Your files stay on your device

IOC extractor

Pull defanged domains, IPs, URLs, hashes, emails, and CVE ids out of a pasted report, grouped and ready to export.

Paste or open a report and press Extract.

Noise is set aside, not deleted: private and reserved address space, RFC 5737 documentation ranges, public resolvers, example.com and reserved TLDs, and filename-shaped matches such as setup.exe all land in the set-aside list with a reason. Known limits: a bare host:port with no scheme is read as the host only, four-part software versions can read as IPv4, Unicode (IDN) domains are not claimed, IPv4-embedded IPv6 forms and IPv6 zone ids are skipped, and hex runs of lengths other than 32, 40, and 64 are ignored. Everything runs in this tab; nothing is uploaded.
OptionsExtract indicators

More text tools

- Acronym extractor (/text/acronym-extractor)
- Find & replace (/text/find-replace)
- Compare two texts (/text/diff)
All text tools (/text)

Was this tool useful?
YesNo

Canonical HTML: https://nutter.tools/text/ioc-extractor
Markdown version: https://nutter.tools/text/ioc-extractor.md
Plain-text version: https://nutter.tools/text/ioc-extractor.txt
Agent index: https://nutter.tools/llms.txt