Indicator Extractor

Paste an alert, ticket, email, log excerpt, or threat report below and every recognizable indicator gets pulled out and grouped by type — IPv4/IPv6, domains, URLs, emails, MD5/SHA-1/SHA-256/SHA-512 hashes, CVE IDs, MITRE ATT&CK technique IDs, and Windows/Unix file paths and registry keys. Runs entirely in your browser; nothing you paste is sent anywhere.

Accuracy notes

Hashes are matched by exact length only (32/40/64/128 hex characters with a non-hex character or nothing on either side), so a hash is never pulled out of the middle of a longer hex blob. Domains require a plausible top-level domain from a curated list (plus the four names RFC 2606 reserves for documentation, like evil.example) — common abbreviations (e.g.) and version numbers (v10.2.5.100) are excluded rather than misread as domains or IPs. Private/reserved IPv4 ranges and RFC 2606 placeholder domains are still extracted, just flagged as ambiguous rather than hidden, since a SOC analyst usually wants to see them and decide for themselves. A dotted word with a real-but-unlikely TLD (Node.js, since .js is a real ccTLD) can't be told apart from an actual domain by shape alone — a known limitation, not a crash.