kirov.ru", 4923 | "koenig.ru", 4924 | "komi.ru", 4925 | "kostroma.ru", 4926 | "krasnoyarsk.ru", 4927 | "kuban.ru", 4928 | "kurgan.ru", 4929 | "kursk.ru", 4930 | "lipetsk.ru", 4931 | "magadan.ru", 4932 | "mari.ru", 4933 | "mari-el.ru", 4934 | "marine.ru", 4935 | "mordovia.ru", 4936 | "mosreg.ru", 4937 | "msk.ru", 4938 | "murmansk.ru", 4939 | "nalchik.ru", 4940 | "nnov.ru", 4941 | "nov.ru", 4942 | "novosibirsk.ru", 4943 | "nsk.ru", 4944 | "omsk.ru", 4945 | "orenburg.ru", 4946 | "oryol.ru", 4947 | "palana.ru", 4948 | "penza.ru", 4949 | "perm.ru", 4950 | "pskov.ru", 4951 | "ptz.ru", 4952 | "rnd.ru", 4953 | "ryazan.ru", 4954 | "sakhalin.ru", 4955 | "samara.ru", 4956 | "saratov.ru", 4957 | "simbirsk.ru", 4958 | "smolensk.ru", 4959 | "spb.ru", 4960 | "stavropol.ru", 4961 | "stv.ru", 4962 | "surgut.ru", 4963 | "tambov.ru", 4964 | "tatarstan.ru", 4965 | "tom.ru", 4966 | "tomsk.ru", 4967 | "tsaritsyn.ru", 4968 | "tsk.ru", 4969 | "tula.ru", 4970 | "tuva.ru", 4971 | "tver.ru", 4972 | "tyumen.ru", 4973 | "udm.ru", 4974 | "udmurtia.ru", 4975 | "ulan-ude.ru", 4976 | "vladikavkaz.ru", 4977 | "vladimir.ru", 4978 | "vladivostok.ru", 4979 | "volgograd.ru", 4980 | "vologda.ru", 4981 | "voronezh.ru", 4982 | "vrn.ru", 4983 | "vyatka.ru", 4984 | "yakutia.ru", 4985 | "yamal.ru", 4986 | "yaroslavl.ru", 4987 | "yekaterinburg.ru", 4988 | "yuzhno-sakhalinsk.ru", 4989 | "amursk.ru", 4990 | "baikal.ru", 4991 | "cmw.ru", 4992 | "fareast.ru", 4993 | "jamal.ru", 4994 | "kms.ru", 4995 | "k-uralsk.ru", 4996 | "kustanai.ru", 4997 | "kuzbass.ru", 4998 | "magnitka.ru", 4999 | "mytis.ru", 5000 | "nakhodka.ru", 5001 | "nkz.ru", 5002 | "norilsk.ru", 5003 | "oskol.ru", 5004 | "pyatigorsk.ru", 5005 | "rubtsovsk.ru", 5006 | "snz.ru", 5007 | "syzran.ru", 5008 | "vdonsk.ru", 5009 | "zgrad.ru", 5010 | "gov.ru", 5011 | "mil.ru", 5012 | "test.ru", 5013 | "rw", 5014 | "gov.rw", 5015 | "net.rw", 5016 | "edu.rw", 5017 | "ac.rw", 5018 | "com.rw", 5019 | "co.rw", 5020 | "int.rw", 5021 | "mil.rw", 5022 | "gouv.rw", 5023 | "sa", 5024 | "com.sa", 5025 | "net.sa", 5026 | "org.sa", 5027 | "gov.sa", 5028 | "med.sa", 5029 | "pub.sa", 5030 | "edu.sa", 5031 | "sch.sa", 5032 | "sb", 5033 | "com.sb", 5034 | "edu.sb", 5035 | "gov.sb", 5036 | "net.sb", 5037 | "org.sb", 5038 | "sc", 5039 | "com.sc", 5040 | "gov.sc", 5041 | "net.sc", 5042 | "org.sc", 5043 | "edu.sc", 5044 | "sd", 5045 | "com.sd", 5046 | "net.sd", 5047 | "org.sd", 5048 | "edu.sd", 5049 | "med.sd", 5050 | "tv.sd", 5051 | "gov.sd", 5052 | "info.sd", 5053 | "se", 5054 | "a.se", 5055 | "ac.se", 5056 | "b.se", 5057 | "bd.se", 5058 | "brand.se", 5059 | "c.se", 5060 | "d.se", 5061 | "e.se", 5062 | "f.se", 5063 | "fh.se", 5064 | "fhsk.se", 5065 | "fhv.se", 5066 | "g.se", 5067 | "h.se", 5068 | "i.se", 5069 | "k.se", 5070 | "komforb.se", 5071 | "kommunalforbund.se", 5072 | "komvux.se", 5073 | "l.se", 5074 | "lanbib.se", 5075 | "m.se", 5076 | "n.se", 5077 | "naturbruksgymn.se", 5078 | "o.se", 5079 | "org.se", 5080 | "p.se", 5081 | "parti.se", 5082 | "pp.se", 5083 | "press.se", 5084 | "r.se", 5085 | "s.se", 5086 | "sshn.se", 5087 | "t.se", 5088 | "tm.se", 5089 | "u.se", 5090 | "w.se", 5091 | "x.se", 5092 | "y.se", 5093 | "z.se", 5094 | "sg", 5095 | "com.sg", 5096 | "net.sg", 5097 | "org.sg", 5098 | "gov.sg", 5099 | "edu.sg", 5100 | "per.sg", 5101 | "sh", 5102 | "com.sh", 5103 | "net.sh", 5104 | "gov.sh", 5105 | "org.sh", 5106 | "mil.sh", 5107 | "si", 5108 | "sk", 5109 | "sl", 5110 | "com.sl", 5111 | "net.sl", 5112 | "edu.sl", 5113 | "gov.sl", 5114 | "org.sl", 5115 | "sm", 5116 | "sn", 5117 | "art.sn", 5118 | "com.sn", 5119 | "edu.sn", 5120 | "gouv.sn", 5121 | "org.sn", 5122 | "perso.sn", 5123 | "univ.sn", 5124 | "so", 5125 | "com.so", 5126 | "net.so", 5127 | "org.so", 5128 | "sr", 5129 | "st", 5130 | "co.st", 5131 | "com.st", 5132 | "consulado.st", 5133 | "edu.st", 5134 | "embaixada.st", 5135 | "gov.st", 5136 | "mil.st", 5137 | "net.st", 5138 | "org.st", 5139 | "principe.st", 5140 | "saotome.st", 5141 | "store.st", 5142 | "su", 5143 | "sv", 5144 | "sx", 5145 | "gov.sx", 5146 | "sy", 5147 | "edu.sy", 5148 | "gov.sy", 5149 | "net.sy", 5150 | "mil.sy", 5151 | "com.sy", 5152 | "org.sy", 5153 | "sz", 5154 | "co.sz", 5155 | "ac.sz", 5156 | "org.sz", 5157 | "tc", 5158 | "td", 5159 | "tel", 5160 | "tf", 5161 | "tg", 5162 | "th", 5163 | "ac.th", 5164 | "co.th", 5165 | "go.th", 5166 | "in.th", 5167 | "mi.th", 5168 | "net.th", 5169 | "or.th", 5170 | "tj", 5171 | "ac.tj", 5172 | "biz.tj", 5173 | "co.tj", 5174 | "com.tj", 5175 | "edu.tj", 5176 | "go.tj", 5177 | "gov.tj", 5178 | "int.tj", 5179 | "mil.tj", 5180 | "name.tj", 5181 | "net.tj", 5182 | "nic.tj", 5183 | "org.tj", 5184 | "test.tj", 5185 | "web.tj", 5186 | "tk", 5187 | "tl", 5188 | "gov.tl", 5189 | "tm", 5190 | "com.tm", 5191 | "co.tm", 5192 | "org.tm", 5193 | "net.tm", 5194 | "nom.tm", 5195 | "gov.tm", 5196 | "mil.tm", 5197 | "edu.tm", 5198 | "tn", 5199 | "com.tn", 5200 | "ens.tn", 5201 | "fin.tn", 5202 | "gov.tn", 5203 | "ind.tn", 5204 | "intl.tn", 5205 | "nat.tn", 5206 | "net.tn", 5207 | "org.tn", 5208 | "info.tn", 5209 | "perso.tn", 5210 | "tourism.tn", 5211 | "edunet.tn", 5212 | "rnrt.tn", 5213 | "rns.tn", 5214 | "rnu.tn", 5215 | "mincom.tn", 5216 | "agrinet.tn", 5217 | "defense.tn", 5218 | "turen.tn", 5219 | "to", 5220 | "com.to", 5221 | "gov.to", 5222 | "net.to", 5223 | "org.to", 5224 | "edu.to", 5225 | "mil.to", 5226 | "tr", 5227 | "nic.tr", 5228 | "gov.nc.tr", 5229 | "travel", 5230 | "tt", 5231 | "co.tt", 5232 | "com.tt", 5233 | "org.tt", 5234 | "net.tt", 5235 | "biz.tt", 5236 | "info.tt", 5237 | "pro.tt", 5238 | "int.tt", 5239 | "coop.tt", 5240 | "jobs.tt", 5241 | "mobi.tt", 5242 | "travel.tt", 5243 | "museum.tt", 5244 | "aero.tt", 5245 | "name.tt", 5246 | "gov.tt", 5247 | "edu.tt", 5248 | "tv", 5249 | "tw", 5250 | "edu.tw", 5251 | "gov.tw", 5252 | "mil.tw", 5253 | "com.tw", 5254 | "net.tw", 5255 | "org.tw", 5256 | "idv.tw", 5257 | "game.tw", 5258 | "ebiz.tw", 5259 | "club.tw", 5260 | "網路.tw", 5261 | "組織.tw", 5262 | "商業.tw", 5263 | "ac.tz", 5264 | "co.tz", 5265 | "go.tz", 5266 | "hotel.tz", 5267 | "info.tz", 5268 | "me.tz", 5269 | "mil.tz", 5270 | "mobi.tz", 5271 | "ne.tz", 5272 | "or.tz", 5273 | "sc.tz", 5274 | "tv.tz", 5275 | "ua", 5276 | "com.ua", 5277 | "edu.ua", 5278 | "gov.ua", 5279 | "in.ua", 5280 | "net.ua", 5281 | "org.ua", 5282 | "cherkassy.ua", 5283 | "cherkasy.ua", 5284 | "chernigov.ua", 5285 | "chernihiv.ua", 5286 | "chernivtsi.ua", 5287 | "chernovtsy.ua", 5288 | "ck.ua", 5289 | "cn.ua", 5290 | "cr.ua", 5291 | "crimea.ua", 5292 | "cv.ua", 5293 | "dn.ua", 5294 | "dnepropetrovsk.ua", 5295 | "dnipropetrovsk.ua", 5296 | "dominic.ua", 5297 | "donetsk.ua", 5298 | "dp.ua", 5299 | "if.ua", 5300 | "ivano-frankivsk.ua", 5301 | "kh.ua", 5302 | "kharkiv.ua", 5303 | "kharkov.ua", 5304 | "kherson.ua", 5305 | "khmelnitskiy.ua", 5306 | "khmelnytskyi.ua", 5307 | "kiev.ua", 5308 | "kirovograd.ua", 5309 | "km.ua", 5310 | "kr.ua", 5311 | "krym.ua", 5312 | "ks.ua", 5313 | "kv.ua", 5314 | "kyiv.ua", 5315 | "lg.ua", 5316 | "lt.ua", 5317 | "lugansk.ua", 5318 | "lutsk.ua", 5319 | "lv.ua", 5320 | "lviv.ua", 5321 | "mk.ua", 5322 | "mykolaiv.ua", 5323 | "nikolaev.ua", 5324 | "od.ua", 5325 | "odesa.ua", 5326 | "odessa.ua", 5327 | "pl.ua", 5328 | "poltava.ua", 5329 | "rivne.ua", 5330 | "rovno.ua", 5331 | "rv.ua", 5332 | "sb.ua", 5333 | "sebastopol.ua", 5334 | "sevastopol.ua", 5335 | "sm.ua", 5336 | "sumy.ua", 5337 | "te.ua", 5338 | "ternopil.ua", 5339 | "uz.ua", 5340 | "uzhgorod.ua", 5341 | "vinnica.ua", 5342 | "vinnytsia.ua", 5343 | "vn.ua", 5344 | "volyn.ua", 5345 | "yalta.ua", 5346 | "zaporizhzhe.ua", 5347 | "zaporizhzhia.ua", 5348 | "zhitomir.ua", 5349 | "zhytomyr.ua", 5350 | "zp.ua", 5351 | "zt.ua", 5352 | "co.ua", 5353 | "pp.ua", 5354 | "ug", 5355 | "co.ug", 5356 | "or.ug", 5357 | "ac.ug", 5358 | "sc.ug", 5359 | "go.ug", 5360 | "ne.ug", 5361 | "com.ug", 5362 | "org.ug", 5363 | "uk", 5364 | "sch.uk", 5365 | "bl.uk", 5366 | "british-library.uk", 5367 | "jet.uk", 5368 | "mod.uk", 5369 | "national-library-scotland.uk", 5370 | "nel.uk", 5371 | "nic.uk", 5372 | "nls.uk", 5373 | "parliament.uk", 5374 | "us", 5375 | "dni.us", 5376 | "fed.us", 5377 | "isa.us", 5378 | "kids.us", 5379 | "nsn.us", 5380 | "ak.us", 5381 | "al.us", 5382 | "ar.us", 5383 | "as.us", 5384 | "az.us", 5385 | "ca.us", 5386 | "co.us", 5387 | "ct.us", 5388 | "dc.us", 5389 | "de.us", 5390 | "fl.us", 5391 | "ga.us", 5392 | "gu.us", 5393 | "hi.us", 5394 | "ia.us", 5395 | "id.us", 5396 | "il.us", 5397 | "in.us", 5398 | "ks.us", 5399 | "ky.us", 5400 | "la.us", 5401 | "ma.us", 5402 | "md.us", 5403 | "me.us", 5404 | "mi.us", 5405 | "mn.us", 5406 | "mo.us", 5407 | "ms.us", 5408 | "mt.us", 5409 | "nc.us", 5410 | "nd.us", 5411 | "ne.us", 5412 | "nh.us", 5413 | "nj.us", 5414 | "nm.us", 5415 | "nv.us", 5416 | "ny.us", 5417 | "oh.us", 5418 | "ok.us", 5419 | "or.us", 5420 | "pa.us", 5421 | "pr.us", 5422 | "ri.us", 5423 | "sc.us", 5424 | "sd.us", 5425 | "tn.us", 5426 | "tx.us", 5427 | "ut.us", 5428 | "vi.us", 5429 | "vt.us", 5430 | "va.us", 5431 | "wa.us", 5432 | "wi.us", 5433 | "wv.us", 5434 | "wy.us", 5435 | "k12.ak.us", 5436 | "k12.al.us", 5437 | "k12.ar.us", 5438 | "k12.as.us", 5439 | "k12.az.us", 5440 | "k12.ca.us", 5441 | "k12.co.us", 5442 | "k12.ct.us", 5443 | "k12.dc.us", 5444 | "k12.de.us", 5445 | "k12.fl.us", 5446 | "k12.ga.us", 5447 | "k12.gu.us", 5448 | "k12.ia.us", 5449 | "k12.id.us", 5450 | "k12.il.us", 5451 | "k12.in.us", 5452 | "k12.ks.us", 5453 | "k12.ky.us", 5454 | "k12.la.us", 5455 | "k12.ma.us", 5456 | "k12.md.us", 5457 | "k12.me.us", 5458 | "k12.mi.us", 