Tools / IOC Extractor

IOC Extractor

Paste a threat report, alert, email or log. Every IP, domain, URL, hash, email address and CVE comes out grouped and de-duplicated, defanged or refanged, ready for your ticket or blocklist.

● Runs in your browser. Nothing you paste is sent anywhere.

Input

Include private / internal IPs Also list domains inside URLs Strict mode (fewer false positives)

Indicators

Indicators will appear here as you paste.

What it handles

Defanged input

Understands hxxp, [.], (.), {.}, [dot], [@] and [:] so you can paste straight from threat intel reports.

Fewer false positives

Checks domains against the full IANA TLD list and skips log field names like event.type, file names and clock times.

Safe sharing

"Copy text with IOCs defanged" returns your original text with every indicator neutralised, so links can't be clicked by accident in tickets or chat.

Need verdicts, not just a list?

IOC Triage checks each indicator against 15 threat-intel sources from a right-click in your browser.

Get IOC Triage