IOC Extractor
Pull IPs, domains, URLs, emails, hashes and CVE IDs out of any text, even when defanged.
How to extract indicators
- Paste a report, log or email.
- Choose the indicator types to find, and whether to defang them.
- Copy the list, or download it as CSV or JSON.
Questions
Does it find defanged indicators?
Yes. It recognises hxxp, [.], (.), [:] and [@], and lists them in their usable form unless you choose Defang the results.
Why isn't a file name like report.docx listed as a domain?
Domains are checked against the public list of domain endings, so file names and version numbers are left out.
Are the indicators looked up anywhere?
No. Nothing is sent to any server or reputation service. Look them up in your own tools.
Is a domain inside a URL listed twice?
No. The URL is listed once; a domain is listed on its own only where it appears by itself.