IOC Extractor & Defanger
Every indicator in a report, alert, e-mail or log — merged, filtered and ready to block.
Try before you buy.
- Free preview: how many indicators of each type were found, with the first ones of each type (up to 10).
- Locked until you unlock it: download and copy.
- Unlock: Premium pass, ₹799 for 30 days or ₹249 for 1 week, a one-time payment that never renews. Unlock: Premium pass, $19.99 for 30 days or $7.99 for 1 week, a one-time payment that never renews.
Ways to unlock shows how to get the full result.
Printing this result is locked in the free preview.
Read on your device as you type. Nothing is uploaded or looked up online.
The example uses documentation addresses and example names, which are normally set aside, so “Keep documentation examples” is switched on for it.
Filters and allowlist
A domain covers its subdomains. Add your own company’s domains and address ranges. Lines starting with # are notes.
Indicators
Paste text or open files. IP addresses, domains, URLs, e-mail addresses, file hashes, CVE IDs, ATT&CK techniques and wallet addresses appear here, without duplicates.
Untick an indicator to leave it out of copies and exports. Copies follow the Defanged / Live choice; CSV and JSON contain both forms.
Set aside
Defanged copy of the pasted text
Every URL, domain, IP and e-mail address in the text written defanged, so it can be shared in chat or a ticket without becoming a link.
Locked in the free preview. Opens the ways to unlock this result.
Locked in the free preview. Batch runs unlock with a pass.
Locked in the free preview. Query results unlock with a pass.
About the IOC Extractor & Defanger
Threat reports, SIEM alerts, phishing e-mails and incident notes are full of indicators of compromise: the IP addresses, domains, URLs and file hashes you need in a blocklist, a SIEM search or a ticket. Copying them out by hand misses some, breaks others and keeps the duplicates. Paste the text, or open a PDF, HTML page, saved e-mail (.eml), CSV or log file, and this extractor lists every IPv4 and IPv6 address, domain, URL, e-mail address, MD5, SHA-1, SHA-256 and SHA-512 hash, CVE ID, MITRE ATT&CK technique ID and cryptocurrency address, once each, with how often and on which line it appears.
It reads the defanged forms analysts use — hxxps://evil[.]example, 198.51.100[.]7, user[at]mail[dot]example — and can write everything back defanged or live. Domains are checked against the Public Suffix List, so setup.py or co.uk alone are not mistaken for domains; private and reserved addresses, documentation examples and an editable allowlist of reference sites are set aside with the reason. With a Premium pass, export CSV, JSON or a STIX 2.1 bundle. Nothing is looked up online: the text never leaves your device, and reputation checks stay with your own tools.
Without a pass you see a free preview: how many indicators of each type were found, with the first ones of each type. The full lists, copying them, the defanged text and the exports unlock with a Premium pass.
How to use it
- Paste a report, alert or log into the box, or open one or more files (PDF, HTML, .eml, CSV, text). Press Try an example to see a made-up incident write-up.
- Read the indicators by type. Each one shows how many times it appears, its first line, the line itself and anything else known about it — the registered domain of a subdomain, the wallet type, or that it was written defanged.
- Untick false positives. Open Filters and allowlist to keep private or documentation addresses, or to add your own company’s domains and IP ranges to the allowlist.
- Choose Defanged to copy safely into chat and tickets, or Live for blocklists and SIEM queries, then, with a Premium pass or after unlocking this result, copy one type, Copy all, or download CSV, JSON or STIX 2.1.
- To share the text itself, use Copy defanged text (with a Premium pass, or after unlocking this result): the pasted text with every URL, domain, IP and e-mail address defanged.
