Indicator types
The engine detects 15 indicator types. 3 of them (registry key, file path and Bitcoin address) are inherently ambiguous, so they carry a heuristic badge — labelled best-effort, never authoritative. Nothing is ever dropped without a visible reason.
| type | what it matches | notes |
|---|---|---|
| IPv4 | Dotted-quad addresses, e.g. 185.220.101.45 | Private / loopback / doc-range / reserved ranges are kept but flagged. |
| IPv6 | Full and :: compressed addresses, e.g. 2001:db8::1 | Same range flags as IPv4 (loopback ::1, doc-range 2001:db8::/32, link-local fe80::/10, multicast ff00::/8). |
| Domain | Registrable hostnames, e.g. malicious.top | Domains on a curated allowlist are flagged “benign”. |
| URL | http/https/ftp URLs, e.g. http://malicious.top/gate.php | Defanged schemes (hxxp, meow://, fxp://) are refanged first. |
| Well-formed addresses, e.g. [email protected] | Bracketed at-sign ([@], (@)) is refanged before detection. | |
| MD5 | 32 hex characters | Classified by length; validated as hexadecimal. |
| SHA-1 | 40 hex characters | Classified by length; validated as hexadecimal. |
| SHA-256 | 64 hex characters | Classified by length; validated as hexadecimal. |
| SHA-512 | 128 hex characters | Classified by length; validated as hexadecimal. |
| CVE | CVE-YYYY-NNNN identifiers (any case) | Normalized to the canonical upper-case form. |
| MAC address | Six colon- or hyphen-separated hex octets, e.g. 00:1b:44:11:3a:b7 | Hardware / interface addresses. |
| UUID | RFC 4122 UUIDs, e.g. 550e8400-e29b-41d4-a716-446655440000 | Case-insensitive; normalized to lower case. |
| Registry key heuristic | Windows registry paths, e.g. HKLM\Software\Run | Heuristic — labelled, never authoritative. |
| File path heuristic | Windows / UNC file paths, e.g. C:\Windows\Temp\a.exe | Heuristic — labelled, never authoritative. |
| Bitcoin address heuristic | Base58 / bech32 BTC addresses, e.g. 1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa | Heuristic — labelled, never authoritative. |
Defang & refang styles
Analysts defang indicators so they can't be clicked or resolved by accident — writing hxxp://malicious[.]top instead of a live URL. Before detection, the extractor refangs the whole input, so a neutralized indicator is recovered as its real value and flagged was defanged. Every style below round-trips refang(defanged) === real.
| style | defanged | refanged |
|---|---|---|
| bracket-dot | [.] | . |
| paren-dot | (.) | . |
| brace-dot | {.} | . |
| word-dot-bracket | [dot] | . |
| word-dot-paren | (dot) | . |
| bracket-colon | [:] | : |
| bracket-scheme-sep | [://] | :// |
| bracket-at | [@] | @ |
| paren-at | (@) | @ |
| hxxp-scheme | hxxp:// | http:// |
| hXXp-scheme | hXXp:// | http:// |
| hstar-scheme | h**p:// | http:// |
| hxxps-scheme | hxxps:// | https:// |
| meow-scheme | meow:// | http:// |
| fxp-scheme | fxp:// | ftp:// |
Note: the backslash-escaped dot (\.) is deliberately NOT refanged — it collides with regex, Sigma and YARA rules a SOC analyst commonly pastes (\.top, \d+\.\d+), and refanging it would corrupt the rule. Scheme neuters (hxxp, h**p, meow://) are only refanged at a scheme position, so a host or word merely containing the substring is left untouched.
Extract a specific type
Worked examples per indicator type — each runs a real sample through the engine at build time, defanged indicators included:
Extract IP addresses
SOC triage 2026-07-04: outbound beacons observed from 185.220.101.45 and 45[.]66[.]77[.]88 (defanged in the advisory).
extract ip-addresses →
Extract domains
Campaign infrastructure: primary C2 malicious[.]top, staging at cdn-update[.]xyz, and phishing lure login-secure(dot)net.
extract domains →
Extract URLs
Dropper phones home to hxxp://malicious[.]top/gate.php and hxxps://cdn-evil[.]xyz/beacon?id=42.
extract urls →
Extract file hashes
Malware sample details from the advisory:
extract file-hashes →
Extract CVE IDs
Patch-Tuesday roundup: actively exploited — CVE-2024-1709 (ScreenConnect auth bypass) and CVE-2023-34362 (MOVEit SQLi).
extract cve →
Extract email addresses
Phishing sender addresses from the campaign: ops[@]corp-security[.]com and billing[@]invoice-update[.]xyz (both defanged).
extract emails →
Open the extractor
Paste any threat report, advisory, or log and pull out every indicator — deduped, counted, and honestly flagged. Free, no account, 100% in your browser.
Open the IOC Extractor →