Reject IPv4 literals from domain and hostname detection

[elhoim]

Finding 24 (Medium) — bin/cli.py:151-163

Problem

looks_like_domain's label regex allows all-numeric labels, so an IPv4 literal parses as a domain - looks_like_domain('8.8.8.8') is True, adding domain(85)/hostname(80) guesses for any IP. With --all-guesses this sends an IP to domain-only modules.

Fix

looks_like_domain() in bin/cli.py used a per-label regex ([A-Za-z0-9-]{1,63}) that accepts purely numeric labels, so any IPv4 literal (e.g. "8.8.8.8") satisfied the domain shape check and looks_like_hostname() (which delegates to it) too. With --all-guesses this caused domain(85)/hostname(80) type guesses to be added for IP-valued attributes, routing IPs into domain-only expansion modules. The fix short-circuits looks_like_domain() to return False immediately when the value is already recognized as an IPv4 or IPv6 address via the existing is_ipv4()/is_ipv6() helpers, before any label parsing happens.

Verification

Reproduced against the unmodified code at 9b8c605, then re-checked after the change.

Before

python -c "import importlib.util; spec=importlib.util.spec_from_file_location('c','bin/cli.py'); m=importlib.util.module_from_spec(spec); spec.loader.exec_module(m); print(m.looks_like_domain('8.8.8.8'))"
=> True   (an IPv4 literal is wrongly classified as a domain)

After

Same command after the fix:
=> False  (IPv4 literal correctly rejected; looks_like_domain('example.com') still returns True, looks_like_domain('2606:4700::1') still returns False as before)

python bin/cli.py --help exits 0 and the module still imports cleanly. Verification was performed offline against the pure functions — no running misp-modules instance is required.

Branched from 9b8c605. This PR addresses only this finding; the other findings from the same review are in separate PRs, so they will need rebasing against each other as they merge.

🤖 Generated with Claude Code

https://claude.ai/code/session_01DYX4TKA5inzByJ4qGWKjqh