IOC extractor
Paste any text with indicators in it and get a clean list, ready to share, block or import.
Runs in your browser. Nothing is sent unless you choose Check reputation, and nothing is stored.
What it finds
IPv4 and IPv6 addresses, domains, URLs, email addresses and MD5, SHA-1 and SHA-256 hashes, even when they're defanged (hxxp, [.], [@]). Duplicates are merged, and a URL's host isn't listed twice.
Domains are only kept if they end in a real top-level domain, so file names like invoice.pdf and code like array.pop are skipped. Private and reserved IP addresses are marked.
Check them all
Press Check reputation to look up to 50 at a time against URLhaus, ThreatFox, MalwareBazaar and Google Safe Browsing, each with a verdict. Email addresses and private IPs are skipped, and each check counts toward the daily free lookups.
Export
Copy a defanged list that's safe to paste into chat or a ticket, download a CSV for spreadsheets (protected against formula injection), or download a STIX 2.1 bundle to import into a threat intelligence platform such as MISP or OpenCTI. Checked verdicts go into both, leaving out Google Safe Browsing as its terms require.
Private until you choose
Extraction and exports happen in your browser. Indicators are sent to our server only when you press Check reputation, and they aren't logged.