Skip to main content
CompressNConvert

IOC Extractor

Extract, normalize, categorize, and deduplicate common indicators from pasted text.

Runs locally in your browser

Recognizes eight IOC types in plain or commonly defanged text.

Normalized does not mean safe. Extracted values may be restored to active-looking forms and can become clickable when copied elsewhere. This is syntax matching, not a maliciousness verdict.

Unique indicators

4 indicators

Normalized and deduplicated

URLs1

  • https://portal.example.com/login

IPv41

  • 198.51.100.42

Emails1

SHA-2561

  • e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Extraction JSON

{
  "total": 4,
  "indicators": {
    "urls": [
      "https://portal.example.com/login"
    ],
    "domains": [],
    "ipv4": [
      "198.51.100.42"
    ],
    "ipv6": [],
    "emails": [
      "[email protected]"
    ],
    "md5": [],
    "sha1": [],
    "sha256": [
      "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
    ]
  }
}

Complete tool guide

IOC Extractor guide

The IOC Extractor finds supported indicator syntax in incident notes or threat reports and organizes unique normalized values by type.

Your input is processed in the current browser tab and is not sent to the application server.

Why use this tool?

  • Handle untrusted indicator text without a lookup or enrichment request.
  • Keep the output as selectable plain text instead of opening recognized values.
  • Copy or download a result for a report, ticket, or investigation workflow.

Common use cases

  • Pulling indicators from incident-response notes
  • Deduplicating a mixed IOC list before analysis
  • Separating URLs, addresses, domains, emails, and hashes for export

How to use it

  1. 1

    Paste incident text or an indicator list.

  2. 2

    Review the unique indicator count and categories.

  3. 3

    Treat normalized findings as untrusted plain text.

  4. 4

    Copy or download the categorized JSON result.

Supported syntax

The extractor recognizes URL, domain, IPv4, IPv6, email, MD5, SHA-1, and SHA-256 syntax in both common and defanged forms.

Normalization

Recognized defanging markers are restored for comparison, hashes are lowercased, and duplicate values of the same type are removed.

Local processing

Everything runs in this browser tab. The page never visits, resolves, enriches, or submits an indicator.

Practical tips for better results

  • Treat syntax recognition as triage, not a reputation verdict.
  • Normalized URLs can become clickable when pasted into another application.
  • Keep original evidence unchanged in your case-management system.

Frequently asked questions

Does the IOC Extractor upload or look up indicators?

No. Processing stays in this browser tab. The tool does not visit, resolve, enrich, or submit an indicator.

Does a syntax match mean an indicator is malicious?

No. These tools only recognize and transform supported text patterns. They do not provide a reputation or safety verdict.

Keep working

Related cybersecurity tools

Continue with another focused tool from the same collection.

IOC DefangerDefang URLs, domains, IP addresses, and email addresses for safer sharing in reports and tickets.IOC RefangerRestore common defanged IOC spellings locally for analysis without opening or resolving them.IP & CIDR CalculatorCalculate IPv4 and IPv6 network boundaries, address ranges, masks, and exact counts with CIDR-aware validation.Secret Scanner & RedactorDetect common API keys, tokens, credentials, and private keys in pasted text, then create a masked local copy.