title: Grabbing URLs from Sanitized URLs
body: <p>A notification service we were using over the last couple of months suddenly started to sanitize their URL inputs.</p>
  
  <p>However, what we were doing as typical operational work is to put this email through a regex filter on notepad++ grab the URLs and send them to a data analyzer like Splunk.</p>
  
  <p>This is my old regex:</p>
  
  <pre><code>hxxps?://.+-?.?\.\w+/
  </code></pre>
  
  <p>Which used to work since their previous sanization method was changing the http/s for hxxp/s.</p>
  
  <p>And I would have a list of the URLs</p>
  
  <pre><code>new 4 (15 hits)
      Line 3: * Payload delivery/url               : hxxp://gxxx.by/
      Line 14: * Payload delivery/url               : hxxp://dawdas.cm/
      Line 15: * Payload delivery/url               : hxxp://dawfafa.ru/
      Line 16: * Payload delivery/url               : hxxp://dwasa-da.fr/
      Line 17: * Payload delivery/url               : hxxp://hdawwwwffa.com/
  </code></pre>
  
  <p>But now the URLs were changed to this:</p>
  
  <pre><code>new 4 (15 hits)
      Line 3: * Payload delivery/url               : hxxp://gxxx[.]by/
      Line 14: * Payload delivery/url               : hxxp://dawdas[.]cm/
      Line 15: * Payload delivery/url               : hxxp://dawfafa[.]ru/
      Line 16: * Payload delivery/url               : hxxp://dwasa-da[.]fr/
      Line 17: * Payload delivery/url               : hxxp://hdawwwwffa[.]com/
  </code></pre>
  
  <p>I am just wondering if there is a way to parse through this with Notepad++ or do I need to use bash which is part of another project, but for now we want to do it as a quick operational task.</p>