Extract IOCs from threat reports: IP addresses, domains, URLs, file hashes, email addresses, and Bitcoin wallets.
Paste a threat report, alert narrative, or analyst note, and the IOC Extractor pulls out strings that look like IP addresses, domain names, URLs, file hashes, email addresses, and Bitcoin wallet addresses. It separates the matches by indicator type, turning narrative reporting into a reviewable set of observables. Processing stays in the browser, which matters when reports contain sensitive incident details. The important limitation is that extraction is not threat validation: a matched address or hash is only a candidate IOC, not proof that it is malicious.
The input is unstructured text rather than a fixed IOC schema. The tool examines the pasted material for recognizable values in its supported categories and presents those matches as extracted indicators. Surrounding prose is not part of an IOC. A single report can therefore yield network locations, file identifiers, contact addresses, and cryptocurrency addresses in one pass.
Read each result according to its category. A URL is a complete resource locator, while a domain or IP address identifies a host or network endpoint. A file hash is a digest-shaped identifier, an email address identifies a mailbox, and a Bitcoin address is a payment identifier. These labels do not retain the report's allegation, confidence, attribution, or time context.
No. It collects candidate indicators from the supplied text; extraction alone cannot establish reputation, ownership, reachability, or current activity. Confirm each value using the report's context and appropriate investigative sources. This is especially important for shared hosting, public email services, legitimate domains abused temporarily, and indicators copied from historical reporting.
Not without review. The output can include references that should not be blocked, such as researcher addresses, victim infrastructure, example values, or legitimate services mentioned in the report. Blocking a full URL, domain, or IP address also has different operational consequences. Validate scope, context, freshness, and likely collateral impact before using any extracted value as an enforcement rule.
The behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.
Generate strong, random passwords with customizable length, character sets, and complexity requirements.
Analyze password strength with entropy scoring, crack-time estimates, and improvement suggestions.
Create cryptographically random strings for API keys, tokens, salts, and unique identifiers.
Create QR codes for URLs, text, Wi-Fi credentials, vCards, and more with customizable size and colors.
Scan and decode QR codes from uploaded images or your device camera to extract embedded data.
Compute MD5, SHA-1, SHA-256, and SHA-512 checksums to verify file integrity and detect tampering.