##############################################################################
## Rules for data extraction
##############################################################################
# Skimmers
Extract-Skimmer Gate: \" \"
Extract-Skimmer screen-obj\",\s?\" \"\)
Extract-Skimmer atob\(" "\);
Extract-Skimmer src=atob\(\" \"\)
Extract-Skimmer img.src = window.atob\(\" \"\)
Extract-Skimmer \\x68\\x74\\x74\\x70\\x73\\x3[aA]\\x2[fF]\\x2[fF] ((\"|'),(\"|')|\\x22)
Extract-Skimmer \\x43\\x68\\x61\\x72\\x43\\x6[fF]\\x64\\x65\\x28 \\x29
Extract-Skimmer var __zz ?= ?' '
Extract-Skimmer \\x61\\x48\\x52\\x30\\x63\\x48\\x4[dD]\\x36 \\x4[cC]\\x32\\x6[cC]\\x74\\x5[aA]\\x77
Extract-Skimmer var url = ' &host
Extract-Skimmer \(window,document,' ','script','Y2hlY2tvdXQ='
Extract-Skimmer \\x55\\x52\\x4[cC]"," \\x3[fF]
Extract-Skimmer \\x55\\x52\\x4C"," \\x2E\\x70\\x68\\x70
Extract-Skimmer "\\x55\\x52\\x4C"," \\x76\\x61\\x6C\\x69\\x64\\x61\\x74\\x65\\x2E\\x70\\x68\\x70
Extract-Skimmer "\\x61\\x70\\x70\\x65\\x6E\\x64"," ","\\x50\\x4F\\x53\\x54"
Extract-Skimmer urll="https:\/\/ "\+
Extract-Skimmer 15,17\)\]\( \)\+Y
Extract-Skimmer \\x49\\x3d',' ','\\x62\\x32\\x35
Extract-Skimmer 'c3RyaW5naWZ5',' ','b3Blbg==
Extract-Skimmer "\\x66\\x6C\\x6F\\x6F\\x72"," \\x3F","\\x61\\x6A\\x61\\x78",
Extract-Skimmer xhr.open\("POST", 'https:\/\/ ', true\);
Extract-Skimmer xhr.open\("POST", '\/ ', true\);
Extract-Skimmer Gate:" ",
Extract-Skimmer ','https:\/\/ ','querySelectorAll
Extract-Skimmer n.src\s=\s"\s \?payment=
Extract-Skimmer \\x36\\x38\\x24\\x37\\x34\\x24\\x37\\x34 \\x36\\x38\\x24\\x37\\x34\\x24\\x37\\x34
Extract-Skimmer eventsListenerPool.src\s=\s" ";
Extract-Skimmer eventsListenerPool.src\s=\s' ;
# Phone numbers
Extract-Phone 1-\d\d\d-\d\d\d-\d\d\d\d
Extract-Phone 0[1-6](-[0-9]{2}){4}
Extract-Phone \+61\s\d{9}
Extract-Phone \+44\s\d{10}
# CMS
Extract-CMS WordPress \/wp-content\/ 10
Extract-CMS Joomla 1
Extract-CMS Magento \/skin\/frontend\/ 10
Extract-CMS Magento