IOC Extractor

Pull domains, IPs, URLs, file hashes, emails and CVE IDs out of any report or email, automatically refanged, deduplicated and ready to export.

Runs locally

Everything happens in your browser. What you paste or drop here is never uploaded, logged or stored.

Report, advisory, email or log

Or drop a text file

Up to 16 MB. Read locally.

Types to extract

Extracting indicators is easy. Not blocking your own DNS server is the hard part

Pulling every IP address and domain out of a threat report takes a regular expression. The result is a list of strings that matched a pattern - and that list contains the attacker's command server next to the victim's own gateway, the researcher's sandbox, a public resolver mentioned in passing, and example.com from a footnote.

Feeding that straight into a blocklist is how organisations block 8.8.8.8. It is a well-documented category of self-inflicted outage, and it is the reason this tool separates what it found from what is plausibly actionable.

What gets set aside

RFC 1918 private ranges, loopback, link-local, multicast and reserved space - a private address in a report is the victim's network
The RFC 5737 documentation ranges, which are never real infrastructure
Public resolvers and well-known infrastructure - Google, Cloudflare, Quad9, the major clouds
example.com, .test, .invalid, localhost
Filenames the domain pattern matches by accident: setup.exe and settings.json both look like hostnames

They are shown, not deleted. That a report mentioned a particular internal address is itself information, and a tool that silently drops things teaches you not to check its output.

Defanged input is understood

hxxps://evil[.]com, evil(dot)com, bad[at]evil.com - the conventions are not standardised, and several forms appear in circulation. Text is refanged before extraction, so an indicator written defensively still comes out as a usable indicator, with the original notation recorded alongside it.

Overlaps are resolved by specificity

A URL contains a domain. An email address contains a domain. A SHA-256 contains runs that match the MD5 and SHA-1 patterns. Left alone, the output fills with fragments - so the most specific type claims each span.

The one deliberate exception is a URL's host, which is emitted as an indicator in its own right and marked as derived. Blocking the activity needs both: the URL for a proxy or web filter, the bare host for DNS and firewall rules. An extractor that gave only the URL would quietly leave half the job undone.

Nothing is uploaded

Embargoed vendor reports, incident timelines and customer log extracts are exactly the documents that must not be pasted into someone else's parser. Extraction runs in your browser.

Frequently asked questions

Can I use the actionable list directly as a blocklist?

No, and no tool can honestly say otherwise. The separation removes the indicators that are obviously not indicators; deciding that the rest are hostile is a judgement about the report and its source. What it does is make that review possible instead of hopeless.

Why is a domain I know is malicious marked as set aside?

Most likely it matched the well-known infrastructure list - attackers do abuse legitimate services. The classification is a heuristic about what is usually safe to block, not a claim about who is using it.

It missed an indicator.

Check whether it was written in a defanging style not covered, or whether the type is deselected. Extraction works on patterns, so anything without a regular shape - a mutex name, a campaign name, a user agent string - will not be found.

Is my report uploaded?

No. It is parsed entirely in your browser.

References

Related tools

What this tool can and cannot tell you. It reports what is present in the input you provide. It cannot see anything you did not give it, and a clean result means nothing was found in that input - not that the wider system is secure.

Security guidance here follows current published sources - OWASP, MDN, the relevant RFCs, NIST, CISA, FIRST and MITRE - which are linked beside the specific claims they support.