What this tool does
Extract URLs, domains, IPv4, IPv6, MD5, SHA1, and SHA256 indicators from pasted security text locally in your browser.
- Extract URLs, IP addresses, and hashes from a phishing alert or sandbox report.
- Pull defanged domains and hxxp links from a threat intelligence note.
- Convert a mixed IOC paragraph into grouped report or JSON output.
IOC Extractor
URLs (1) - https://login.example.com/session Domains (2) - cdn.example.net - login.example.com IPv4 addresses (1) - 198.51.100.24 IPv6 addresses (1) - 2001:db8:85a3::8a2e:370:7334 MD5 hashes (1) - 44d88612fea8a8f36de82e1278abb02f SHA1 hashes (1) - 3395856ce81f2b7382dee72602f798b642f14140 SHA256 hashes (1) - 275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f
Extraction runs locally. No reputation lookup, DNS query, URL fetch, or enrichment request is made.
When this tool is a good fit
IOC Extractor helps when you need deduplicated IOC groups for reporting, triage, or follow-up tools from pasted security text that may contain URLs, domains, IPs, hashes, or defanged values. It is most useful for turning alerts, logs, email headers, sandbox notes, and threat reports into grouped indicators. The notes below focus on the settings that matter, the checks worth doing before you export, and the limits that tend to cause mistakes.
- Takes pasted security text that may contain URLs, domains, IPs, hashes, or defanged values.
- Lets you adjust which indicator groups to copy and whether to preserve defanged or normalized forms.
- Calls out what to review: false positives, private IPs, context around indicators, and whether hashes have the expected length.
- Produces deduplicated IOC groups for reporting, triage, or follow-up tools.
- Fits common jobs such as turning alerts, logs, email headers, sandbox notes, and threat reports into grouped indicators.
Example jobs
- Extract URLs, IP addresses, and hashes from a phishing alert or sandbox report.
- Pull defanged domains and hxxp links from a threat intelligence note.
- Convert a mixed IOC paragraph into grouped report or JSON output.
How to use IOC Extractor
- Prepare pasted security text that may contain URLs, domains, IPs, hashes, or defanged values.
- Set which indicator groups to copy and whether to preserve defanged or normalized forms before running the tool.
- Generate or process the result, then review false positives, private IPs, context around indicators, and whether hashes have the expected length.
- Copy, export, or download deduplicated IOC groups for reporting, triage, or follow-up tools.
- Run a second pass if the destination system, document, or workflow has stricter requirements.
What to know before you use it
- The pasted text is normalized locally to recognize common defanged forms such as hxxp and [.] notation.
- Regular expressions identify URLs, domains, IPv4, IPv6, MD5, SHA1, and SHA256 indicators.
- Results are deduplicated, sorted, grouped, and made copyable without any enrichment calls.
- Extraction uses local pattern matching and normalization; it does not perform enrichment or reputation lookup.
- IPv6, URLs, hashes, and domains have overlapping text patterns, so review grouped output before taking action.
Checks and edge cases
- Save the original source text so every indicator can be traced back to context.
- Defang URLs before pasting them into shared reports or chat threads.
How your data is handled
IOC extraction runs entirely in your browser. Toolumina does not upload, save, log, fetch, resolve, or enrich the text or indicators you paste.
FAQ
Does this support defanged indicators?
Yes. Common forms such as hxxp, hxxps, [.] and [:] are normalized locally before extraction.
Does the tool query threat intelligence services?
No. It only extracts indicators from text and does not perform reputation, DNS, WHOIS, HTTP, or enrichment lookups.
Which hash types are detected?
The extractor groups MD5, SHA1, and SHA256 hashes by length after matching hexadecimal hash strings.