IOC Extractor & Defanger
Turn pasted logs and incident notes into a deduplicated list of candidate indicators, without visiting URLs or sending evidence to lookup services.
About IOC workbenchFeatures & how to use
Extract URLs, domains, IPs, emails and hashes from logs. Deduplicate, defang or refang indicators and export TXT or CSV locally in your browser.
What it can do
- Extract candidate URLs, domains, IPv4, IPv6, email addresses and MD5 or SHA hashes.
- Accept common defanged notation, count occurrences and filter by indicator type.
- Export refanged or defanged TXT and CSV while preserving case-sensitive URL paths.
- Syntax matches are not maliciousness verdicts; no DNS or reputation lookups are performed.
How to use it
- Paste logs or notes, such as hxxps://login[.]example[.]com and 192.0.2.14, or load the example.
- Select Extract indicators, then review candidate types and occurrence counts.
- Choose an output format and whether to defang. Copy or download the filtered results.