IOC extractor and defanger
Pulls indicators of compromise out of any text (URLs, domains, IPv4 addresses, email addresses, MD5/SHA-1/SHA-256 hashes, CVE IDs), removes duplicates and gets them ready to share safely.
How to use it
- Paste the text into the box – a log excerpt, the headers and body of a suspicious email, an antivirus report or a message from a colleague.
- Click Find indicators. The tool also recognises indicators that have already been defanged (hxxp, [.], [@]).
- Leave defanging switched on if you're sending the results by email or chat, so nobody clicks them by accident.
- Copy the whole set or a single group and paste it into a ticket, a blocklist or a SIEM query.
How it works
An IOC (indicator of compromise) is a trace that gives an attack away: the address of a phishing site, the IP address of a command-and-control server, the hash of a malicious file or the ID of a vulnerability being exploited.
The tool looks for these patterns in the text:
- URLs with an http, https or ftp scheme (URL syntax is defined in RFC 3986).
- Domains, including those that appear inside URLs. To avoid confusing them with file names (invoice.exe), it only accepts domains with common generic or country-code endings.
- IPv4 addresses – valid ones only (each part 0–255).
- Hashes by length: MD5 is 128 bits (32 hexadecimal characters), SHA-1 is 160 bits (40 characters) and SHA-256 is 256 bits (64 characters).
- Email addresses and CVE IDs in the form CVE-year-number.
Defanging rewrites an indicator so that a mail client or chat app won't turn it into a clickable link: http becomes hxxp, dots become [.] and the at sign becomes [@]. Refanging is the reverse – the tool does it automatically on input.
Pattern matching isn't perfect. Check the results before you block anything: a 32-character hexadecimal string, for example, may not be an MD5 hash at all but a session ID.
FAQ
Is the text I paste sent anywhere?
No. All processing happens in JavaScript in your browser. The page loads no analytics or third-party scripts, and the text isn't stored.
Why didn't a file name show up as a domain?
Strings like invoice.pdf or setup.exe look like domain names. The tool skips them when the ending matches a common file extension rather than a known top-level domain.
Why defang the results?
So that nobody opens a malicious link by accident, and so that mail filters or link previews in chat apps don't connect to the attacker's server.
Does the tool handle IPv6?
Not yet. We plan to add IPv6 if there's demand – let us know through the Feedback page.
Sources
Updated