IOC Extractor & Defanger

Paste a threat report, a log excerpt or a phishing email and get its indicators of compromise grouped by type, deduplicated and counted. Defanged notation such as hxxp, [.] and [at] is recognised on the way in, and you can choose defanged output that is safe to paste into tickets and chat. Everything runs in this page; no indicator is looked up or sent anywhere.

Runs locally — nothing you enter is sent Security Free · no signup

How to use

Paste the text: a threat report, SIEM or proxy log lines, an email with headers, or a chat thread. Click Load sample to see a worked example.
Click Extract IOCs. Indicators are grouped into URLs, domains, IPv4, IPv6, email addresses, MD5, SHA-1, SHA-256 and SHA-512 hashes, CVE IDs, MITRE ATT&CK technique IDs and risky file names, each deduplicated with a count.
Pick Defanged output when the list is going into a ticket, email or chat, so nobody clicks a live link; pick Refanged when it is going into a blocklist, SIEM query or EDR search.
Tick Exclude private, reserved and documentation IPs to drop 10.x, 192.168.x, loopback, link-local, TEST-NET and similar addresses. Without it they are kept and labelled.
Copy one group or everything, or download the result as CSV or JSON. To defang or refang the whole text in place instead, use Defang text or Refang text.

Examples

Input

Payload pulled from hxxps://cdn.invoice-portal[.]xyz/Invoice_0423.zip by 10.20.30.40, then C2 to 203.0.113[.]45 (T1071.001). Sender billing[at]invoice-portal[.]xyz.

Extracted (defanged output)

URLs: hxxps://cdn[.]invoice-portal[.]xyz/Invoice_0423.zip
Domains: cdn[.]invoice-portal[.]xyz, invoice-portal[.]xyz
IPv4: 10[.]20[.]30[.]40 · Private (RFC 1918)
      203[.]0[.]113[.]45 · Documentation (TEST-NET-3)
Email: billing[@]invoice-portal[.]xyz
ATT&CK: T1071.001

Supported formats

Any plain text. Defanged forms are read as the real thing: hxxp:// and hxxps://, fxp://, meow://, [.] (.) {.} [dot] (dot), [:] and [://], [@] [at] (at) — for example 1.2.3[.]4 or evil[.]com.
URLs: http, https and ftp, including URLs wrapped in parentheses, angle brackets, quotes or Markdown links; trailing sentence punctuation and unbalanced closing brackets are stripped.
Domains: names whose last label is a real top-level domain from the IANA root zone (or a punycode xn-- TLD). Names ending in .json, .js, .log, .exe and other non-TLD extensions are ignored, and two-part names on TLDs that are mostly file extensions (.zip, .sh, .py, .md, .mov, .rs, .so, .pm, .tf, .one) are treated as file names unless they appear in a URL or email address.
IPv4 with every octet 0–255 and no leading zeros; IPv6 in full, compressed or IPv4-mapped form. Numbers right after the words version, ver, build, release or v are treated as versions, not addresses.
Hashes by hex length: 32 (MD5), 40 (SHA-1), 64 (SHA-256) and 128 (SHA-512) characters, not touching other letters, digits or underscores. Upper-case hex is lower-cased; runs of digits only are skipped.
CVE-YYYY-NNNN… IDs (any case, normalised to upper case) and ATT&CK technique IDs T1xxx and sub-techniques T1xxx.xxx.

Privacy

This tool runs entirely in your browser. Nothing you enter or open is sent anywhere. Privacy policy.

Limitations

Extraction is pattern based. A 32-character hex string is listed as MD5 even if it is really a GUID without hyphens or a session token, and code such as self.name can look like a domain because .name is a real TLD. Review the list before blocking anything.
Overlaps are resolved one way: a URL's host is also listed under Domains or IPs, and an email's domain under Domains, but nothing else inside a URL is listed separately — except hashes, CVE IDs and ATT&CK IDs, which are searched in the whole text so a hash in a sandbox link is caught.
File names are only recognised without spaces and only for risky extensions (executables, scripts, shortcuts, macro-capable Office files, archives and disk images); a file named in a URL path is not listed separately.
Internationalised domain names written in Unicode, IPv6 zone IDs (%eth0), Bitcoin and other wallet addresses, registry keys, mutexes and YARA rules are not extracted.
Defanging changes only URLs, domains, IPv4 addresses and email addresses. IPv6 addresses, hashes and file names are left as they are.
Nothing is enriched or checked: the tool does not resolve domains, look up reputation or tell you whether an indicator is malicious.

FAQ

What does defanging an IOC mean?

Rewriting it so it can't be clicked or resolved by accident: http becomes hxxp, dots in the host become [.] and @ becomes [@], so https://evil.com/a turns into hxxps://evil[.]com/a. It is the convention for sharing indicators in reports, tickets and chat. Refanging turns it back for use in a blocklist or query.

Is the text I paste sent anywhere?

No. Extraction, refanging and defanging run in JavaScript on this page, and the tool makes no network request with your text, so it is safe to use with internal logs. Nothing in the text is visited, resolved or looked up.

Why was report.pdf or config.json not listed as a domain?

Only names ending in a real top-level domain count as domains, and .pdf and .json are not TLDs. A few real TLDs are mostly seen as file extensions (.zip, .sh, .py, .md, .mov and others), so a bare two-part name such as invoice.zip is listed as a file name instead; cdn.invoice.zip or https://invoice.zip/ would still count as domains.

Why does a domain show a higher count than I expected?

Counts include every appearance, including as the host of a URL or the domain of an email address. evil.com, https://evil.com/x and bob@evil.com together give evil.com a count of 3.

How are private IP addresses handled?

They are kept by default and labelled, for example Private (RFC 1918), Loopback, Carrier-grade NAT or Documentation (TEST-NET-2), because an internal address can matter during an investigation. Tick Exclude private, reserved and documentation IPs to keep only public addresses.