IOC Normalizer and Deduplicator

Clean a messy indicator list into one canonical set - type-aware normalisation, defanging undone, duplicates merged and the ambiguous ones set aside for review.

Runs locally

Everything happens in your browser. What you paste or drop here is never uploaded, logged or stored.

Paste raw lists or whole reports - indicators are extracted from either.

Normalise an indicator list, value by value

One value per line. Each is typed, validated and canonicalised on its own, and every change is shown next to the original. Ambiguous and invalid values are never merged.

Indicators

Treat every line as

The source count is the most useful field in the result

Merging four feeds into one deduplicated list is straightforward. What makes the output worth having is knowing that a particular indicator appeared in three of the four.

Corroboration across independent sources is the nearest thing to evidence a list of strings can offer. A deduplicator that collapses everything to a set of unique values has thrown that away - so this keeps the occurrence count, the source names, and every original spelling.

One caveat the tool cannot check for you: sources are only corroborating if they are genuinely independent. A great many commercial feeds resell the same upstream data, and three copies of one observation is still one observation.

What normalising actually fixes

The same indicator is written differently by every tool that touches it, and unnormalised lists deduplicate to nothing:

Hashes in upper and lower case - D41D8C... and d41d8c...
Domains with and without a trailing root dot, in either case
URLs with an explicit default port - https://x.com:443/a and https://x.com/a
Defanged and plain forms of the same value
CVE identifiers in mixed case
MAC addresses with colons or hyphens

All of those collapse to one row here, with the variants recorded so you can see what merged.

The set-aside classification carries through

Private ranges, documentation addresses, public resolvers and well-known infrastructure are flagged in the merged output exactly as they are in the extractor. A list assembled from four sources contains four times as many of them, and they are the entries most likely to cause damage if the list is loaded automatically.

Everything stays local

Several feeds' worth of indicators, merged in your browser. Nothing is uploaded.

Frequently asked questions

What format should each source be in?

Anything. Paste a clean list, one per line, or an entire report - indicators are extracted from both, so there is no need to prepare the input.

Why do two indicators that look identical not merge?

Check the type column. A domain and the host of a URL are different indicator types by design, because they are used at different points in a network. Within a type, normalisation is thorough.

Can I see which source contributed what?

Yes - every merged row lists its source names, and the CSV export includes both the count and the list.

Are my feeds uploaded?

No. Merging runs entirely in your browser.

References

Related tools

What this tool can and cannot tell you. It reports what is present in the input you provide. It cannot see anything you did not give it, and a clean result means nothing was found in that input - not that the wider system is secure.

Security guidance here follows current published sources - OWASP, MDN, the relevant RFCs, NIST, CISA, FIRST and MITRE - which are linked beside the specific claims they support.