Tools / IOC Extractor
IOC Extractor
Paste unstructured threat-intel text and pull out the indicators of compromise: IPs, domains, hashes, emails, and CVEs. Defanged forms like evil[.]com are normalized automatically. Everything runs in your browser — nothing is uploaded.
Start typing or paste text to extract indicators live.
// About this tool
IOC Extractor
An IOC (Indicator of Compromise) extractor scans unstructured threat-intel text — incident reports, malware analyses, blog write-ups, or pastebin dumps — and pulls out the concrete indicators security teams use to hunt and block: IP addresses, domains, file hashes, email addresses, and CVE identifiers.
It recognizes the defanged forms analysts use to keep links inert, like evil[.]com, evil(.)com, or user[at]example[.]com, and normalizes them back to plain indicators. Results are deduplicated and grouped by type, ready to copy into a blocklist, SIEM query, or detection rule.
Everything runs locally in your browser. Your text is never uploaded, stored, or sent to a server — which matters when you are working with sensitive incident data.
// When to use it
Turn a malware report into a blocklist
Paste a threat-intel write-up and get a clean, deduplicated list of C2 IPs, domains, and hashes to feed into your firewall or EDR.
Normalize defanged indicators
Analysts often write evil[.]com or hxxps:// to keep links inert. The extractor recognizes these and restores the real indicator.
Build a detection query
Collect the CVEs and hashes from an advisory and use them to write or update detection rules without manually transcribing each one.
// Questions
Is my text uploaded?
No. Extraction runs entirely in your browser using JavaScript. Your text never leaves your machine — nothing is uploaded, stored, or sent to a server.
What indicator types does it extract?
IPv4 and IPv6 addresses, domains, MD5/SHA-1/SHA-256/SHA-512 hashes, email addresses, and CVE identifiers (CVE-YYYY-NNNNN).
What is a defanged indicator?
A defanged indicator is one written so it can't be clicked or triggered accidentally — for example evil[.]com instead of evil.com, or hxxps:// instead of https://. The extractor normalizes these back to their real form.
Can it enrich indicators against threat feeds?
No. This tool only extracts and deduplicates indicators. It does not query threat-intelligence feeds or enrich them with reputation data — it is strictly client-side with no server component.
// Related tools