Public-source Research / BROWSER-ONLY UTILITY
IOC Candidate Extractor
An address in a report is a lead, not a verdict. Make a deduplicated candidate list while keeping its uncertainty visible.
Paste an extract or choose a local text file. Common hxxp, hxxps and bracketed-dot forms are recognised. Remove private context before sharing results. Limit: 100,000 characters.
Loading local tool code...
Input stays in this tab. No upload, AI call, analytics or ads. Reset clears the workspace. Clipboard copies and downloaded files remain under your control.
Result
Technical details (optional)
Review the result before sharing. It may still contain personal or confidential information.
What is extracted
The extractor recognises HTTP/HTTPS URL candidates, fully qualified domain-like names, strict dotted IPv4 addresses, supported IPv6 text and hexadecimal strings of 32, 40, 64, 96 or 128 characters. Hash candidates are labelled by bit length, not asserted algorithm. A hexadecimal identifier can have the right length without being a file digest. Email addresses are deliberately excluded.
Defanged input and output
Common hxxp and hxxps schemes, bracketed colons and bracketed, parenthesised or braced dots are normalised before extraction. Output URLs use hxxp or hxxps and dots become [.] so the result is not an active link in the tool. Occurrence offsets refer to that normalised working text, not byte positions in the original file. No original file is changed.
Candidate quality needs context
A domain can be legitimate, shared or mentioned as background. Invalid syntax is skipped, but valid syntax does not establish maliciousness, current activity or relevance to your environment. Candidate occurrences inside a recognised URL are not separately counted as domain or IP rows. URLs containing credentials are omitted rather than reproduced. Other URL paths and query values may remain in defanged output.
Bounded local review
Input is limited to 100,000 characters and 2,000 unique candidates. The tool performs no DNS resolution, URL visits, file retrieval, reputation queries or threat-intelligence submission. It does not search leaked data or collect email addresses. Preserve authorised source evidence separately so a downstream analyst can understand where each candidate came from.
References
- Indicators of Compromise and operational limits, RFC 9424
- URI syntax, RFC 3986
- IPv6 address representation, RFC 5952
Documentation reviewed: . Rule results describe the supplied text, not a live application test.
Useful next steps
- Public Domain OSINT Workbench
- Secret Redactor
- SHA Checksum Calculator
- Practical guides and coding projects
Maintained by MetaCyberGuru. A review point may need source, runtime or deployment context before you act on it.