5459 | "k12.mn.us", 5460 | "k12.mo.us", 5461 | "k12.ms.us", 5462 | "k12.mt.us", 5463 | "k12.nc.us", 5464 | "k12.nd.us", 5465 | "k12.ne.us", 5466 | "k12.nh.us", 5467 | "k12.nj.us", 5468 | "k12.nm.us", 5469 | "k12.nv.us", 5470 | "k12.ny.us", 5471 | "k12.oh.us", 5472 | "k12.ok.us", 5473 | "k12.or.us", 5474 | "k12.pa.us", 5475 | "k12.pr.us", 5476 | "k12.ri.us", 5477 | "k12.sc.us", 5478 | "k12.sd.us", 5479 | "k12.tn.us", 5480 | "k12.tx.us", 5481 | "k12.ut.us", 5482 | "k12.vi.us", 5483 | "k12.vt.us", 5484 | "k12.va.us", 5485 | "k12.wa.us", 5486 | "k12.wi.us", 5487 | "k12.wv.us", 5488 | "k12.wy.us", 5489 | "cc.ak.us", 5490 | "cc.al.us", 5491 | "cc.ar.us", 5492 | "cc.as.us", 5493 | "cc.az.us", 5494 | "cc.ca.us", 5495 | "cc.co.us", 5496 | "cc.ct.us", 5497 | "cc.dc.us", 5498 | "cc.de.us", 5499 | "cc.fl.us", 5500 | "cc.ga.us", 5501 | "cc.gu.us", 5502 | "cc.hi.us", 5503 | "cc.ia.us", 5504 | "cc.id.us", 5505 | "cc.il.us", 5506 | "cc.in.us", 5507 | "cc.ks.us", 5508 | "cc.ky.us", 5509 | "cc.la.us", 5510 | "cc.ma.us", 5511 | "cc.md.us", 5512 | "cc.me.us", 5513 | "cc.mi.us", 5514 | "cc.mn.us", 5515 | "cc.mo.us", 5516 | "cc.ms.us", 5517 | "cc.mt.us", 5518 | "cc.nc.us", 5519 | "cc.nd.us", 5520 | "cc.ne.us", 5521 | "cc.nh.us", 5522 | "cc.nj.us", 5523 | "cc.nm.us", 5524 | "cc.nv.us", 5525 | "cc.ny.us", 5526 | "cc.oh.us", 5527 | "cc.ok.us", 5528 | "cc.or.us", 5529 | "cc.pa.us", 5530 | "cc.pr.us", 5531 | "cc.ri.us", 5532 | "cc.sc.us", 5533 | "cc.sd.us", 5534 | "cc.tn.us", 5535 | "cc.tx.us", 5536 | "cc.ut.us", 5537 | "cc.vi.us", 5538 | "cc.vt.us", 5539 | "cc.va.us", 5540 | "cc.wa.us", 5541 | "cc.wi.us", 5542 | "cc.wv.us", 5543 | "cc.wy.us", 5544 | "lib.ak.us", 5545 | "lib.al.us", 5546 | "lib.ar.us", 5547 | "lib.as.us", 5548 | "lib.az.us", 5549 | "lib.ca.us", 5550 | "lib.co.us", 5551 | "lib.ct.us", 5552 | "lib.dc.us", 5553 | "lib.de.us", 5554 | "lib.fl.us", 5555 | "lib.ga.us", 5556 | "lib.gu.us", 5557 | "lib.hi.us", 5558 | "lib.ia.us", 5559 | "lib.id.us", 5560 | "lib.il.us", 5561 | "lib.in.us", 5562 | "lib.ks.us", 5563 | "lib.ky.us", 5564 | "lib.la.us", 5565 | "lib.ma.us", 5566 | "lib.md.us", 5567 | "lib.me.us", 5568 | "lib.mi.us", 5569 | "lib.mn.us", 5570 | "lib.mo.us", 5571 | "lib.ms.us", 5572 | "lib.mt.us", 5573 | "lib.nc.us", 5574 | "lib.nd.us", 5575 | "lib.ne.us", 5576 | "lib.nh.us", 5577 | "lib.nj.us", 5578 | "lib.nm.us", 5579 | "lib.nv.us", 5580 | "lib.ny.us", 5581 | "lib.oh.us", 5582 | "lib.ok.us", 5583 | "lib.or.us", 5584 | "lib.pa.us", 5585 | "lib.pr.us", 5586 | "lib.ri.us", 5587 | "lib.sc.us", 5588 | "lib.sd.us", 5589 | "lib.tn.us", 5590 | "lib.tx.us", 5591 | "lib.ut.us", 5592 | "lib.vi.us", 5593 | "lib.vt.us", 5594 | "lib.va.us", 5595 | "lib.wa.us", 5596 | "lib.wi.us", 5597 | "lib.wv.us", 5598 | "lib.wy.us", 5599 | "pvt.k12.ma.us", 5600 | "chtr.k12.ma.us", 5601 | "paroch.k12.ma.us", 5602 | "uy", 5603 | "com.uy", 5604 | "edu.uy", 5605 | "gub.uy", 5606 | "mil.uy", 5607 | "net.uy", 5608 | "org.uy", 5609 | "uz", 5610 | "co.uz", 5611 | "com.uz", 5612 | "net.uz", 5613 | "org.uz", 5614 | "va", 5615 | "vc", 5616 | "com.vc", 5617 | "net.vc", 5618 | "org.vc", 5619 | "gov.vc", 5620 | "mil.vc", 5621 | "edu.vc", 5622 | "ve", 5623 | "co.ve", 5624 | "com.ve", 5625 | "e12.ve", 5626 | "edu.ve", 5627 | "gov.ve", 5628 | "info.ve", 5629 | "mil.ve", 5630 | "net.ve", 5631 | "org.ve", 5632 | "web.ve", 5633 | "vg", 5634 | "vi", 5635 | "co.vi", 5636 | "com.vi", 5637 | "k12.vi", 5638 | "net.vi", 5639 | "org.vi", 5640 | "vn", 5641 | "com.vn", 5642 | "net.vn", 5643 | "org.vn", 5644 | "edu.vn", 5645 | "gov.vn", 5646 | "int.vn", 5647 | "ac.vn", 5648 | "biz.vn", 5649 | "info.vn", 5650 | "name.vn", 5651 | "pro.vn", 5652 | "health.vn", 5653 | "vu", 5654 | "wf", 5655 | "ws", 5656 | "com.ws", 5657 | "net.ws", 5658 | "org.ws", 5659 | "gov.ws", 5660 | "edu.ws", 5661 | "yt", 5662 | "امارات", 5663 | "বাংলা", 5664 | "中国", 5665 | "中國", 5666 | "الجزائر", 5667 | "مصر", 5668 | "გე", 5669 | "香港", 5670 | "भारत", 5671 | "بھارت", 5672 | "భారత్", 5673 | "ભારત", 5674 | "ਭਾਰਤ", 5675 | "ভারত", 5676 | "இந்தியா", 5677 | "ایران", 5678 | "ايران", 5679 | "الاردن", 5680 | "한국", 5681 | "ලංකා", 5682 | "இலங்கை", 5683 | "المغرب", 5684 | "عمان", 5685 | "فلسطين", 5686 | "срб", 5687 | "рф", 5688 | "قطر", 5689 | "السعودية", 5690 | "السعودیة", 5691 | "السعودیۃ", 5692 | "السعوديه", 5693 | "سورية", 5694 | "سوريا", 5695 | "新加坡", 5696 | "சிங்கப்பூர்", 5697 | "ไทย", 5698 | "تونس", 5699 | "台灣", 5700 | "台湾", 5701 | "臺灣", 5702 | "укр", 5703 | "اليمن", 5704 | "xxx", 5705 | "ye", 5706 | "za", 5707 | "zm", 5708 | "zw", 5709 | "cloudfront.net", 5710 | "compute.amazonaws.com", 5711 | "us-east-1.amazonaws.com", 5712 | "compute-1.amazonaws.com", 5713 | "z-1.compute-1.amazonaws.com", 5714 | "z-2.compute-1.amazonaws.com", 5715 | "ap-northeast-1.compute.amazonaws.com", 5716 | "ap-southeast-1.compute.amazonaws.com", 5717 | "ap-southeast-2.compute.amazonaws.com", 5718 | "eu-west-1.compute.amazonaws.com", 5719 | "sa-east-1.compute.amazonaws.com", 5720 | "us-gov-west-1.compute.amazonaws.com", 5721 | "us-west-1.compute.amazonaws.com", 5722 | "us-west-2.compute.amazonaws.com", 5723 | "elasticbeanstalk.com", 5724 | "elb.amazonaws.com", 5725 | "s3.amazonaws.com", 5726 | "s3-us-west-2.amazonaws.com", 5727 | "s3-us-west-1.amazonaws.com", 5728 | "s3-eu-west-1.amazonaws.com", 5729 | "s3-ap-southeast-1.amazonaws.com", 5730 | "s3-ap-southeast-2.amazonaws.com", 5731 | "s3-ap-northeast-1.amazonaws.com", 5732 | "s3-sa-east-1.amazonaws.com", 5733 | "s3-us-gov-west-1.amazonaws.com", 5734 | "s3-fips-us-gov-west-1.amazonaws.com", 5735 | "s3-website-us-east-1.amazonaws.com", 5736 | "s3-website-us-west-2.amazonaws.com", 5737 | "s3-website-us-west-1.amazonaws.com", 5738 | "s3-website-eu-west-1.amazonaws.com", 5739 | "s3-website-ap-southeast-1.amazonaws.com", 5740 | "s3-website-ap-southeast-2.amazonaws.com", 5741 | "s3-website-ap-northeast-1.amazonaws.com", 5742 | "s3-website-sa-east-1.amazonaws.com", 5743 | "s3-website-us-gov-west-1.amazonaws.com", 5744 | "betainabox.com", 5745 | "ae.org", 5746 | "ar.com", 5747 | "br.com", 5748 | "cn.com", 5749 | "com.de", 5750 | "de.com", 5751 | "eu.com", 5752 | "gb.com", 5753 | "gb.net", 5754 | "gr.com", 5755 | "hu.com", 5756 | "hu.net", 5757 | "jp.net", 5758 | "jpn.com", 5759 | "kr.com", 5760 | "no.com", 5761 | "qc.com", 5762 | "ru.com", 5763 | "sa.com", 5764 | "se.com", 5765 | "se.net", 5766 | "uk.com", 5767 | "uk.net", 5768 | "us.com", 5769 | "us.org", 5770 | "uy.com", 5771 | "za.com", 5772 | "c.la", 5773 | "cloudcontrolled.com", 5774 | "cloudcontrolapp.com", 5775 | "co.ca", 5776 | "co.nl", 5777 | "co.no", 5778 | "dreamhosters.com", 5779 | "dyndns-at-home.com", 5780 | "dyndns-at-work.com", 5781 | "dyndns-blog.com", 5782 | "dyndns-free.com", 5783 | "dyndns-home.com", 5784 | "dyndns-ip.com", 5785 | "dyndns-mail.com", 5786 | "dyndns-office.com", 5787 | "dyndns-pics.com", 5788 | "dyndns-remote.com", 5789 | "dyndns-server.com", 5790 | "dyndns-web.com", 5791 | "dyndns-wiki.com", 5792 | "dyndns-work.com", 5793 | "dyndns.biz", 5794 | "dyndns.info", 5795 | "dyndns.org", 5796 | "dyndns.tv", 5797 | "at-band-camp.net", 5798 | "ath.cx", 5799 | "barrel-of-knowledge.info", 5800 | "barrell-of-knowledge.info", 5801 | "better-than.tv", 5802 | "blogdns.com", 5803 | "blogdns.net", 5804 | "blogdns.org", 5805 | "blogsite.org", 5806 | "boldlygoingnowhere.org", 5807 | "broke-it.net", 5808 | "buyshouses.net", 5809 | "cechire.com", 5810 | "dnsalias.com", 5811 | "dnsalias.net", 5812 | "dnsalias.org", 5813 | "dnsdojo.com", 5814 | "dnsdojo.net", 5815 | "dnsdojo.org", 5816 | "does-it.net", 5817 | "doesntexist.com", 5818 | "doesntexist.org", 5819 | "dontexist.com", 5820 | "dontexist.net", 5821 | "dontexist.org", 5822 | "doomdns.com", 5823 | "doomdns.org", 5824 | "dvrdns.org", 5825 | "dyn-o-saur.com", 5826 | "dynalias.com", 5827 | "dynalias.net", 5828 | "dynalias.org", 5829 | "dynathome.net", 5830 | "dyndns.ws", 5831 | "endofinternet.net", 5832 | "endofinternet.org", 5833 | "endoftheinternet.org", 5834 | "est-a-la-maison.com", 5835 | "est-a-la-masion.com", 5836 | "est-le-patron.com", 5837 | "est-mon-blogueur.com", 5838 | "for-better.biz", 5839 | "for-more.biz", 5840 | "for-our.info", 5841 | "for-some.biz", 5842 | "for-the.biz", 5843 | "forgot.her.name", 5844 | "forgot.his.name", 5845 | "from-ak.com", 5846 | "from-al.com", 5847 | "from-ar.com", 5848 | "from-az.net", 5849 | "from-ca.com", 5850 | "from-co.net", 5851 | "from-ct.com", 5852 | "from-dc.com", 5853 | "from-de.com", 5854 | "from-fl.com", 5855 | "from-ga.com", 5856 | "from-hi.com", 5857 | "from-ia.com", 5858 | "from-id.com", 5859 | "from-il.com", 5860 | "from-in.com", 5861 | "from-ks.com", 5862 | "from-ky.com", 5863 | "from-la.net", 5864 | "from-ma.com", 5865 | "from-md.com", 5866 | "from-me.org", 5867 | "from-mi.com", 5868 | "from-mn.com", 5869 | "from-mo.com", 5870 | "from-ms.com", 5871 | "from-mt.com", 5872 | "from-nc.com", 5873 | "from-nd.com", 5874 | "from-ne.com", 5875 | "from-nh.com", 5876 | "from-nj.com", 5877 | "from-nm.com", 5878 | "from-nv.com", 5879 | "from-ny.net", 5880 | "from-oh.com", 5881 | "from-ok.com", 5882 | "from-or.com", 5883 | "from-pa.com", 5884 | "from-pr.com", 5885 | "from-ri.com", 5886 | "from-sc.com", 5887 | "from-sd.com", 5888 | "from-tn.com", 5889 | "from-tx.com", 5890 | "from-ut.com", 5891 | "from-va.com", 5892 | "from-vt.com", 5893 | "from-wa.com", 5894 | "from-wi.com", 5895 | "from-wv.com", 5896 | "from-wy.com", 5897 | "ftpaccess.cc", 5898 | "fuettertdasnetz.de", 5899 | "game-host.org", 5900 | "game-server.cc", 5901 | "getmyip.com", 5902 | "gets-it.net", 5903 | "go.dyndns.org", 5904 | "gotdns.com", 5905 | "gotdns.org", 5906 | "groks-the.info", 5907 | "groks-this.info", 5908 | "ham-radio-op.net", 5909 | "here-for-more.info", 5910 | "hobby-site.com", 5911 | "hobby-site.org", 5912 | "home.dyndns.org", 5913 | "homedns.org", 5914 | "homeftp.net", 5915 | "homeftp.org", 5916 | "homeip.net", 5917 | "homelinux.com", 5918 | "homelinux.net", 5919 | "homelinux.org", 5920 | "homeunix.com", 5921 | "homeunix.net", 5922 | "homeunix.org", 5923 | "iamallama.com", 5924 | "in-the-band.net", 5925 | "is-a-anarchist.com", 5926 | "is-a-blogger.com", 5927 | "is-a-bookkeeper.com", 5928 | "is-a-bruinsfan.org", 5929 | "is-a-bulls-fan.com", 5930 | "is-a-candidate.org", 5931 | "is-a-caterer.com", 5932 | "is-a-celticsfan.org", 5933 | "is-a-chef.com", 5934 | "is-a-chef.net", 5935 | "is-a-chef.org", 5936 | "is-a-conservative.com", 5937 | "is-a-cpa.com", 5938 | "is-a-cubicle-slave.com", 5939 | "is-a-democrat.com", 5940 | "is-a-designer.com", 5941 | "is-a-doctor.com", 5942 | "is-a-financialadvisor.com", 5943 | "is-a-geek.com", 5944 | "is-a-geek.net", 5945 | "is-a-geek.org", 5946 | "is-a-green.com", 5947 | "is-a-guru.com", 5948 | "is-a-hard-worker.com", 5949 | "is-a-hunter.com", 5950 | "is-a-knight.org", 5951 | "is-a-landscaper.com", 5952 | "is-a-lawyer.com", 5953 | "is-a-liberal.com", 5954 | "is-a-libertarian.com", 5955 | "is-a-linux-user.org", 5956 | "is-a-llama.com", 5957 | "is-a-musician.com", 5958 | "is-a-nascarfan.com", 5959 | "is-a-nurse.com", 5960 | "is-a-painter.com", 5961 | "is-a-patsfan.org", 5962 | "is-a-personaltrainer.com", 5963 | "is-a-photographer.com", 5964 | "is-a-player.com", 5965 | "is-a-republican.com", 5966 | "is-a-rockstar.com", 5967 | "is-a-socialist.com", 5968 | "is-a-soxfan.org", 5969 | "is-a-student.com", 5970 | "is-a-teacher.com", 5971 | "is-a-techie.com", 5972 | "is-a-therapist.com", 5973 | "is-an-accountant.com", 5974 | "is-an-actor.com", 5975 | "is-an-actress.com", 5976 | "is-an-anarchist.com", 5977 | "is-an-artist.com", 5978 | "is-an-engineer.com", 5979 | "is-an-entertainer.com", 5980 | "is-by.us", 5981 | "is-certified.com", 5982 | "is-found.org", 5983 | "is-gone.com", 5984 | "is-into-anime.com", 5985 | "is-into-cars.com", 5986 | "is-into-cartoons.com", 5987 | "is-into-games.com", 5988 | "is-leet.com", 5989 | "is-lost.org", 5990 | "is-not-certified.com", 5991 | "is-saved.org", 5992 | "is-slick.com", 5993 | "is-uberleet.com", 5994 | "is-very-bad.org", 5995 | "is-very-evil.org", 5996 | "is-very-good.org", 5997 | "is-very-nice.org", 5998 | "is-very-sweet.org", 5999 | "is-with-theband.com", 6000 | "isa-geek.com", 6001 | "isa-geek.net", 6002 | "isa-geek.org", 6003 | "isa-hockeynut.com", 6004 | "issmarterthanyou.com", 6005 | "isteingeek.de", 6006 | "istmein.de", 6007 | "kicks-ass.net", 6008 | "kicks-ass.org", 6009 | "knowsitall.info", 6010 | "land-4-sale.us", 6011 | "lebtimnetz.de", 6012 | "leitungsen.de", 6013 | "likes-pie.com", 6014 | "likescandy.com", 6015 | "merseine.nu", 6016 | "mine.nu", 6017 | "misconfused.org", 6018 | "mypets.ws", 6019 | "myphotos.cc", 6020 | "neat-url.com", 6021 | "office-on-the.net", 6022 | "on-the-web.tv", 6023 | "podzone.net", 6024 | "podzone.org", 6025 | "readmyblog.org", 6026 | "saves-the-whales.com", 6027 | "scrapper-site.net", 6028 | "scrapping.cc", 6029 | "selfip.biz", 6030 | "selfip.com", 6031 | "selfip.info", 6032 | "selfip.net", 6033 | "selfip.org", 6034 | "sells-for-less.com", 6035 | "sells-for-u.com", 6036 | "sells-it.net", 6037 | "sellsyourhome.org", 6038 | "servebbs.com", 6039 | "servebbs.net", 6040 | "servebbs.org", 6041 | "serveftp.net", 6042 | "serveftp.org", 6043 | "servegame.org", 6044 | "shacknet.nu", 6045 | "simple-url.com", 6046 | "space-to-rent.com", 6047 | "stuff-4-sale.org", 6048 | "stuff-4-sale.us", 6049 | "teaches-yoga.com", 6050 | "thruhere.net", 6051 | "traeumtgerade.de", 6052 | "webhop.biz", 6053 | "webhop.info", 6054 | "webhop.net", 6055 | "webhop.org", 6056 | "worse-than.tv", 6057 | "writesthisblog.com", 6058 | "a.ssl.fastly.net", 6059 | "b.ssl.fastly.net", 6060 | "global.ssl.fastly.net", 6061 | "a.prod.fastly.net", 6062 | "global.prod.fastly.net", 6063 | "github.io", 6064 | "ro.com", 6065 | "appspot.com", 6066 | "blogspot.be", 6067 | "blogspot.bj", 6068 | "blogspot.ca", 6069 | "blogspot.cf", 6070 | "blogspot.ch", 6071 | "blogspot.co.at", 6072 | "blogspot.co.il", 6073 | "blogspot.co.nz", 6074 | "blogspot.co.uk", 6075 | "blogspot.com", 6076 | "blogspot.com.ar", 6077 | "blogspot.com.au", 6078 | "blogspot.com.br", 6079 | "blogspot.com.es", 6080 | "blogspot.cv", 6081 | "blogspot.cz", 6082 | "blogspot.de", 6083 | "blogspot.dk", 6084 | "blogspot.fi", 6085 | "blogspot.fr", 6086 | "blogspot.gr", 6087 | "blogspot.hk", 6088 | "blogspot.hu", 6089 | "blogspot.ie", 6090 | "blogspot.in", 6091 | "blogspot.it", 6092 | "blogspot.jp", 6093 | "blogspot.kr", 6094 | "blogspot.mr", 6095 | "blogspot.mx", 6096 | "blogspot.nl", 6097 | "blogspot.no", 6098 | "blogspot.pt", 6099 | "blogspot.re", 6100 | "blogspot.ro", 6101 | "blogspot.se", 6102 | "blogspot.sg", 6103 | "blogspot.sk", 6104 | "blogspot.td", 6105 | "blogspot.tw", 6106 | "codespot.com", 6107 | "googleapis.com", 6108 | "googlecode.com", 6109 | "herokuapp.com", 6110 | "herokussl.com", 6111 | "iki.fi", 6112 | "biz.at", 6113 | "info.at", 6114 | "co.pl", 6115 | "nyc.mn", 6116 | "operaunite.com", 6117 | "rhcloud.com", 6118 | "priv.at", 6119 | "za.net", 6120 | "za.org", 6121 | }; 6122 | -------------------------------------------------------------------------------- /ip_location_stuff.bro: -------------------------------------------------------------------------------- 1 | local g: geo_location = lookup_location(8.8.8.8); 2 | 3 | print fmt("CC, %s", g$country_code); 4 | print fmt("region, %s", g$region); 5 | print fmt("city, %s", g$city); 6 | print fmt("lat, %s", g$latitude); 7 | print fmt("lon, %s", g$longitude); 8 | 9 | local g2: count = lookup_asn(8.8.8.8); 10 | 11 | print g2; 12 | 13 | -------------------------------------------------------------------------------- /opaques_and_hooks.bro: -------------------------------------------------------------------------------- 1 | # opaques 2 | #local handle: opaque of md5 = md5_hash_init(); 3 | #md5_hash_update(handle, "test"); 4 | #md5_hash_update(handle, "testing"); 5 | #print md5_hash_finish(handle); 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | # hooks 14 | #global myhook: hook(s: string); 15 | # 16 | #hook myhook(s: string) &priority=10 17 | #{ 18 | # print "priority 10 myhook handler", s; 19 | # s = "bye"; 20 | #} 21 | # 22 | #hook myhook(s: string) 23 | #{ 24 | # print "break out of myhook handling", s; 25 | # break; 26 | #} 27 | # 28 | #hook myhook(s: string) &priority=-5 29 | #{ 30 | # print "not going to happen", s; 31 | #} 32 | # 33 | #if ( hook myhook("hi") ) 34 | #{ 35 | # print "all handlers ran"; 36 | #} 37 | -------------------------------------------------------------------------------- /order_of_ops.bro: -------------------------------------------------------------------------------- 1 | module UniqueModuleName1234; 2 | 3 | export { 4 | global foo: string = "foo"; 5 | # print "you cannot print from an export block :("; 6 | } 7 | 8 | event bro_init() 9 | { 10 | print "printing from a bro_init() event"; 11 | } 12 | 13 | event bro_done() 14 | { 15 | print "printing from a bro_done() event"; 16 | } 17 | 18 | 19 | print "printing outside any events or functions before the @-statements"; 20 | @if (T) 21 | @ifdef ( UniqueModuleName1234::foo ) 22 | print fmt("printing from an @-statement. UniqueModuleName1234::foo is defined as: %s", UniqueModuleName1234::foo); 23 | @else 24 | print "@-statements are interpretted before export frames"; 25 | @endif 26 | @else 27 | print "this should never happen, because the initial @if was set to T"; 28 | # try setting the if statement to F and see what occurs 29 | @endif 30 | # why doesn't the following print statement print anything? 31 | print "printing outside any events or functions after the @-statements"; 32 | -------------------------------------------------------------------------------- /owasp/__load__.bro: -------------------------------------------------------------------------------- 1 | @load ./http_ext 2 | @load ./url_decoder 3 | @load ./detect-response-splitting.bro 4 | 5 | -------------------------------------------------------------------------------- /owasp/detect-response-splitting.bro: -------------------------------------------------------------------------------- 1 | @load base/frameworks/notice 2 | 3 | module HTTP; 4 | 5 | export { 6 | redef enum Notice::Type += { 7 | Response_Splitting_Body, 8 | Response_Splitting_Parameter, 9 | }; 10 | 11 | global http_response_line: pattern = /.*?[[:digit:]]{3}[[:space:]]([[:alpha:]]+[[:space:]])+HTTP\/[0-9]/; 12 | global url_decode_tries: count = 3; 13 | } 14 | 15 | event connection_state_remove(c: connection) 16 | { 17 | if (!c?$http) return; 18 | if (c$http$body_length > 6) 19 | { 20 | if (HTTP::http_response_line in HTTP::url_decode(c$http$body_data, HTTP::url_decode_tries)) 21 | { 22 | NOTICE([$note=Response_Splitting_Body, $msg="Possible HTTP response splitting"]); 23 | } 24 | } 25 | } 26 | 27 | event http_message_done(c: connection, is_orig: bool, stat: http_message_stat) 28 | { 29 | if (! is_orig) return; 30 | 31 | for (p in c$http$params_data) 32 | { 33 | if (HTTP::http_response_line in HTTP::url_decode(p, HTTP::url_decode_tries)) 34 | { 35 | NOTICE([$note=Response_Splitting_Parameter, $msg="Possible HTTP response splitting"]); 36 | } 37 | } 38 | } 39 | -------------------------------------------------------------------------------- /owasp/http_ext.bro: -------------------------------------------------------------------------------- 1 | module HTTP; 2 | 3 | export { 4 | redef record Info += { 5 | body_length: count &log &default=0; 6 | body_data: string &log &default=""; 7 | params_data: set[string] &log &optional; 8 | }; 9 | global body_length_max: count = 1024; 10 | } 11 | 12 | function extract_params_data(uri: string): set[string] 13 | { 14 | local p: set[string] = set(); 15 | if (strstr(uri, "?")