IOC Extractor
Paste unstructured threat-intel text and pull out the indicators of compromise: IPs, domains, hashes, emails, and CVEs. Defanged forms like evil[.]com are normalized automatically. Everything runs in your browser — nothing is uploaded.
Start typing or paste text to extract indicators live.
About this tool
IOC Extractor
An IOC (Indicator of Compromise) extractor scans unstructured threat-intel text — incident reports, malware analyses, blog write-ups, or pastebin dumps — and pulls out the concrete indicators security teams use to hunt and block: IP addresses, domains, file hashes, email addresses, and CVE identifiers.
It recognizes the defanged forms analysts use to keep links inert, like evil[.]com, evil(.)com, or user[at]example[.]com, and normalizes them back to plain indicators. Results are deduplicated and grouped by type, ready to copy into a blocklist, SIEM query, or detection rule.
Everything runs locally in your browser. Your text is never uploaded, stored, or sent to a server — which matters when you are working with sensitive incident data.
When to use it
Turn a malware report into a blocklist
Paste a threat-intel write-up and get a clean, deduplicated list of C2 IPs, domains, and hashes to feed into your firewall or EDR.
Normalize defanged indicators
Analysts often write evil[.]com or hxxps:// to keep links inert. The extractor recognizes these and restores the real indicator.
Build a detection query
Collect the CVEs and hashes from an advisory and use them to write or update detection rules without manually transcribing each one.
Questions
Is my text uploaded?
No. Extraction runs entirely in your browser using JavaScript. Your text never leaves your machine — nothing is uploaded, stored, or sent to a server.
What indicator types does it extract?
IPv4 and IPv6 addresses, domains, MD5/SHA-1/SHA-256/SHA-512 hashes, email addresses, and CVE identifiers (CVE-YYYY-NNNNN).
What is a defanged indicator?
A defanged indicator is one written so it can't be clicked or triggered accidentally — for example evil[.]com instead of evil.com, or hxxps:// instead of https://. The extractor normalizes these back to their real form.
Can it enrich indicators against threat feeds?
No. This tool only extracts and deduplicates indicators. It does not query threat-intelligence feeds or enrich them with reputation data — it is strictly client-side with no server component.
Related resources