Torito

IOC Extractor & Defanger

Turn pasted logs and incident notes into a deduplicated list of candidate indicators, without visiting URLs or sending evidence to lookup services.

About IOC workbenchFeatures & how to use

Extract URLs, domains, IPs, emails and hashes from logs. Deduplicate, defang or refang indicators and export TXT or CSV locally in your browser.

What it can do

  • Extract candidate URLs, domains, IPv4, IPv6, email addresses and MD5 or SHA hashes.
  • Accept common defanged notation, count occurrences and filter by indicator type.
  • Export refanged or defanged TXT and CSV while preserving case-sensitive URL paths.
  • Syntax matches are not maliciousness verdicts; no DNS or reputation lookups are performed.

How to use it

  1. Paste logs or notes, such as hxxps://login[.]example[.]com and 192.0.2.14, or load the example.
  2. Select Extract indicators, then review candidate types and occurrence counts.
  3. Choose an output format and whether to defang. Copy or download the filtered results.