==0) return p; 16 | 17 | local query: string = split1(uri, /\?/)[2]; 18 | local opv: table[count] of string = split(query, /&/); 19 | 20 | for (each in opv) 21 | { 22 | add p[split1(opv[each], /=/)[2]]; 23 | } 24 | 25 | return p; 26 | } 27 | 28 | event http_entity_data(c: connection, is_orig: bool, length: count, data: string) 29 | { 30 | if (is_orig) 31 | { 32 | if (c$http$body_length < HTTP::body_length_max) 33 | { 34 | c$http$body_data = string_cat(c$http$body_data, data); 35 | c$http$body_length += length; 36 | } 37 | } 38 | } 39 | 40 | event http_request(c: connection, method: string, original_URI: string, unescaped_URI: string, version: string) 41 | { 42 | local ss: set[string] = extract_params_data(original_URI); 43 | 44 | if (! c$http?$params_data) 45 | { 46 | local tmp: set[string] = set(); 47 | c$http$params_data = tmp; 48 | } 49 | for (each in ss) 50 | { 51 | add c$http$params_data[each]; 52 | } 53 | } 54 | -------------------------------------------------------------------------------- /owasp/url_decoder.bro: -------------------------------------------------------------------------------- 1 | module HTTP; 2 | 3 | export { 4 | global url_decode: function(s: string, iterations: count): string; 5 | global url2char: table[string] of string = { 6 | ["%0A"]="\n", 7 | ["%0D"]="\r", 8 | ["%20"]=" ", 9 | ["%21"]="!", 10 | ["%22"]="\"", 11 | ["%23"]="#", 12 | ["%24"]="$", 13 | ["%25"]="%", 14 | ["%26"]="&", 15 | ["%27"]="'", 16 | ["%28"]="(", 17 | ["%29"]=")", 18 | ["%2A"]="*", 19 | ["%2B"]="+", 20 | ["%2C"]=",", 21 | ["%2D"]="-", 22 | ["%2E"]=".", 23 | ["%2F"]="/", 24 | ["%30"]="0", 25 | ["%31"]="1", 26 | ["%32"]="2", 27 | ["%33"]="3", 28 | ["%34"]="4", 29 | ["%35"]="5", 30 | ["%36"]="6", 31 | ["%37"]="7", 32 | ["%38"]="8", 33 | ["%39"]="9", 34 | ["%3A"]=":", 35 | ["%3B"]=";", 36 | ["%3C"]="<", 37 | ["%3D"]="=", 38 | ["%3E"]=">", 39 | ["%3F"]="?", 40 | ["%40"]="@", 41 | ["%41"]="A", 42 | ["%42"]="B", 43 | ["%43"]="C", 44 | ["%44"]="D", 45 | ["%45"]="E", 46 | ["%46"]="F", 47 | ["%47"]="G", 48 | ["%48"]="H", 49 | ["%49"]="I", 50 | ["%4A"]="J", 51 | ["%4B"]="K", 52 | ["%4C"]="L", 53 | ["%4D"]="M", 54 | ["%4E"]="N", 55 | ["%4F"]="O", 56 | ["%50"]="P", 57 | ["%51"]="Q", 58 | ["%52"]="R", 59 | ["%53"]="S", 60 | ["%54"]="T", 61 | ["%55"]="U", 62 | ["%56"]="V", 63 | ["%57"]="W", 64 | ["%58"]="X", 65 | ["%59"]="Y", 66 | ["%5A"]="Z", 67 | ["%5B"]="[", 68 | ["%5C"]="\\", 69 | ["%5D"]="]", 70 | ["%5E"]="^", 71 | ["%5F"]="_", 72 | ["%60"]="`", 73 | ["%61"]="a", 74 | ["%62"]="b", 75 | ["%63"]="c", 76 | ["%64"]="d", 77 | ["%65"]="e", 78 | ["%66"]="f", 79 | ["%67"]="g", 80 | ["%68"]="h", 81 | ["%69"]="i", 82 | ["%6A"]="j", 83 | ["%6B"]="k", 84 | ["%6C"]="l", 85 | ["%6D"]="m", 86 | ["%6E"]="n", 87 | ["%6F"]="o", 88 | ["%70"]="p", 89 | ["%71"]="q", 90 | ["%72"]="r", 91 | ["%73"]="s", 92 | ["%74"]="t", 93 | ["%75"]="u", 94 | ["%76"]="v", 95 | ["%77"]="w", 96 | ["%78"]="x", 97 | ["%79"]="y", 98 | ["%7A"]="z", 99 | ["%7B"]="{", 100 | ["%7C"]="|", 101 | ["%7D"]="}", 102 | ["%7E"]="~", 103 | # ["%7F"]="]", 104 | ["%80"]="`", 105 | # ["%81"]="", 106 | ["%82"]="‚", 107 | ["%83"]="ƒ", 108 | ["%84"]="„", 109 | ["%85"]="…", 110 | ["%86"]="†", 111 | ["%87"]="‡", 112 | ["%88"]="ˆ", 113 | ["%89"]="‰", 114 | ["%8A"]="Š", 115 | ["%8B"]="‹", 116 | ["%8C"]="Œ", 117 | # ["%8D"]="", 118 | ["%8E"]="Ž", 119 | # ["%8F"]="", 120 | # ["%90"]="", 121 | ["%91"]="‘", 122 | ["%92"]="’", 123 | ["%93"]="“", 124 | ["%94"]="”", 125 | ["%95"]="•", 126 | ["%96"]="–", 127 | ["%97"]="—", 128 | ["%98"]="˜", 129 | ["%99"]="™", 130 | ["%9A"]="š", 131 | ["%9B"]="›", 132 | ["%9C"]="œ", 133 | # ["%9D"]="", 134 | ["%9E"]="ž", 135 | ["%9F"]="Ÿ", 136 | # ["%A0"]="]", 137 | ["%A1"]="¡", 138 | ["%A2"]="¢", 139 | ["%A3"]="£", 140 | ["%A4"]="¤", 141 | ["%A5"]="¥", 142 | ["%A6"]="¦", 143 | ["%A7"]="§", 144 | ["%A8"]="¨", 145 | ["%A9"]="©", 146 | ["%AA"]="ª", 147 | ["%AB"]="«", 148 | ["%AC"]="¬", 149 | # ["%AD"]="]", 150 | ["%AE"]="®", 151 | ["%AF"]="¯", 152 | ["%B0"]="°", 153 | ["%B1"]="±", 154 | ["%B2"]="²", 155 | ["%B3"]="³", 156 | ["%B4"]="´", 157 | ["%B5"]="µ", 158 | ["%B6"]="¶", 159 | ["%B7"]="·", 160 | ["%B8"]="¸", 161 | ["%B9"]="¹", 162 | ["%BA"]="º", 163 | ["%BB"]="»", 164 | ["%BC"]="¼", 165 | ["%BD"]="½", 166 | ["%BE"]="¾", 167 | ["%BF"]="¿", 168 | ["%C0"]="À", 169 | ["%C1"]="Á", 170 | ["%C2"]="Â", 171 | ["%C3"]="Ã", 172 | ["%C4"]="Ä", 173 | ["%C5"]="Å", 174 | ["%C6"]="Æ", 175 | ["%C7"]="Ç", 176 | ["%C8"]="È", 177 | ["%C9"]="É", 178 | ["%CA"]="Ê", 179 | ["%CB"]="Ë", 180 | ["%CC"]="Ì", 181 | ["%CD"]="Í", 182 | ["%CE"]="Î", 183 | ["%CF"]="Ï", 184 | ["%D0"]="Ð", 185 | ["%D1"]="Ñ", 186 | ["%D2"]="Ò", 187 | ["%D3"]="Ó", 188 | ["%D4"]="Ô", 189 | ["%D5"]="Õ", 190 | ["%D6"]="Ö", 191 | ["%D7"]="×", 192 | ["%D8"]="Ø", 193 | ["%D9"]="Ù", 194 | ["%DA"]="Ú", 195 | ["%DB"]="Û", 196 | ["%DC"]="Ü", 197 | ["%DD"]="Ý", 198 | ["%DE"]="Þ", 199 | ["%DF"]="ß", 200 | ["%E0"]="à", 201 | ["%E1"]="á", 202 | ["%E2"]="â", 203 | ["%E3"]="ã", 204 | ["%E4"]="ä", 205 | ["%E5"]="å", 206 | ["%E6"]="æ", 207 | ["%E7"]="ç", 208 | ["%E8"]="è", 209 | ["%E9"]="é", 210 | ["%EA"]="ê", 211 | ["%EB"]="ë", 212 | ["%EC"]="ì", 213 | ["%ED"]="í", 214 | ["%EE"]="î", 215 | ["%EF"]="ï", 216 | ["%F0"]="ð", 217 | ["%F1"]="ñ", 218 | ["%F2"]="ò", 219 | ["%F3"]="ó", 220 | ["%F4"]="ô", 221 | ["%F5"]="õ", 222 | ["%F6"]="ö", 223 | ["%F7"]="÷", 224 | ["%F8"]="ø", 225 | ["%F9"]="ù", 226 | ["%FA"]="ú", 227 | ["%FB"]="û", 228 | ["%FC"]="ü", 229 | ["%FD"]="ý", 230 | ["%FE"]="þ", 231 | ["%FF"]="ÿ", 232 | }; 233 | } 234 | 235 | function url_decode(s: string, iterations: count &default=5): string 236 | { 237 | if ( (|find_all(s, /%/)| == 0) || (iterations <= 0) ) 238 | { 239 | return s; 240 | } 241 | 242 | local s2: string = s; 243 | 244 | for (each in find_all(s, /\%../)) 245 | { 246 | if (to_upper(each) in url2char) 247 | { 248 | s2 = subst_string(s2, each, url2char[to_upper(each)]); 249 | } 250 | } 251 | 252 | return url_decode(s2, iterations-1); 253 | } 254 | 255 | -------------------------------------------------------------------------------- /pcap_bro_es/pcap2bro2es.py: -------------------------------------------------------------------------------- 1 | # It would be nice to put this on a webserver and wrap it in a webUI 2 | # I'd like to have pcap upload ability 3 | # I'd love to see addBroScript called via checkboxes in a form (select the scripts you'd like to have run on your pcap) 4 | 5 | import os 6 | import glob 7 | import sys 8 | import hashlib 9 | import json 10 | import binascii 11 | import tempfile 12 | import shutil 13 | from elasticsearch import Elasticsearch 14 | 15 | def sumFile(f, block_size=2**20): 16 | sum = hashlib.sha256() 17 | while True: 18 | data = f.read(block_size) 19 | if not data: 20 | break 21 | sum.update(data) 22 | return sum.digest().encode("hex") 23 | 24 | class Pcap2Bro2Es: 25 | def __init__(self, pcap_name, bro_bin="/usr/local/bro/bin/bro"): 26 | self.working_dir = os.getcwd() 27 | self.temp_dir = tempfile.mkdtemp() 28 | self.pcap_name = pcap_name 29 | self.pcapf = open(pcap_name, 'rb') 30 | self.pcap_sum = sumFile(self.pcapf) 31 | self.bro_bin = bro_bin 32 | self.bro_cmd = self.bro_bin 33 | self.bro_scripts = [] 34 | self.bro_flags = [] 35 | 36 | def _tempDirCleaner(self): 37 | if self.temp_dir and os.path.exists(self.temp_dir): 38 | shutil.rmtree(self.temp_dir) 39 | os.chdir(self.working_dir) 40 | 41 | def logShits(self, msg): 42 | # Fixme 43 | print msg 44 | 45 | def addBroFlag(self, flag): 46 | self.bro_flags.append( flag ) 47 | 48 | def addBroScript(self, script_name): 49 | self.bro_scripts.append( script_name ) 50 | 51 | def buildBroCmd(self): 52 | # These flags and scripts are REQUIRED 53 | self.addBroFlag( ("-C", "") ) 54 | self.addBroFlag( ("-r", self.pcap_name) ) 55 | self.addBroScript("/usr/local/bro/share/bro/policy/tuning/json-logs.bro") 56 | for each_tuple in self.bro_flags: 57 | for each_flag in each_tuple: 58 | self.bro_cmd = self.bro_cmd + ' ' + each_flag 59 | for each_script in self.bro_scripts: 60 | self.bro_cmd = self.bro_cmd + ' ' + each_script 61 | 62 | def runBroCmd(self): 63 | os.chdir(self.temp_dir) 64 | if os.system(self.bro_cmd) != 0: 65 | self.logShits("system call to Bro binary failed") 66 | 67 | def indexBroLogs(self, es_index="bro_logs"): 68 | log_json = [] 69 | es = Elasticsearch() 70 | es_id = self.pcap_sum 71 | all_bro_logs = glob.glob('*.log') # we should still be in self.temp_dir 72 | for es_type in all_bro_logs: 73 | with open(es_type) as file: 74 | for each_line in file: 75 | try: 76 | log_json.append(json.loads(each_line)) 77 | except: 78 | self.logShits(".log file in temp_dir likely not JSON") 79 | es.index(index=es_index, doc_type=os.path.basename(es_type), id=es_id, body={'records':log_json}) 80 | # the best debugging is print pepper 81 | doc_url = "/" + es_index + "/" + os.path.basename(es_type) + "/" + es_id 82 | self.logShits("es document created at " + doc_url) 83 | self._tempDirCleaner() 84 | 85 | def go(self): 86 | self.buildBroCmd() 87 | self.runBroCmd() 