Quick take
Pull URLs, domains, IPs, and hashes out of noisy security text.
- Extract URLs, IP addresses, and hashes from a phishing alert or sandbox report.
- Pull defanged domains and hxxp links from a threat intelligence note.
IOC Extractor
URLs (1) - https://login.example.com/session Domains (2) - cdn.example.net - login.example.com IPv4 addresses (1) - 198.51.100.24 IPv6 addresses (1) - 2001:db8:85a3::8a2e:370:7334 MD5 hashes (1) - 44d88612fea8a8f36de82e1278abb02f SHA1 hashes (1) - 3395856ce81f2b7382dee72602f798b642f14140 SHA256 hashes (1) - 275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f
Extraction runs locally. No reputation lookup, DNS query, URL fetch, or enrichment request is made.
Where it fits
Use IOC Extractor for turning alerts, logs, email headers, sandbox notes, and threat reports into grouped indicators. It works well when you want deduplicated IOC groups for reporting, triage, or follow-up tools and do not need a bigger workflow around it.
- Best fit: turning alerts, logs, email headers, sandbox notes, and threat reports into grouped indicators.
- You start with pasted security text that may contain URLs, domains, IPs, hashes, or defanged values.
- The useful choices are which indicator groups to copy and whether to preserve defanged or normalized forms.
- Check false positives, private IPs, context around indicators, and whether hashes have the expected length.
- You end up with deduplicated IOC groups for reporting, triage, or follow-up tools.
What the output does and does not prove
- The pasted text is normalized locally to recognize common defanged forms such as hxxp and [.] notation.
- Regular expressions identify URLs, domains, IPv4, IPv6, MD5, SHA1, and SHA256 indicators.
- Results are deduplicated, sorted, grouped, and made copyable without any enrichment calls.
A clean way to use IOC Extractor
- Start with pasted security text that may contain URLs, domains, IPs, hashes, or defanged values.
- Choose which indicator groups to copy and whether to preserve defanged or normalized forms.
- Run the tool once, then review false positives, private IPs, context around indicators, and whether hashes have the expected length.
- Copy, export, or download deduplicated IOC groups for reporting, triage, or follow-up tools.
- Treat the output as one checkpoint, then verify the next step in the real workflow.
What to watch for
- Extraction uses local pattern matching and normalization; it does not perform enrichment or reputation lookup.
- IPv6, URLs, hashes, and domains have overlapping text patterns, so review grouped output before taking action.
- Save the original source text so every indicator can be traced back to context.
- Defang URLs before pasting them into shared reports or chat threads.
How your data is handled
IOC extraction runs entirely in your browser. Toolumina does not upload, save, log, fetch, resolve, or enrich the text or indicators you paste.
FAQ
Does this support defanged indicators?
Yes. Common forms such as hxxp, hxxps, [.] and [:] are normalized locally before extraction.
Does the tool query threat intelligence services?
No. It only extracts indicators from text and does not perform reputation, DNS, WHOIS, HTTP, or enrichment lookups.
Which hash types are detected?
The extractor groups MD5, SHA1, and SHA256 hashes by length after matching hexadecimal hash strings.