Nutter Tools
Nutter Tools

A free toolbox that runs in your browser. A tool for every job.

Your files never leave your device

Images

  • Convert images
  • Compress images
  • Resize images
  • Crop
  • Watermark

PDF & files

  • Merge PDFs
  • Split a PDF
  • Images to PDF
  • PDF to images
  • Remove photo location

Video & audio

  • Compress video
  • Convert video
  • Video to GIF
  • Convert audio
  • Trim audio

Everyday

  • QR codes
  • Passwords
  • Time zones
  • Unit converter
  • Word count
  • Webcam test

Developer

  • JSON formatter
  • Base64
  • Regex tester
  • Hashes
  • JWT decoder

Site

  • About
  • Contact
  • Settings
  • Privacy
  • Terms
  • Site map
  • llms.txt

Everyday

  • Images
  • Video
  • Audio
  • PDF & files
  • Text
  • QR codes
  • Units & math
  • Time & dates
  • Color
  • Passwords & IDs
  • Device tests
  • Sun & moon

For developers

  • JSON
  • Encoding
  • Regex & cron
  • Web & auth
  • Hashing & encryption
  • Config files
  • Network
  • Browser
  • AI
  • Fake data
© Nutter Toolsnutter.tools
  1. Home
  2. Text
  3. IOC extractor
Your files stay on your device

IOC extractor

Pull defanged domains, IPs, URLs, hashes, emails, and CVE ids out of a pasted report, grouped and ready to export.

This tool is in beta

Still being tested. If a result looks wrong, tell us.

Report a problem

Paste or open a report and press Extract.

Noise is set aside, not deleted: private and reserved address space, RFC 5737 documentation ranges, public resolvers, example.com and reserved TLDs, and filename-shaped matches such as setup.exe all land in the set-aside list with a reason. Known limits: a bare host:port with no scheme is read as the host only, four-part software versions can read as IPv4, Unicode (IDN) domains are not claimed, IPv4-embedded IPv6 forms and IPv6 zone ids are skipped, and hex runs of lengths other than 32, 40, and 64 are ignored. Everything runs in this tab; nothing is uploaded.

IOC Extractor

Defanged notation is understood
http and https links
hostnames; the host of every URL comes along, marked derived
dotted quads with valid octets
hex-colon forms with a :: or eight groups
local part plus domain
hex runs of exactly 32, 40, or 64 characters
CVE-YYYY-NNNNNN

The scan undoes hxxp, bracketed dots, and bracketed at-signs before matching, so a defanged report yields plain values. Up to 2 MB per run, 5,000 distinct indicators.

Runs on this device. Nothing is uploaded.

More text tools

  • Acronym extractor
  • Find & replace
  • Compare two texts
All text tools

Was this tool useful?