88 | self.indexBroLogs() 89 | 90 | 91 | def main(): 92 | pcap_name = sys.argv[1] 93 | doit = Pcap2Bro2Es(pcap_name) 94 | doit.go() 95 | 96 | if __name__ == "__main__": 97 | main() 98 | -------------------------------------------------------------------------------- /protocol_confirmation_printer.bro: -------------------------------------------------------------------------------- 1 | ##! These events are deprecated 2 | 3 | # this script will print stuff when bro identifies the protocol used in a connection 4 | 5 | #@load policy/frameworks/dpd/detect-protocols 6 | #@load base/frameworks/dpd 7 | 8 | redef ignore_checksums = T; 9 | 10 | event protocol_violation(c: connection, atype: count, aid: count, reason: string) 11 | { 12 | # print atype; 13 | # print dpd_config[atype]; 14 | # print ( analyzer_name(aid) ); 15 | # print reason; 16 | } 17 | 18 | event protocol_confirmation(c: connection, atype: count, aid: count) 19 | { 20 | #print c; 21 | #print atype; 22 | #print ( analyzer_name(aid) ); 23 | } 24 | -------------------------------------------------------------------------------- /redirections/README.md: -------------------------------------------------------------------------------- 1 | Track chains of related DNS and HTTP 2 | ------------------------------------ 3 | this is useful for analyzing drive by compromises, but can also be used to troubleshoot HTTP redirects 4 | 5 | 6 | 7 | try running 8 | bro -Ci eth0 chains.bro 9 | 10 | then running 11 | wget google.com 12 | 13 | the wget command will cause 14 | - a dns request for google.com 15 | - an http 16 | - request to an IP with host: google.com 17 | - response stating host google.com is located at www.google.com 18 | - a dns request for www.google.com 19 | - an http request to an IP with host: www.google.com 20 | -------------------------------------------------------------------------------- /redirections/chains.bro: -------------------------------------------------------------------------------- 1 | 2 | # once my pull request for changes in base/utils/urls.bro is merged, this can be removed 3 | @load ./urls 4 | 5 | module Redirects; 6 | 7 | export { 8 | type http_pivot: record { 9 | uri: string; 10 | domain: string; 11 | uid: string; 12 | }; 13 | 14 | type dns_pivot: record { 15 | domain: string; 16 | uid: string; 17 | }; 18 | 19 | redef record connection += { 20 | dns_precede: dns_pivot &optional; 21 | http_precede: http_pivot &optional; 22 | }; 23 | 24 | redef record Conn::Info += { 25 | dns_domain: string &log &optional; 26 | dns_uid: string &log &optional; 27 | 28 | http_uri: string &optional &log; 29 | http_domain: string &optional &log; 30 | http_uid: string &optional &log; 31 | }; 32 | 33 | type dns_query_index: table[addr] of dns_pivot; 34 | global dns_cache: table[addr] of dns_query_index &create_expire=5secs; 35 | global http_location_cache: table[addr] of http_pivot &create_expire=5secs; 36 | 37 | # threshold for redirect chain length 38 | # 2 UIDs are needed to visit 1 webiste via dns+http, so you might consider dividing chain lengths by 2 39 | # 4 allows for a single redirect 40 | global max_chain_len: count = 2; 41 | 42 | # function to add uid links to chain table 43 | global add_uid_link: function(preceding_uid: string, subsequent_uid: string); 44 | 45 | # expire function for chains 46 | global check_chain_len: function(chains: table[string] of vector of string, chain: vector of string): interval; 47 | 48 | # table of chains indexed by last link in chain 49 | global chains: table[string] of vector of string &create_expire=15secs &expire_func=check_chain_len; 50 | } 51 | 52 | function check_chain_len(chains: table[string] of vector of string, chain: vector of string): interval 53 | { 54 | if (|chain| > max_chain_len) 55 | { 56 | # PANIC! (or raise a notice) 57 | print chain; 58 | } 59 | # do not wait any longer to expire the chain 60 | return 0secs; 61 | } 62 | 63 | function add_uid_link(preceding_uid: string, subsequent_uid: string) 64 | { 65 | if (preceding_uid in chains) 66 | { 67 | local idx: count = |chains[preceding_uid]|; 68 | chains[preceding_uid][idx] = subsequent_uid; 69 | chains[subsequent_uid] = chains[preceding_uid]; 70 | delete chains[preceding_uid]; 71 | 72 | ########## This should be removed ################################ 73 | if (|chains[subsequent_uid]| > max_chain_len) 74 | { 75 | # PANIC! (or raise a notice) 76 | print chains[subsequent_uid]; 77 | } 78 | ################################################################## 79 | 80 | } 81 | else 82 | { 83 | chains[subsequent_uid] = vector(preceding_uid, subsequent_uid); 84 | } 85 | } 86 | 87 | event dns_request(c: connection, msg: dns_msg, query: string, qtype: count, qclass: count) 88 | { 89 | if ( (qtype != 1) || (qclass != 1) || (c$id$orig_h !in http_location_cache) ) # not class IN or not type A 90 | { 91 | return; 92 | } 93 | c$http_precede=http_location_cache[c$id$orig_h]; 94 | add_uid_link(c$http_precede$uid, c$uid); 95 | } 96 | 97 | event dns_A_reply(c: connection, msg: dns_msg, ans: dns_answer, a: addr) 98 | { 99 | if (msg$num_answers < 1) 100 | { 101 | return; 102 | } 103 | 104 | local tmp_dns_query_index: dns_query_index; 105 | tmp_dns_query_index[c$id$orig_h] = [$domain=ans$query, $uid=c$uid]; 106 | dns_cache[a] = tmp_dns_query_index; 107 | } 108 | 109 | event http_header(c: connection, is_orig: bool, name: string, value: string) 110 | { 111 | if ( (is_orig) || (name != "LOCATION") ) 112 | { 113 | return; 114 | } 115 | http_location_cache[c$id$orig_h] = [$uri=value, $domain=decompose_uri(value)$netlocation, $uid=c$uid]; 116 | } 117 | 118 | event new_connection(c: connection) 119 | { 120 | if (c$id$resp_h !in dns_cache) 121 | { 122 | return; 123 | } 124 | 125 | if (c$id$orig_h !in dns_cache[c$id$resp_h]) 126 | { 127 | return; 128 | } 129 | else 130 | { 131 | c$dns_precede = [$uid=dns_cache[c$id$resp_h][c$id$orig_h]$uid, 132 | $domain = dns_cache[c$id$resp_h][c$id$orig_h]$domain]; 133 | add_uid_link(c$dns_precede$uid, c$uid); 134 | } 135 | } 136 | 137 | event connection_state_remove(c: connection) 138 | { 139 | if (c?$dns_precede) 140 | { 141 | c$conn$dns_domain = c$dns_precede$domain; 142 | c$conn$dns_uid = c$dns_precede$uid; 143 | } 144 | 145 | if (c?$http_precede) 146 | { 147 | c$conn$http_uri = c$http_precede$uri; 148 | c$conn$http_domain = c$http_precede$domain; 149 | c$conn$http_uid = c$http_precede$uid; 150 | } 151 | } 152 | -------------------------------------------------------------------------------- /redirections/urls.bro: -------------------------------------------------------------------------------- 1 | export { 2 | type uri: record { 3 | protocol: string &optional; 4 | # this could be a domain name or an IP address 5 | netlocation: string; 6 | portnum: count &optional; 7 | path: string &optional; 8 | file_name: string &optional; 9 | file_ext: string &optional; 10 | }; 11 | 12 | global decompose_uri: function(s: string): uri; 13 | } 14 | 15 | function decompose_uri(s: string): uri 16 | { 17 | local parts: string_array; 18 | local u: uri = [$netlocation=""]; 19 | 20 | if (/:\/\// in s) 21 | { 22 | parts = split1(s, /:\/\//); 23 | u$protocol = parts[1]; 24 | s = parts[2]; 25 | } 26 | if (/\// in s) 27 | { 28 | parts = split1(s, /\//); 29 | s = parts[1]; 30 | u$path = fmt("/%s", parts[2]); 31 | 32 | if (|u$path| > 1) 33 | { 34 | local last_token: string = find_last(u$path, /\/.+/); 35 | local full_filename = split1(last_token, /\//)[2]; 36 | if (/\./ in full_filename) 37 | { 38 | u$file_name = split1(full_filename, /\./)[1]; 39 | u$file_ext = split1(full_filename, /\./)[2]; 40 | u$path = subst_string(u$path, fmt("%s.%s", u$file_name, u$file_ext), ""); 41 | } 42 | else 43 | { 44 | u$file_name = full_filename; 45 | u$path = subst_string(u$path, u$file_name, ""); 46 | } 47 | } 48 | } 49 | if (/:/ in s) 50 | { 51 | parts = split1(s, /:/); 52 | u$netlocation = parts[1]; 53 | u$portnum = to_count(parts[2]); 54 | } 55 | else 56 | { 57 | u$netlocation = s; 58 | } 59 | 60 | return u; 61 | } 62 | -------------------------------------------------------------------------------- /rules/README.md: -------------------------------------------------------------------------------- 1 | Indicator Rules 2 | =============== 3 | Adding context and layering to intelligence indicators. This package is built on top of the Intel framework. See [here](http://www.bro.org/bro-exchange-2013/exercises/intel.html) for examples on using the intel framework. 4 | 5 | Description 6 | ----------- 7 | This package provides extensions for brogrammers to create complex conditional rules based on intelligence indicators. The ultimate goal of something like this would be a framework for context aware [yara](http://plusvic.github.io/yara)-like network rule sets. 8 | 9 | Usage 10 | ----- 11 | - create indicators (or use the provided ones in indicators.dat) 12 | - create rules based on the indicators (or use the ones provided) 13 | - rules can be read in from a file or added form scriptland similar to indicators 14 | - run Bro on an interface 15 | - cause network traffic that will match the indicators and conditions in your rules (or your rules' rules) 16 | - the included rules will match on 'wget www.google.com/foo' and 'wget www.google.com/bar' (depending on your version of wget) 17 | - look in the notice.log file for Intel::Rule_Match notes 18 | 19 | ToDo 20 | ---- 21 | - extend rules to support clustering (fraternities) 22 | - indicator metadata isn't distributed to workers, this could be problematic 23 | - consider placing indicator "hits" in hidden value of connection types (similar to how everything else is just dumping into a new connection value) 24 | - opposed to keeping a single central table (indicator_cache) 25 | - let each connection carry it's own indicator matches around? 