Free tool · runs in your browser
IOC Extractor
Powered by ip-address · MIT, WHATWG URL
Source text
Text only, up to 1 MiB. No DNS resolution or reputation query.
Extracted indicators
| Type | Normalised value | Defanged version |
|---|
What is an indicator of compromise?
An IOC is observable data associated with activity or an incident, such as an IP address, domain, URL or file digest. It must be interpreted with its source and context: its mere presence does not prove that something is malicious.
Inventory without enrichment
The extractor recognises HTTP(S) URLs, domains, IPv4, IPv6, emails, MD5/SHA-1/SHA-256/SHA-512 digests and CVE identifiers. It deduplicates results, normalises case and caps output at 5,000 items.
Keep context
A string may look like an indicator without being one. Keep its source, timestamp and collection method; then use an authorised platform if external enrichment is required.
?Frequently asked questions
Does the tool contact found domains or addresses?
No. It only performs local syntactic extraction and creates no clickable links.
Are defanged spellings recognised?
Yes. Common hxxp, [.] and [@] forms are restored for analysis, then a defanged version is provided for sharing.
Is an extracted IOC necessarily malicious?
No. The presence of a URL, hash or CVE in text says nothing about its reputation.
+More tools
- [•••]Evidence Sanitizer
Mask secrets, emails and IPv4 addresses before sharing evidence.
- #Hash Lab
Compute digests and identify a hash format.
- ://URL Inspector
Break down and normalise a URL with the browser’s actual parser.
Technical assessment
Request an application or infrastructure assessment
For an assessment by our team, specify the systems involved, available access and requested tests in your enquiry.