Add support for additional deobfuscation techniques

[rshipp]

Continue to add and improve C2 deobfuscation to catch more cases.

• [ ] "ftx:" -> "ftp:"
• [ ] "http__"
• [ ] http:// test .com /url

ftx://test.com/doc.doc
http__www.clowndoc.com/KNpgJS/
http__co-story.co.kr/j59x7Q6/
http__delassociates.com/vXWS9G/
http__www.bagnismeraldo.com/hsVI1/
http__mkholidays.co.uk/GDYt/
http:// peekquick .com /sdeu/cr.sedin/sdac/

• https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118775-technote-esa-00.html

[rshipp]

Done as part of #11