26 | - support patterns in indicators 27 | - indicators as [substrings](http://www.bro.org/sphinx/scripts/base/bif/strings.bif.html#id-strstr) of meta.if_in value, not absolute value 28 | - this is most likely a rewrite to fully support patterns, not a simple add-on 29 | - given indicators and rules are logically seperate, consider ways to shadow indicators while distributing rules 30 | - can indicators be hidden from worker nodes somehow? 31 | -------------------------------------------------------------------------------- /rules/example_usage.bro: -------------------------------------------------------------------------------- 1 | # load the rules package 2 | @load ./rules 3 | 4 | # read in an intel file for indicators 5 | redef Intel::read_files += { 6 | fmt ("%s/indicators.dat", @DIR) 7 | }; 8 | 9 | # read in rules file for applying logic based on indicators 10 | redef Intel::read_rules_files += { 11 | fmt ("%s/rules.dat", @DIR) 12 | }; 13 | 14 | # rules can also be created in scriptland by calling the Intel::add_rule function 15 | #Intel::add_rule( [$rid="RID_1", $i_condition=Intel::AND, $iids=set("IID_1", "IID_5")] ); 16 | #Intel::add_rule( [$rid="RID_2", $i_condition=Intel::OR, $iids=set("IID_6", "IID_7")] ); 17 | #Intel::add_rule( [$rid="RID_3", $r_condition=Intel::AND, $rids=set("RID_1","RID_2")] ); 18 | 19 | -------------------------------------------------------------------------------- /rules/indicators.dat: -------------------------------------------------------------------------------- 1 | #fields indicator indicator_type meta.source meta.do_notice meta.if_in meta.iid 2 | www.google.com Intel::DOMAIN my_special_source F HTTP::IN_HOST_HEADER IID_1 3 | www.google.com Intel::DOMAIN my_special_source F DNS::IN_REQUEST IID_2 4 | www.cnn.com Intel::DOMAIN my_special_source F HTTP::IN_HOST_HEADER IID_3 5 | www.cnn.com Intel::DOMAIN my_special_source F DNS::IN_REQUEST IID_4 6 | # 7 | Wget/1.13.4 (linux-gnu) Intel::SOFTWARE my_special_source F HTTP::IN_USER_AGENT_HEADER IID_5 8 | # 9 | /foo Intel::URL_PATH my_special_source F HTTP::IN_URL_PATH IID_6 10 | /bar Intel::URL_PATH my_special_source F HTTP::IN_URL_PATH IID_7 11 | # 12 | 200 Intel::RETURN_CODE my_special_source F HTTP::IN_STATUS_CODE HTTP_200 13 | 302 Intel::RETURN_CODE my_special_source F HTTP::IN_STATUS_CODE HTTP_302 14 | 404 Intel::RETURN_CODE my_special_source F HTTP::IN_STATUS_CODE HTTP_404 15 | 500 Intel::RETURN_CODE my_special_source F HTTP::IN_STATUS_CODE HTTP_500 16 | -------------------------------------------------------------------------------- /rules/rules.dat: -------------------------------------------------------------------------------- 1 | #fields rid i_condition iids rids r_condition do_rules_notice 2 | RID_1 Intel::AND IID_1,IID_5,HTTP_404 - - F 3 | RID_2 Intel::OR IID_6,IID_7 RID_1 Intel::OR T 4 | -------------------------------------------------------------------------------- /rules/rules/__load__.bro: -------------------------------------------------------------------------------- 1 | @load frameworks/intel/seen 2 | @load frameworks/intel/do_notice 3 | @load ./main 4 | @load ./input 5 | @load ./seen 6 | -------------------------------------------------------------------------------- /rules/rules/input.bro: -------------------------------------------------------------------------------- 1 | @load ./main 2 | 3 | # copied and repurposed from base/frameworks/intel/input.bro 4 | 5 | module Intel; 6 | 7 | export { 8 | ## Intelligence rules files that will be read off disk. The files are 9 | ## reread every time they are updated so updates must be atomic with 10 | ## "mv" instead of writing the file in place. 11 | const read_rules_files: set[string] = {} &redef; 12 | } 13 | 14 | event Intel::read_rule_entry(desc: Input::EventDescription, tpe: Input::Event, r: Intel::Rule) 15 | { 16 | Intel::add_rule(r); 17 | } 18 | 19 | event bro_init() &priority=5 20 | { 21 | if ( ! Cluster::is_enabled() || 22 | Cluster::local_node_type() == Cluster::MANAGER ) 23 | { 24 | for ( a_file in read_rules_files ) 25 | { 26 | Input::add_event([$source=a_file, 27 | $reader=Input::READER_ASCII, 28 | $mode=Input::REREAD, 29 | $name=cat("intel_rules-", a_file), 30 | $fields=Intel::Rule, 31 | $ev=Intel::read_rule_entry]); 32 | } 33 | } 34 | } 35 | 36 | -------------------------------------------------------------------------------- /rules/rules/main.bro: -------------------------------------------------------------------------------- 1 | module Intel; 2 | export { 3 | 4 | redef enum Notice::Type += { Intel::Rule_Notice }; 5 | 6 | # a condition to apply to multiple indicators/items 7 | type Condition: enum { 8 | # At least one of the indicators were seen 9 | OR, 10 | # All the indicators were seen 11 | AND, 12 | # None of the indicators were seen 13 | # CAUTION: USE AT YOUR OWN RISK 14 | # creating rules with a condition of NONE has the potentional to match many things, store a lot of state, and generate many notices 15 | NONE, 16 | # Exactly one of the indicators were seen 17 | XOR, 18 | }; 19 | 20 | type Rule: record { 21 | # condition to apply to included indicators 22 | i_condition: Condition &default=OR; 23 | # set of indicators to monitor for 24 | iids: set[string] &default=set(); 25 | # rule identification string 26 | rid: string; 27 | # set of rules to monitor for 28 | rids: set[string] &default=set(); 29 | # condition to apply to included rules 30 | r_condition: Condition &default=OR; 31 | # do you want to get notices about this rule firing? 32 | do_rules_notice: bool &default=F; 33 | }; 34 | 35 | redef record Intel::MetaData += { 36 | # indicator identification string 37 | iid: string &optional; 38 | }; 39 | 40 | # interface to add rules to check for 41 | # to update a rule, simply re-add it 42 | global add_rule: function(r: Rule); 43 | 44 | # interface to remove rules 45 | global delete_rule: function(r: Rule); 46 | } 47 | 48 | # Rule indxed by rid, rid=>[Rule] 49 | global indicator_rules: table[string] of Rule &redef; 50 | 51 | # set of indicators indexed by connection UID, uid=>[iid, iid, iid] 52 | global indicator_cache: table[string] of set[string] &redef; 53 | 54 | function add_rule(r: Intel::Rule) 55 | { 56 | Intel::indicator_rules[r$rid] = r; 57 | } 58 | 59 | function delete_rule(r: Intel::Rule) 60 | { 61 | delete Intel::indicator_rules[r$rid]; 62 | } 63 | 64 | event Intel::match(s: Seen, items: set[Item]) &priority=-2 65 | { 66 | for (each_item in items) 67 | { 68 | if (! each_item$meta?$if_in || s$where == each_item$meta$if_in) 69 | { 70 | # consider indexing items in the Intel::indicator_cache by something other than connection UID. perhaps by host? 71 | if (s$conn$uid in Intel::indicator_cache) 72 | { 73 | add Intel::indicator_cache[s$conn$uid][each_item$meta$iid]; 74 | } else { 75 | Intel::indicator_cache[s$conn$uid] = set(each_item$meta$iid); 76 | } 77 | } 78 | } 79 | } 80 | 81 | # given a connection and a rule, check if the connection matches the rule's indicators and condition 82 | function Intel::check_indicator_logic(r: Rule, c: connection): bool 83 | { 84 | switch (r$i_condition) 85 | { 86 | case OR: 87 | for (each_iid in r$iids) 88 | { 89 | if (each_iid in indicator_cache[c$uid]) 90 | { 91 | return T; 92 | break; 93 | } 94 | } 95 | break; 96 | 97 | case AND: 98 | for (each_iid in r$iids) 99 | { 100 | if (each_iid !in indicator_cache[c$uid]) 101 | { 102 | return F; 103 | } 104 | } 105 | return T; 106 | break; 107 | 108 | case NONE: 109 | local none_iid_match: bool = T; 110 | for (each_iid in r$iids) 111 | { 112 | if (each_iid in indicator_cache[c$uid]) 113 | { 114 | none_iid_match = F; 115 | break; 116 | } 117 | } 118 | if (none_iid_match) 119 | { 120 | return T; 121 | } 122 | break; 123 | 124 | case XOR: 125 | local one_iid_match: bool = F; 126 | for (each_iid in r$iids) 127 | { 128 | if (each_iid in indicator_cache[c$uid]) 129 | { 130 | if (one_iid_match) 131 | { 132 | one_iid_match = F; 133 | break; 134 | } 135 | one_iid_match = T; 136 | } 137 | } 138 | if (one_iid_match) 139 | { 140 | return T; 141 | } 142 | break; 143 | 144 | } 145 | 146 | return F; 147 | } 148 | 149 | # given a connection and a nested rule, check if the connection matches the rule's rules and condition 150 | function Intel::check_rule_logic(r: Rule, c: connection): bool 151 | { 152 | 153 | switch (r$r_condition) 154 | { 155 | case OR: 156 | for (each_rid in r$rids) 157 | { 158 | if ( check_indicator_logic(indicator_rules[each_rid], c) ) 159 | { 160 | return T; 161 | break; 162 | } 163 | } 164 | break; 165 | 166 | case AND: 167 | for (each_rid in r$rids) 168 | { 169 | if (! check_indicator_logic(indicator_rules[each_rid], c) ) 170 | { 171 | return F; 172 | break; 173 | } 174 | } 175 | return T; 176 | break; 177 | 178 | case NONE: 179 | local none_rid_match: bool = T; 180 | for (each_rid in r$rids) 181 | { 182 | if ( check_indicator_logic(indicator_rules[each_rid], c) ) 183 | { 184 | none_rid_match = F; 185 | break; 186 | } 187 | } 188 | if (none_rid_match) 189 | { 190 | return T; 191 | } 192 | break; 193 | 194 | case XOR: 195 | local one_rid_match: bool = F; 196 | for (each_rid in r$rids) 197 | { 198 | if ( check_indicator_logic(indicator_rules[each_rid], c) ) 199 | { 200 | if (one_rid_match) 201 | { 202 | one_rid_match = F; 203 | break; 