Examples
The link pointed to hxxps://secure-login[.]invoice-portal[.]example/auth/verify.php?id=8841 and redirected to hxxp://198.51.100[.]23:8080/dl/invoice_4471.zip
URLs: https://secure-login.invoice-portal.example/auth/verify.php?id=8841, http://198.51.100.23:8080/dl/invoice_4471.zip Domains: secure-login.invoice-portal.example IPv4: 198.51.100.23
Documentation addresses and example names like these are set aside unless “Keep documentation examples” is on, as it is for the page’s example.
invoice_4471.js (MD5 fd2f408e9d16606e6f560386995a6ab7) exploited CVE-2023-4966 using T1059.007
MD5: fd2f408e9d16606e6f560386995a6ab7 CVE IDs: CVE-2023-4966 ATT&CK: T1059.007 (sub-technique)
invoice_4471.js is not listed as a domain: .js is not a top-level domain.
fileserver01.corp.internal (10.20.30.40); see https://attack.mitre.org/techniques/T1566/002/
Set aside: fileserver01.corp.internal and 10.20.30.40 (private or internal), the attack.mitre.org link (allowlist) Kept: T1566.002
Common uses
- Turning a vendor’s threat report or a government advisory into a blocklist for the firewall, proxy or e-mail gateway.
- Pulling sender IPs, link domains and attachment hashes out of a reported phishing e-mail (.eml).
- Collecting the indicators from an alert or an incident timeline into a ticket, defanged so nobody clicks them.
- Loading indicators into a threat-intelligence platform or SIEM that imports STIX 2.1 or CSV.
- Defanging a whole incident write-up before posting it in a chat channel.
What counts as an indicator
- IPv4 and IPv6 addresses: whole addresses only, so version numbers such as
1.2.3.4.5, times and MAC addresses are skipped. An IPv4-mapped IPv6 address (::ffff:198.51.100.7) is listed as IPv4, and IPv6 addresses are written in the standard short form (RFC 5952). - Domains: the last label must be a top-level domain on the Public Suffix List, and the name must be registrable —
evil.co.ukcounts,co.ukdoes not. Subdomains show their registered domain. Internationalised names are kept in Punycode with the Unicode form beside them. - URLs: http, https, ftp, ftps, sftp, ws and wss, including IPv6 hosts in brackets. Trailing full stops, commas and an unmatched closing bracket are trimmed.
- E-mail addresses, but not the
user@part of a URL. - Hashes: runs of exactly 32, 40, 64 or 128 hexadecimal digits — MD5, SHA-1, SHA-256 and SHA-512 by length — not inside longer hex strings, not after
0x, and not all digits or one repeated character. - CVE IDs:
CVE-followed by the year and 4 to 19 digits, the pattern of the CVE Record Format. - MITRE ATT&CK technique IDs: techniques (
T1105), sub-techniques (T1059.001, also theT1059/001of attack.mitre.org links) and ICS techniques (T0800onwards). - Cryptocurrency addresses, only when their built-in checksum is right: Bitcoin and Litecoin (Base58Check and Bech32 or Bech32m, BIP-173 and BIP-350), Dogecoin, Tron, Monero, and Ethereum-style 0x addresses (mixed-case ones must pass the EIP-55 checksum).
Defanged forms it reads
Defanging stops an address from becoming a clickable link. These forms are turned back into live ones before reading, in upper or lower case:
hxxp,hxxps,h**pandfxpbefore://[.],(.),{.},[dot],(dot)and a backslash before a dot,\.[:],[://],[@],[at],(at)and[/]- zero-width spaces and soft hyphens inserted into addresses
When it writes them defanged, it uses the most common style: hxxps://, [.] in host names and IP addresses, [@] in e-mail addresses and [:] in IPv6 addresses. Paths, hashes and IDs are left as they are.
What is set aside, and why
- Private, reserved and internal: private ranges such as 10.0.0.0/8 and 192.168.0.0/16, loopback, link-local, carrier-grade NAT, multicast and other addresses the IANA special-purpose registries mark as not reachable on the internet, and internal names such as
.local,.internalandhome.arpa. - Documentation examples: 192.0.2.0/24, 198.51.100.0/24 and 203.0.113.0/24 (RFC 5737), 2001:db8::/32 (RFC 3849), example.com and the .example and .test names (RFC 2606).
- Allowlist: reference and standards sites that appear in almost every report (mitre.org, cve.org, nist.gov, w3.org…) and XML namespace hosts found in every Office or HTML file. Sites where anyone can host files are deliberately not on it, because attackers use them. Add your own domains and CIDR ranges.
