Indicia

IOC extractor

Paste an email, alert, log or threat report and get every IP, domain, URL, email address, file hash and CVE, de-duplicated, defanged and ready to copy or export.

Runs in your browser. Nothing you paste is uploaded, stored or logged.

How it works

Phishing emails, EDR alerts, firewall logs and threat reports all bury the values you need to check among a lot of other text. Copying them out by hand is slow and easy to get wrong, and the same domain often appears several times in different forms.

Paste the text and the extractor finds every IP address, domain, URL, email address, file hash and CVE ID as you type. It removes wrapping punctuation, ports and duplicates, understands defanged values, and skips things that only look like indicators, such as version numbers, times and file names like invoice.pdf.

Copy one group, copy everything, or download a CSV for your case notes or a block list.

Questions

What counts as an indicator of compromise (IOC)?
Observable values that point to malicious activity: IP addresses, domains, URLs, sender email addresses and file hashes (MD5, SHA-1, SHA-256, SHA-512). The tool also picks out CVE IDs, which are useful context when you write up an incident.
Does it understand defanged indicators?
Yes. Common defanged forms such as hxxps[://], evil[.]example, (dot) and [@] are recognised, so a value appears once whether it was written defanged or not. Results are defanged again by default, so you can paste them straight into a ticket or chat.
Why are some IP addresses hidden?
Private (10.x, 172.16–31.x, 192.168.x), loopback, link-local and documentation addresses are usually your own hosts, not attacker infrastructure, so they are hidden by default. Tick “Include private and internal IPs” to show them, marked as internal.
Is the text I paste uploaded anywhere?
No. Extraction runs entirely in your browser. The page’s security policy only lets it talk to this website, it makes no requests while extracting, and nothing is stored or logged. That makes it suitable for internal emails, alerts and logs.
Is the CSV export safe to open in Excel?
Yes. Any value that starts with =, +, - or @ is prefixed so that Excel or Google Sheets treats it as text instead of running it as a formula, a known trick for attacking analysts through exported data.