Actually, that _was_ the real data....

<ul><li>The following Host Name was requested from a host database:</l
+i>
<ul>
<li>192.5.5.241</li>
</ul></ul>
[download]

Everything between the first <ul> after the host down to the first ul pairing at </ul></ul>. There is an unknown number of li line elements between these two ul statements. The precursor to that data chunk is the bit where it comments about "Host Name". view-source:http://www.threatexpert.com/report.aspx?md5=ab41b1e2db77cebd9e2779110ee3915d The above is a sample of the raw html file to be parsed.