- File names and code: names whose last part is both a file extension and a top-level domain (
setup.py,notes.md,photos.zip), names with a document extension inside (invoice.pdf.zip) and code such as$user.name— unless they were written defanged, which shows someone meant them as an address.
Everything set aside is listed with its reason, so nothing disappears silently.
The STIX 2.1 export
The bundle follows STIX 2.1. Each network or file indicator becomes an Indicator object with a STIX pattern — [ipv4-addr:value = '…'], [domain-name:value = '…'], [url:value = '…'], [email-addr:value = '…'] or [file:hashes.'SHA-256' = '…'] — and the indicator type you choose (unknown by default, because a report can mention addresses that are not malicious). CVE IDs become Vulnerability objects with a cve external reference and ATT&CK IDs become Attack Pattern objects with a mitre-attack reference and link. STIX 2.1 has no object for cryptocurrency wallets, so those stay in the CSV and JSON exports.
Limitations
- Nothing is looked up: the tool does not know whether an address or hash is malicious. Check reputation with your own threat-intelligence tools.
- PDFs are read from their text layer. A scanned PDF (a picture of text) has none: run it through OCR first. An address split across two lines of a PDF is read as two parts.
- Outlook .msg files cannot be read; save the message as .eml. Attachments inside an e-mail are hashed, and text attachments are read, but archives are not opened.
- Pattern matching can produce false positives, especially in code: an object property such as
process.namelooks like a domain. Untick them before exporting. - ATT&CK IDs are recognised by their format, not checked against the current ATT&CK release, and their names are not shown (that would need the ATT&CK data set). Bitcoin Cash, XRP and other coins are not recognised.
- Up to 60 MB per file and 50,000 different indicators per run.
Privacy
On this device: nothing is sent
Everything is read in your browser, in a background worker; nothing you paste or open is uploaded, stored or looked up online. Your filter choices and allowlist are remembered in this browser only.
Frequently asked questions
What do I get without a pass?
Without a pass, IOC Extractor & Defanger shows how many indicators of each type were found, with the first ones of each type (up to 10). Until you unlock it, the result can’t be downloaded or copied. A Premium or Ultimate pass, a one-time payment that never renews, unlocks the full result. The pricing page lists the passes and their prices.
What does “defang” mean?
Writing an indicator so that it is not a working link: hxxps://evil[.]example instead of the real address. Mail clients, chat apps and ticket systems turn live addresses into links, and one accidental click on a malicious one is enough. Defanged indicators can be shared safely; Live turns them back for blocklists and searches.
Why are some addresses and domains set aside?
Private addresses (10.x, 192.168.x), internal names (.local), documentation examples (192.0.2.x, example.com) and reference links (attack.mitre.org) are almost never indicators, but they appear in nearly every report and would clutter a blocklist. They are listed under “Set aside” with the reason, and the filters let you keep them.
Does it check whether an IP or domain is malicious?
No. It only finds and tidies indicators; it never contacts any service, so it can be used on confidential reports. For a quick look at an address, the IP Address Lookup shows its network and country, and the Suspicious Link Checker explains the warning signs in a link.
Can it read the indicators in a phishing e-mail?
Yes. Save the message as .eml (most mail clients can, or forward it as an attachment) and open it here: the headers — including the Received lines with the sending servers’ addresses — the text and HTML bodies, the link targets and the MD5, SHA-1 and SHA-256 hashes of every attachment are read. To read the headers in depth, use the Email Header Analyzer.
Why is a domain like setup.py not listed?
.py is a real top-level domain (Paraguay), but setup.py is far more likely to be a Python file. Names like that are set aside as probable file names unless they were written defanged (setup[.]py) or appear in a URL. Untick the file-name filter to list them all.
Which tools can import the STIX file?
Any tool that reads STIX 2.1 JSON bundles, such as threat-intelligence platforms and many SIEMs. The bundle uses only standard objects (Indicator, Vulnerability, Attack Pattern) and STIX patterns. If a tool wants plain lists instead, use CSV or copy one type at a time.