Your files stay on your device

# IOC extractor

Pull defanged domains, IPs, URLs, hashes, emails, and CVE ids out of a pasted report, grouped and ready to export.

Paste or open a report and press Extract.

Noise is set aside, not deleted: private and reserved address space, RFC 5737 documentation ranges, public resolvers, example.com and reserved TLDs, and filename-shaped matches such as setup.exe all land in the set-aside list with a reason. Known limits: a bare host:port with no scheme is read as the host only, four-part software versions can read as IPv4, Unicode (IDN) domains are not claimed, IPv4-embedded IPv6 forms and IPv6 zone ids are skipped, and hex runs of lengths other than 32, 40, and 64 are ignored. Everything runs in this tab; nothing is uploaded.
OptionsExtract indicators

## More text tools

- [Acronym extractor](/text/acronym-extractor)
- [Find & replace](/text/find-replace)
- [Compare two texts](/text/diff)
[All text tools](/text)

Was this tool useful?
YesNo

---

Canonical HTML: https://nutter.tools/text/ioc-extractor
Markdown version: https://nutter.tools/text/ioc-extractor.md
Plain-text version: https://nutter.tools/text/ioc-extractor.txt
Agent index: https://nutter.tools/llms.txt