How to use the IOC Extractor (IP Domain Hash from Text)
- 1. Paste the textAdd a threat report, phishing email, alert or log lines.
- 2. Set optionsChoose whether to read defanged input and how to output results.
- 3. ExportReview the table and download it as CSV for your SIEM or blocklist.
What it finds
- URLs starting with http or https (and hxxp after refanging).
- Domains, skipping things that are really file names, such as invoice.pdf or setup.exe.
- IPv4 addresses with valid octets, with private ranges like 10.x and 192.168.x marked.
- Email addresses, hashes by exact length (32, 40 or 64 hex) and CVE IDs.
Worked example (the practice sample): it finds 11 indicators: 1 URL, 3 domains, 3 IPv4 addresses (one marked private / internal), 1 email, 1 SHA-256, 1 MD5 and 1 CVE. Defanged input like login-update[.]example[.]com is read correctly because refanging runs first.
Good practice for analysts
Regular expressions are fast but not perfect. Version numbers such as 1.2.3.4 look like IP addresses, and a sentence ending in a word and a full stop can resemble a domain. Review every row before you block anything, and check the context: an IP in a report may belong to the victim, not the attacker.
- Share defanged indicators in emails and tickets so nobody clicks them by accident.
- Use raw output only for tools that need live values, such as a firewall blocklist.
- Formula-safe CSV: values starting with =, +, - or @ are prefixed so spreadsheets do not run them.
- Enrich with reputation services before acting on unfamiliar indicators.
All processing happens in your browser; the text is never uploaded. Convert single links with the URL defang tool, analyse the email itself with the email header analyzer, and check what a hash is with the hash identifier.
Frequently asked questions
Does it support IPv6 addresses?
Not yet in this extractor. Use the IPv6 expander to check individual IPv6 addresses.
Why is a .zip domain missing?
Endings that are common file extensions, such as .zip, .py or .sh, are skipped to avoid flagging file names. Add those by hand if they are real domains.
Is the IOC Extractor (IP Domain Hash from Text) free?
Yes, the IOC Extractor (IP Domain Hash from Text) is free. The first time you extract your first indicators, you are asked for your name and WhatsApp number once. After that, this and every other Uncodemy tool opens straight away without the form.