204 | } 205 | one_rid_match = T; 206 | } 207 | } 208 | if (one_rid_match) 209 | { 210 | return T; 211 | } 212 | break; 213 | 214 | } 215 | 216 | return F; 217 | 218 | } 219 | 220 | event connection_state_remove(c: connection) 221 | { 222 | if (c$uid !in Intel::indicator_cache) return; 223 | 224 | for (r in Intel::indicator_rules) 225 | { 226 | # If the rule consists of a set of indicators and no nested rules 227 | if ( (|Intel::indicator_rules[r]$rids| == 0) && (|Intel::indicator_rules[r]$iids| > 0) ) 228 | { 229 | # check it's indicator logic and notice 230 | if ( check_indicator_logic(Intel::indicator_rules[r], c) ) 231 | { 232 | if (Intel::indicator_rules[r]$do_rules_notice) NOTICE( [$note=Intel::Rule_Notice, $conn=c, $msg=fmt("matched on rule: %s", Intel::indicator_rules[r]$rid)] ); 233 | } 234 | } 235 | 236 | # If the rule consists of nested rules and no indicators 237 | else if ( (|Intel::indicator_rules[r]$rids| > 0) && (|Intel::indicator_rules[r]$iids| == 0) ) 238 | { 239 | # check it's rule logic and notice 240 | if ( check_rule_logic(Intel::indicator_rules[r], c) ) 241 | { 242 | if (Intel::indicator_rules[r]$do_rules_notice) NOTICE( [$note=Intel::Rule_Notice, $conn=c, $msg=fmt("matched on rule: %s", Intel::indicator_rules[r]$rid)] ); 243 | } 244 | } 245 | 246 | # If the rule consists of nested rules and indicators 247 | else if ( (|Intel::indicator_rules[r]$rids| > 0) && (|Intel::indicator_rules[r]$iids| > 0) ) 248 | { 249 | # check it's indicator logic and it's rule logic, then notice 250 | if ( (check_indicator_logic(Intel::indicator_rules[r], c)) && (check_rule_logic(Intel::indicator_rules[r], c)) ) 251 | { 252 | if (Intel::indicator_rules[r]$do_rules_notice) NOTICE( [$note=Intel::Rule_Notice, $conn=c, $msg=fmt("matched on rule: %s", Intel::indicator_rules[r]$rid)] ); 253 | } 254 | } 255 | 256 | # If the rule consists of no nested rules and no indicators 257 | else 258 | { 259 | # there's nothing to do and keeping the rule is a waste 260 | Intel::delete_rule(Intel::indicator_rules[r]); 261 | } 262 | 263 | } 264 | 265 | # when a connection expires, so do all the Intel::match hits that went with it 266 | delete Intel::indicator_cache[c$uid]; 267 | } 268 | -------------------------------------------------------------------------------- /rules/rules/seen/__load__.bro: -------------------------------------------------------------------------------- 1 | @load ./http-url-path 2 | @load ./http-status 3 | -------------------------------------------------------------------------------- /rules/rules/seen/http-status.bro: -------------------------------------------------------------------------------- 1 | @load base/frameworks/intel 2 | @load ./where-locations 3 | 4 | event http_reply(c: connection, version: string, code: count, reason: string) 5 | { 6 | Intel::seen([$indicator=fmt("%d", code), 7 | $indicator_type=Intel::RETURN_CODE, 8 | $conn=c, 9 | $where=HTTP::IN_STATUS_CODE]); 10 | } 11 | -------------------------------------------------------------------------------- /rules/rules/seen/http-url-path.bro: -------------------------------------------------------------------------------- 1 | @load base/frameworks/intel 2 | @load base/protocols/http/utils 3 | @load ./where-locations 4 | 5 | event http_message_done(c: connection, is_orig: bool, stat: http_message_stat) 6 | { 7 | if ( is_orig && c?$http && c$http?$uri ) 8 | Intel::seen([$indicator=c$http$uri, 9 | $indicator_type=Intel::URL_PATH, 10 | $conn=c, 11 | $where=HTTP::IN_URL_PATH]); 12 | } 13 | -------------------------------------------------------------------------------- /rules/rules/seen/where-locations.bro: -------------------------------------------------------------------------------- 1 | @load base/frameworks/intel 2 | 3 | export { 4 | redef enum Intel::Where += { 5 | HTTP::IN_URL_PATH, 6 | HTTP::IN_STATUS_CODE, 7 | }; 8 | 9 | redef enum Intel::Type += { 10 | Intel::URL_PATH, 11 | Intel::RETURN_CODE, 12 | }; 13 | } 14 | -------------------------------------------------------------------------------- /scriptland_analyzers/raw.bro: -------------------------------------------------------------------------------- 1 | ## CAUTION: This script is meant for analyzing trace files and can be harmful if ran on live networks. 2 | ## Working with the tcp_contents event can be expensive. 3 | # 4 | 5 | module Raw; 6 | 7 | export { 8 | 9 | type Info: record { 10 | orig_tcp_data: string &default=""; 11 | resp_tcp_data: string &default=""; 12 | }; 13 | } 14 | 15 | redef tcp_content_deliver_all_orig = T; 16 | redef tcp_content_deliver_all_resp = T; 17 | 18 | redef record connection += { 19 | raw: Info &optional; 20 | }; 21 | 22 | event tcp_contents(c: connection, is_orig: bool, seq: count, contents: string) 23 | { 24 | if (! c?$raw) 25 | { 26 | local tmp: Raw::Info; 27 | c$raw = tmp; 28 | } 29 | # contents values are the same data that is passed on to protocol analyzers internally in Bro's core 30 | # scriptland protocol analyzers can hook in here 31 | if (is_orig) 32 | { 33 | c$raw$orig_tcp_data = fmt("%s%s", c$raw$orig_tcp_data, contents); 34 | } else 35 | { 36 | c$raw$resp_tcp_data = fmt("%s%s", c$raw$resp_tcp_data, contents); 37 | } 38 | } 39 | -------------------------------------------------------------------------------- /scriptland_analyzers/scriptland_http_analyzer.bro: -------------------------------------------------------------------------------- 1 | @load ./raw 2 | 3 | module Analyzer; 4 | 5 | export { 6 | global session_taster: function(c: connection, is_orig: bool); 7 | 8 | # these regexes are lame, don't trust them 9 | global orig_check: pattern = /.*HTTP/; 10 | global resp_check: pattern = /.*HTTP/; 11 | } 12 | 13 | function session_taster(c: connection, is_orig: bool) 14 | { 15 | if (is_orig) 16 | { 17 | if (Analyzer::orig_check in c$raw$orig_tcp_data) 18 | { 19 | print "ORIG HTTP"; 20 | } 21 | } else 22 | { 23 | if (Analyzer::resp_check in c$raw$resp_tcp_data) 24 | { 25 | print "RESP HTTP"; 26 | } 27 | } 28 | } 29 | 30 | 31 | event connection_state_remove(c: connection) 32 | { 33 | if (c$conn$proto == tcp) 34 | { 35 | if (|c$raw$orig_tcp_data| > 0) 36 | { 37 | Analyzer::session_taster(c, T); 38 | } 39 | if (|c$raw$resp_tcp_data| > 0) 40 | { 41 | Analyzer::session_taster(c, F); 42 | } 43 | } 44 | } 45 | 46 | -------------------------------------------------------------------------------- /setup.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | # This script is meant to be a single button to push to get Bro set up and running on a Debian system. 3 | 4 | ################################################### 5 | # SET THESE VARS TO CHANGE SCRIPT DEFAULT BEHAVIOR 6 | # THEN DON'T TOUCH ANYTHING ELSE 7 | # 8 | LOG_FILE="setup.log"; 9 | PREFIX="/opt/bro"; 10 | WANT_GEOIP="Y"; 11 | WHICH_CMD="/usr/bin/which"; 12 | # 13 | ################################################### 14 | 15 | DEPENDS="git cmake make gcc g++ flex bison libpcap-dev libssl-dev python-dev swig zlib1g-dev libmagic-dev libgeoip-dev sendmail libcap2-bin libcurl3-dev wget gzip"; 16 | 17 | # Lazy command path location 18 | SETCAP_CMD=$( ${WHICH_CMD} setcap ); 19 | D_CMD=$( ${WHICH_CMD} dpkg-query ); 20 | 21 | # use aptitude if available, apt-get if not 22 | APT_CHECK=$(${D_CMD} -W --showformat='${Status}\n' aptitude | grep 'install ok installed'); 23 | if [[ ${APT_CHECK} = "install ok installed" ]] 24 | then 25 | APT_CMD=$( which aptitude ); 26 | else 27 | APT_CMD=$( which apt-get ); 28 | fi 29 | 30 | function log_it { 31 | echo "$(date +%s) : ${1}" >> ${LOG_FILE}; 32 | } 33 | 34 | function depends { 35 | ${APT_CMD} install -y ${DEPENDS}; 36 | log_it "dependencies installed"; 37 | } 38 | 39 | function geo_ip_stuff { 40 | ${WGET_CMD} http://geolite.maxmind.com/download/geoip/database/GeoLiteCity.dat.gz; 41 | ${GZIP_CMD} -d GeoLiteCity.dat.gz; 42 | mv GeoLiteCity.dat /usr/share/GeoIP/GeoIPCity.dat; 43 | ${WGET_CMD} http://download.maxmind.com/download/geoip/database/asnum/GeoIPASNum.dat.gz; 44 | ${GZIP_CMD} -d GeoIPASNum.dat.gz; 45 | mv GeoIPASNum.dat /usr/share/GeoIP/GeoIPASNum.dat; 46 | export CFLAGS=-I/usr/local/include; 47 | export LDFLAGS=-L/usr/local/lib; 48 | log_it "geoIP stuff installed"; 49 | } 50 | 51 | function bro_install { 52 | ${GIT_CMD} clone --recursive https://github.com/bro/bro.git; 53 | if [ ! -d ${PREFEXI} ] 54 | then 55 | mkdir -p ${PREFIX}; 56 | fi 57 | cd bro; 58 | ./configure --prefix=${PREFIX}; 59 | make && make install; 60 | log_it "bro installed at ${PREFIX}"; 61 | } 62 | 63 | function make_nice { 64 | ${SETCAP_CMD} cap_net_raw,cap_net_admin=eip ${PREFIX}/bin/bro; 65 | export PATH=${PATH}:${PREFIX}/bin; 66 | 67 | ${GIT_CMD} clone git://github.com/mephux/bro.vim.git; 68 | if [ ! -d ~/.vim/syntax ] 69 | then 70 | mkdir -p ~/.vim/syntax; 71 | fi 72 | if [ ! -d ~/.vim/ftdetect ] 73 | then 74 | mkdir -p ~/.vim/ftdetect; 75 | fi 76 | cp -R bro.vim/syntax/* ~/.vim/syntax/; 77 | cp -R bro.vim/ftdetect/* ~/.vim/ftdetect/; 78 | rm -rf bro.vim; 79 | log_it "environment made nice"; 80 | } 81 | 82 | depends; 83 | WGET_CMD=$( ${WHICH_CMD} wget ); 84 | GZIP_CMD=$( ${WHICH_CMD} gzip ); 85 | GIT_CMD=$( ${WHICH_CMD} git ); 86 | if [[ ${WANT_GEOIP} = "Y" ]] 87 | then 88 | geo_ip_stuff; 89 | fi 90 | bro_install; 91 | make_nice; 92 | 93 | echo "Setup finished. Check ${LOG_FILE} for details."; 94 | -------------------------------------------------------------------------------- /star_wars_greetings.bro: -------------------------------------------------------------------------------- 1 | # inspired by chapter 7 of