initial

honeypot_api.py

@@ -106,62 +106,65 @@ def extract_intelligence(text):
         "orderNumbers": [],
     }
 
-    # Phone Numbers
-    phone_matches = re.findall(r"\+?\d{1,3}[- ]?\d{10}", text)
-    extracted["phoneNumbers"] = list(set(phone_matches))
+    # Strict Indian phone numbers only (+91-XXXXXXXXXX)
+    phones = re.findall(r"\+91[- ]?\d{10}\b", text)
+    extracted["phoneNumbers"] = list(set(phones))
 
-    # Bank Accounts (12–18 digits only)
-    bank_matches = re.findall(r"\b\d{12,18}\b", text)
-    extracted["bankAccounts"] = list(set(bank_matches))
+    # Bank accounts (12–18 digits only)
+    banks = re.findall(r"\b\d{12,18}\b", text)
+    extracted["bankAccounts"] = list(set(banks))
 
-    # Email Addresses (strict)
-    email_matches = re.findall(
+    # Email addresses
+    emails = re.findall(
         r"[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}",
         text
     )
-    extracted["emailAddresses"] = list(set(email_matches))
-
-    # UPI IDs (exclude emails with dot-domain)
-    upi_matches = re.findall(
-        r"\b[a-zA-Z0-9._%+-]+@[a-zA-Z0-9]+(?:\.[a-zA-Z0-9]+)?\b",
-        text
-    )
+    extracted["emailAddresses"] = list(set(emails))
 
+    # UPI IDs (no dot-domain)
+    upis = re.findall(r"\b[a-zA-Z0-9._-]+@[a-zA-Z]+\b", text)
     clean_upi = []
-    for u in upi_matches:
-        if u not in extracted["emailAddresses"] and "." not in u.split("@")[1]:
+    for u in upis:
+        if u not in extracted["emailAddresses"]:
             clean_upi.append(u)
-
     extracted["upiIds"] = list(set(clean_upi))
 
-    # Phishing Links (remove trailing punctuation)
-    link_matches = re.findall(r"https?://[^\s]+", text)
-    clean_links = [l.rstrip(".,)") for l in link_matches]
+    # Phishing links
+    links = re.findall(r"https?://[^\s]+", text)
+    clean_links = [l.rstrip(".,)") for l in links]
     extracted["phishingLinks"] = list(set(clean_links))
 
-    # Case IDs (full capture including suffix)
-    case_matches = re.findall(
-        r"\b(?:CASE|REF|ID|TICKET)[- ]?\d+(?:-\d+)*\b",
+    # Case IDs (REF, CASE, ID)
+    case_ids = re.findall(
+        r"\b(?:REF|CASE|ID)[- ]?\d+(?:-\d+)*\b",
         text,
         flags=re.IGNORECASE
     )
-    extracted["caseIds"] = list(set(case_matches))
 
-    # Policy Numbers (full capture)
-    policy_matches = re.findall(
-        r"\b(?:POLICY|POL|INS)[- ]?\d+(?:-\d+)*\b",
+    # Employee IDs
+    emp_ids = re.findall(
+        r"\bEMP[- ]?\d+(?:-\d+)*\b",
+        text,
+        flags=re.IGNORECASE
+    )
+
+    extracted["caseIds"] = list(set(case_ids + emp_ids))
+
+    # Policy numbers
+    policies = re.findall(
+        r"\bPOL[- ]?\d+(?:-\d+)*\b",
         text,
         flags=re.IGNORECASE
     )
-    extracted["policyNumbers"] = list(set(policy_matches))
+    extracted["policyNumbers"] = list(set(policies))
 
-    # Order / Transaction IDs
-    order_matches = re.findall(
+    # Transaction / Order IDs
+    txns = re.findall(
         r"\b(?:TXN|ORDER|ORD)[- ]?\d+(?:-\d+)*\b",
         text,
         flags=re.IGNORECASE
     )
-    extracted["orderNumbers"] = list(set(order_matches))
+    extracted["orderNumbers"] = list(set(txns))
 
     return extracted
 # ======================================================