IOC Extractor & Normalizer
Turn pasted reports, logs, or notes into a clean list of candidate indicators. Extract, normalize, remove duplicates, and export without uploading your text.
Source text
These are syntactically valid candidates, not a verdict that they are malicious. No DNS lookup, reputation query, or destination connection is performed.
Extracted indicators
No extraction yetDefanged output reduces accidental opening. URL paths and queries retain their case. Copy and exports use the current filter and output format.
| Type | Indicator | Occurrences |
|---|---|---|
| No results yet. | ||
What normalization does
- Recognizes common defanged notation such as
[.],[@],[:], andhxxp(s). - Lowercases domains, URL hosts, and hashes; preserves URL path/query case and email local-part case.
- Compresses IPv6 addresses and converts CIDRs to their network address. Equivalent normalized values are deduplicated within each type.
- Recognizes hash length and syntax only. It does not verify a file or look up a hash.
Domain detection uses syntax rather than a public-suffix or reputation database; names resembling file names may appear. Quoted email local parts, IPv6 zone identifiers, and non-HTTP URLs are not supported. Always review the results.
Data processing & privacy
The tools process entered addresses and generate results locally in your browser. They do not send inputs or results to a server.
Cloudflare hosts this website and receives the connection information required to deliver its pages. Cloudflare Web Analytics collects aggregate usage and performance metrics without analytics cookies or visitor fingerprinting.
Results are copied or downloaded only when you choose to do so. Always review generated configuration before applying it.