O'Reilly's Intermediate Perl 2 | # no need to specify an interface when running this script 3 | 4 | # declar a new type 'greeting' of base type function 5 | type greeting: function(name: string): string; 6 | 7 | # define all characters in the plot 8 | global characters: set[string] = { 9 | "Han Brolo", 10 | "Broba Fett", 11 | "Admiral Ackbro", 12 | "C3PBro", 13 | }; 14 | 15 | # declare the room all characters will enter into 16 | global room: set[string] = {}; 17 | 18 | # define a table containing a greeting type for each character 19 | global greets: table[string] of greeting = { 20 | ["Han Brolo"] = function(name: string): string 21 | { 22 | if (name == "Admiral Ackbro") 23 | { 24 | return "Han Brolo: It's not a trap, Ackbro."; 25 | } else if (name == "Broba Fett") 26 | { 27 | return "Han Brolo: Taste my laser, Fett."; 28 | } else 29 | { 30 | return fmt("Han Brolo: Heya, %s", name); 31 | } 32 | }, 33 | ["Broba Fett"] = function(name: string): string 34 | { 35 | if (name == "Admiral Ackbro") 36 | { 37 | return "Broba Fett: It's not a trap, Ackbro."; 38 | } else if (name == "Han Brolo") 39 | { 40 | return fmt ("Broba Fett: How's that carbon freeze, %s?", name); 41 | } else 42 | { 43 | return "Broba Fett: ..."; 44 | } 45 | }, 46 | ["Admiral Ackbro"]= function(name: string): string 47 | { 48 | return "Admir Ackbro: It's a TRAP!"; 49 | }, 50 | ["C3PBro"] = function(name: string): string 51 | { 52 | return fmt("C3PBro: Greetings, %s", name); 53 | }, 54 | }; 55 | 56 | # have each character enter the room and greet one another 57 | for (person_entering in characters) 58 | { 59 | print ""; 60 | print fmt("%s enters the room.", person_entering); 61 | 62 | for (person_there in room) 63 | { 64 | print greets[person_entering](person_there); 65 | print greets[person_there](person_entering); 66 | } 67 | 68 | add room[person_entering]; 69 | } 70 | -------------------------------------------------------------------------------- /terminate_from_scriptland.bro: -------------------------------------------------------------------------------- 1 | redef exit_only_after_terminate = T; 2 | 3 | function custom_bro_done() 4 | { 5 | print "custom_bro_done"; 6 | terminate(); 7 | } 8 | 9 | bro_init() 10 | { 11 | print "bro_init"; 12 | custom_bro_done(); 13 | } 14 | 15 | event bro_done() 16 | { 17 | print "bro_done"; 18 | } 19 | -------------------------------------------------------------------------------- /top_cc/README.md: -------------------------------------------------------------------------------- 1 | Top Country Code 2 | ================ 3 | This code is meant to provide examples on how to use the top k data type. It also shows how an event can schedule itself to create a control flow similar to a while loop combined with a sleep command. 4 | 5 | Description 6 | ----------- 7 | **pinger.py** sends FIN+ACK packets to random IP addresses from an RFC1918 address. 8 | **topc_cc.bro** draws a rudimentary graph for the top K countries sent packets. 9 | 10 | Requirements 11 | ------------ 12 | - The Scapy Python module 13 | - GeoIP enabled Bro 14 | 15 | Usage 16 | ----- 17 | 18 | sudo python pinger.py 19 | sudo bro -i ethX top_cc.bro 20 | 21 | If Bro complains about checksums in the above command, run it with the -C option. 22 | -------------------------------------------------------------------------------- /top_cc/pinger.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/python 2 | 3 | from scapy.all import * 4 | import random 5 | import time 6 | 7 | src_ip_addr = "10.0.0.1" 8 | destp = 80 9 | srcp = 25252 10 | 11 | while (1): 12 | o1 = str( random.randint(1,255) ) 13 | o2 = str( random.randint(1,255) ) 14 | o3 = str( random.randint(1,255) ) 15 | o4 = str( random.randint(1,255) ) 16 | 17 | dst_ip_addr = o1 + "." + o2 + "." + o3 + "." + o4 18 | 19 | print "sending FA to", dst_ip_addr, ":", destp, "from", src_ip_addr, ":", srcp 20 | pkt = IP(dst=dst_ip_addr, src=src_ip_addr)/TCP(dport=destp, sport=srcp, flags="FA") 21 | send(pkt) 22 | time.sleep(1) 23 | -------------------------------------------------------------------------------- /top_cc/top_cc.bro: -------------------------------------------------------------------------------- 1 | module TopCC; 2 | 3 | export { 4 | # how many countries to count in topX 5 | global top_cc_count: count = 10; 6 | 7 | # the topk object used to track everything 8 | global top_cc: opaque of topk = topk_init( top_cc_count ); 9 | 10 | # how frequenty we should check for new connections and redraw graph 11 | global draw_freq: interval = 5secs; 12 | 13 | # internal counter used to check if topk object has new connection (thus causing a redraw) 14 | global top_cc_sum: count = 0; 15 | } 16 | 17 | event draw() 18 | { 19 | # each draw() event schedules the next draw() event 20 | schedule draw_freq { draw() }; 21 | 22 | if (topk_sum(top_cc) == top_cc_sum) 23 | return; 24 | 25 | local c_list: vector of string = topk_get_top(TopCC::top_cc, top_cc_count); 26 | 27 | print "============================================================="; 28 | for (each in c_list) 29 | { 30 | local tkc: count = topk_count(top_cc, c_list[each]); 31 | print fmt("%s: %s", c_list[each], sub( string_fill( tkc+1, "*"), /\0/, "") ); 32 | } 33 | 34 | top_cc_sum = topk_sum(top_cc); 35 | } 36 | 37 | event bro_init() 38 | { 39 | # schedule the first draw() 40 | schedule draw_freq { draw() }; 41 | } 42 | 43 | event new_connection(c: connection) 44 | { 45 | if ( c?$id && c$id?$resp_h ) 46 | { 47 | local g: geo_location = lookup_location(c$id$resp_h); 48 | if (g?$country_code) 49 | { 50 | topk_add(TopCC::top_cc, g$country_code); 51 | } 52 | } 53 | 54 | } 55 | 56 | event bro_done() 57 | { 58 | local c_list: vector of string = topk_get_top(TopCC::top_cc, top_cc_count); 59 | for (each in c_list) 60 | { 61 | print fmt("%s => %d", c_list[each], topk_count(top_cc, c_list[each]) ); 62 | } 63 | 64 | print topk_sum(top_cc); 65 | } 66 | -------------------------------------------------------------------------------- /txbaseline/README.md: -------------------------------------------------------------------------------- 1 | Tx Baseline 2 | =========== 3 | This code is meant to provide examples on how to use the SumStats framework. The script will determine the total amount of bytes each host sends per day and the average amount of bytes each host sends per week. The script is configured to use minutes instead of days for illustation. 4 | 5 | Usage 6 | ----- 7 | sudo bro -i ethX txbaseline.bro 8 | 9 | If Bro complains about checksums in the above comand, run it with the -C option. The SumStats framework like to see traffic, so feed it some by pinging a few things while running this script. 10 | 11 | ToDo 12 | ---- 13 | - Determine how to incorporate the STD_DEV plugin to determine if a host has sent an abnormal (more than one standard deviation) amount of traffic compared to similar days of the week in the year. How many bytes does this IP address normally send on a Wednesday? Is this IP sending more or less than usual or an acceptable deviation? 14 | -------------------------------------------------------------------------------- /txbaseline/txbaseline.bro: -------------------------------------------------------------------------------- 1 | @load base/frameworks/notice 2 | @load base/frameworks/sumstats 3 | 4 | redef use_conn_size_analyzer = T; 5 | 6 | module TxBaseline; 7 | export { 8 | # redef enum Notice::Type += { 9 | # Too_much, 10 | # Too_little, 11 | # }; 12 | 13 | # alter these intervals from minutess to days 14 | const tx_summer_interval = 1mins &redef; 15 | const tx_aver_interval = 7mins &redef; 16 | 17 | const week: vector of string = {"Monday", "Tuesday", "Wednesday", "Thursday", "Friday", "Saturday", "Sunday"}; 18 | global day_of_week: count = 6; 19 | global week_of_year: count = 0; 20 | 21 | # const tx_threshold = 0.0 &redef; 22 | } 23 | 24 | 25 | event bro_init() &priority=5 26 | { 27 | local r1: SumStats::Reducer = [$stream="tx_summer", $apply=set(SumStats::SUM)]; 28 | local r2: SumStats::Reducer = [$stream="tx_aver", $apply=set(SumStats::AVERAGE)]; 29 | # local r3: SumStats::Reducer = [$stream="tx_stder", $apply=set(SumStats::STD_DEV)]; 30 | 31 | SumStats::create( [$name="tx_aver", 32 | $epoch=tx_aver_interval, 33 | $reducers=set(r2), 34 | $epoch_result(ts: time, key: SumStats::Key, result: SumStats::Result) = 35 | { 36 | local r = result["tx_aver"]; 37 | print fmt("%s sent a weekly average of %f bytes. It is week %d", key$host, r$average, week_of_year); 38 | }, 39 | $epoch_finished(ts: time) = 40 | { 41 | if (TxBaseline::week_of_year == 52) 42 | { 43 | TxBaseline::week_of_year = 0; 44 | return; 45 | } 46 | TxBaseline::week_of_year += 1; 47 | } 48 | ] ); 49 | 50 | SumStats::create( [$name="tx_summer", 51 | $epoch=tx_summer_interval, 52 | $reducers=set(r1), 53 | $epoch_result(ts: time, key: SumStats::Key, result: SumStats::Result) = 54 | { 55 | local r = result["tx_summer"]; 56 | print fmt("%s sent a sum of %f bytes. Today is %s", key$host, r$sum, week[day_of_week] ); 57 | SumStats::observe( "tx_aver", [$host=key$host], [$dbl=r$sum] ); 58 | }, 59 | $epoch_finished(ts: time) = 60 | { 61 | if (TxBaseline::day_of_week == 6) 62 | { 63 | TxBaseline::day_of_week = 0; 64 | return; 65 | } 66 | TxBaseline::day_of_week += 1; 67 | } 68 | ] ); 69 | } 70 | 71 | event connection_state_remove(c: connection) 72 | { 73 | SumStats::observe( "tx_summer", [$host=c$id$orig_h], [$num=c$orig$num_bytes_ip] ); 74 | } 75 | 76 | --------------------------------------------------------------------------------