IOC extractor
Pull URLs, IPs, domains, emails, hashes, MAC addresses, file paths and dates out of text in one pass. Regex-based pattern matching, not a validator: a matched hash might be any 64 hex characters, not necessarily a real SHA-256 of anything, and "domain" filters out a small blocklist of common file extensions (.php/.exe/.sh/...) rather than knowing real TLDs. Categories can overlap by design (a domain inside a matched URL is listed under both).
Runs on your device. The file is never uploaded.
IOC extractor sweeps text for twelve kinds of indicator at once: URLs, addresses, domains, emails, hash-shaped hex, MAC addresses, Windows and Unix paths, and dates in ISO 8601 form. Each kind is a separate regex pass, deduplicated and headed with its count. Nothing is validated, so any 64 character hex string is listed as a SHA256.
Questions
What does it pull out of a file?
Twelve categories in one pass: URLs, IPv4, IPv6, domains, emails, MD5, SHA1 and SHA256 shaped hashes, MAC addresses, Windows paths, Unix paths and ISO 8601 dates. Each category is deduplicated and printed with a count and one match per line, and categories with no matches are left out entirely.
Why is the same value listed twice?
Because categories overlap on purpose. A domain inside a URL appears under both, and so does an IP inside a URL. The job here is finding everything indicator shaped in the text, not deciding which category owns each match. The one carve out is MAC addresses, which are kept out of the IPv6 list because they match that pattern by shape.
Are the matches validated?
No, they are regex shapes. Any 64 hex characters count as a SHA256, whether or not they are the hash of anything, and the domain pattern cannot tell a real TLD from a file extension. It filters out a blocklist of about 30 obvious extensions such as php, exe and dll so gate.php does not appear as a domain, but that is a heuristic, not a TLD list.
It found nothing in my report. Why?
Either the indicators are genuinely absent, or they are defanged. Text written as hxxps and 1[.]2[.]3[.]4 does not match the URL or IP patterns, which need real separators. Run Defang / Fang URL or Defang / Fang IP in fang mode first, then extract. When there are no matches the output is "(no indicators matched)".
Does my report get uploaded?
No. The text is decoded and matched in a Web Worker in this tab, and the file is never transmitted. That is the point of running an indicator extractor here rather than pasting an incident report into a website: the report itself is often the sensitive part, not the indicators in it.