IOC Extractor and Defanger.

Paste a report, email or log. Pull out the indicators, and make links safe to share.

Runs in your browser. Nothing you paste is uploaded, and nothing is ever opened or looked up.

Extract indicators Why defang

Extractor

Find every indicator in the text.

Links, domains, IP addresses, emails, file hashes, CVE numbers and ATT&CK techniques. Already defanged text is understood too.

Text to scan

Show indicators defanged Also bracket the :// in links Hide private and reserved IPs

Why defang

Make it harmless to share.

Defang

Break the link on purpose.

Writing hxxps://evil[.]example stops email, chat and documents from turning a malicious address into a clickable link, so nobody opens it by accident.

Extract

Turn prose into a list.

Reports bury their indicators in paragraphs. A clean list of domains, IPs and hashes is what you paste into a firewall, a SIEM or a ticket.

Refang

Reverse it for analysis.

To search a log or check a domain, you need the live form. Refang puts the dots and colons back, ready to copy into your own tools.

Clicking before checking.Never open an indicator from a report to see what happens. Look it up in a tool built for it, or in a safe lab.

Trusting every match.A version number like 1.2.3.4 looks like an IP address, and a file name can look like a domain. Read the list before you block anything.

Blocking shared or private addresses.Private ranges (10.x, 192.168.x) and cloud or CDN addresses can belong to many innocent services. The tool tags private and reserved ranges to help.

Free live toolEmail header analyser Free live toolHash and file checker Free live toolBase64, URL and hex

More free tools.

Lessons and tools. No sign-up.

Back to Free See the courses