Your files stay on your device

IOC normalizer and deduplicator

Clean messy indicator lists into one canonical set with defang reversal, type-aware normalization, and variant-merged duplicates.

Paste one or more sources and press Normalise and merge.

The same indicator in different shapes collapses into one entry: hash and domain casing folds, trailing root dots strip, default ports 80 and 443 come off URLs, IPv6 compresses to canonical form, MAC separators fold to colons, and defanged spellings reverse before matching. Variants are recorded, never silently discarded, and the source count shows how many independent feeds carried each indicator. Reserved and well-known space (private ranges, documentation addresses, public resolvers, example domains) is flagged in the merged output, not deleted. Everything runs in this tab; nothing is uploaded.
OptionsNormalise and merge

More text tools

- Compare two texts (/text/diff)
- Find & replace (/text/find-replace)
- Sort and clean lines (/text/lines)
All text tools (/text)

Was this tool useful?
YesNo

Canonical HTML: https://nutter.tools/text/ioc-normalizer-deduplicator
Markdown version: https://nutter.tools/text/ioc-normalizer-deduplicator.md
Plain-text version: https://nutter.tools/text/ioc-normalizer-deduplicator.txt
Agent index: https://nutter.tools/llms.txt