IOC Extractor pulls indicators of compromise out of any text you paste, such as a threat report, a phishing email or log lines, and lists them by type: URLs, domains, IPv4 and IPv6 addresses, email addresses, MD5, SHA-1, SHA-256 and SHA-512 hashes, CVE ids and MITRE ATT&CK technique ids. It also defangs text so links cannot be clicked by accident, and refangs defanged text back for your tools.
How to read the result
Each indicator type gets its own table with the value and its defanged form; IPv4 addresses also show whether they are public, private, loopback or reserved, so internal addresses in a report stand out. Duplicates are removed. The defanged list at the end is ready to paste into a ticket, a chat or an email.
Defanged input such as hxxps://evil[.]com or user[at]domain[dot]com is recognised, because the text is refanged before extraction. File names like update.log or config.json are not reported as domains.
Defender tips
- Always share indicators defanged in email and chat; mail clients and chat apps turn plain URLs into links and sometimes fetch previews.
- Check the scope column before blocking: a private address in a report usually belongs to the victim's network, not the attacker's.
- Treat extracted hashes as leads, not verdicts. Confirm them in your own telemetry before acting.
FAQ
Is the text sent to a server?
No. Extraction, defanging and refanging run in your browser.
Why is a domain missing?
Domains are matched against known top-level domains to avoid false positives from file names. A domain with an unusual TLD may be skipped unless it appears inside a URL or an email address.
Which defang style does it produce?
hxxp or hxxps for the scheme and [.] for dots in host names, the style most threat intelligence platforms accept.