IOC normalizer and deduplicator

Paste one or more sources and press Normalise and merge.

The same indicator in different shapes collapses into one entry: hash and domain casing folds, trailing root dots strip, default ports 80 and 443 come off URLs, IPv6 compresses to canonical form, MAC separators fold to colons, and defanged spellings reverse before matching. Variants are recorded, never silently discarded, and the source count shows how many independent feeds carried each indicator. Reserved and well-known space (private ranges, documentation addresses, public resolvers, example domains) is flagged in the merged output, not deleted. Everything runs in this tab; nothing is uploaded.