IOC extractor

Twelve categories in one pass: URLs, IPv4, IPv6, domains, emails, MD5, SHA1 and SHA256 shaped hashes, MAC addresses, Windows paths, Unix paths and ISO 8601 dates. Each category is deduplicated and printed with a count and one match per line, and categories with no matches are left out entirely.

Because categories overlap on purpose. A domain inside a URL appears under both, and so does an IP inside a URL. The job here is finding everything indicator shaped in the text, not deciding which category owns each match. The one carve out is MAC addresses, which are kept out of the IPv6 list because they match that pattern by shape.

No, they are regex shapes. Any 64 hex characters count as a SHA256, whether or not they are the hash of anything, and the domain pattern cannot tell a real TLD from a file extension. It filters out a blocklist of about 30 obvious extensions such as php, exe and dll so gate.php does not appear as a domain, but that is a heuristic, not a TLD list.

Because the indicators are genuinely absent, not because they were defanged. hxxps and 1[.]2[.]3[.]4 both match already: the tool builds a refanged copy of your text and checks it too, alongside the original, so hxxp, [.]/(.)/{.}, [://], [:] and [@] all need no separate Defang / Fang step first. When there are no matches the output is "(no indicators matched)".

No. The text is decoded and matched in a Web Worker in this tab, and the file is never transmitted. That is the point of running an indicator extractor here rather than pasting an incident report into a website: the report itself is often the sensitive part, not the indicators in it.