Extract IOCs by type

SOC triage 2026-07-04: outbound beacons observed from 185.220.101.45 and 45[.]66[.]77[.]88 (defanged in the advisory). C2 resolved to 2001:db8::dead:beef over IPv6; scanner source 198.51.100.23 hit the perimeter 40x. Lateral movement seen to internal host 10.0.0.5 and loopback probe 127.0.0.1. Blocklist add: 203.0.113.66, 91.219.236.10, 1[.]2[.]3[.]4.

Paste a threat report, firewall log, or advisory and pull out every IPv4 and IPv6 address in one pass — including defanged ones written as 1[.]2[.]3[.]4. Duplicates are collapsed with an occurrence count, and private, loopback, documentation-range and reserved addresses are kept but clearly labelled so you never block a bogon by accident.

extract IP addresses →

Campaign infrastructure: primary C2 malicious[.]top, staging at cdn-update[.]xyz, and phishing lure login-secure(dot)net. Fast-flux rotation across evil-domain.com, tracker.example.org and data-exfil[.]io. Benign check-in traffic to github.com and microsoft.com is expected and can be ignored. Newly registered: bad-actor{.}ru observed resolving after the refang.

Extract every domain name from a report, log, or advisory — including defanged ones written as malicious[.]top, evil(dot)com, or bad-actor{.}ru. Domains are deduped with counts, and hosts on a curated allowlist (github.com, microsoft.com, …) are flagged “benign” so the noise floor stays low and the real indicators stand out.

extract domains →

Dropper phones home to hxxp://malicious[.]top/gate.php and hxxps://cdn-evil[.]xyz/beacon?id=42. Second-stage payload hosted at meow://payload-host.example/stage2.bin (defanged scheme). Exfil endpoint: http://data-exfil.io/upload observed in PCAP. Phishing link in the lure: hxxp://login-secure(dot)net/verify.

Pull every URL out of a threat report or log, including defanged links written as hxxp://malicious[.]top/gate.php or meow://payload-host/stage2.bin. The extractor refangs neutralized schemes (hxxp → http, hxxps → https, meow:// → http://) and bracketed dots first, so an un-clickable link in the source becomes a real, copy-ready indicator flagged “was defanged”.

extract URLs →

Malware sample details from the advisory: MD5 44d88612fea8a8f36de82e1278abb02f SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e The same dropper (SHA256 above) beacons to hxxp://payload-host[.]top/gate.php and was seen alongside CVE-2024-1709.

Extract every file hash from a malware advisory or log in one pass — MD5, SHA-1, SHA-256 and SHA-512 are each recognized by length and validated as hex, then deduped with counts. Paste a messy report and get a clean, copy-ready list of hashes you can push straight into a blocklist, YARA rule, or MISP event.

extract file hashes →

Patch-Tuesday roundup: actively exploited — CVE-2024-1709 (ScreenConnect auth bypass) and CVE-2023-34362 (MOVEit SQLi). Chained with CVE-2021-44228 (Log4Shell) in the wild; scanners also probing CVE-2019-0708 (BlueKeep). Advisory references cve-2022-30190 (Follina) — note the lower-case form is still matched. Related infrastructure: hxxp://exploit-kit[.]top/probe hosting the CVE-2024-1709 payload.

Pull every CVE identifier out of a bulletin, advisory, or log — CVE-YYYY-NNNN in any case — and get a deduped, counted list you can paste into a tracker or vuln-management ticket. Mixed in with IPs, URLs and hashes in a long report, the CVEs are isolated onto their own filter chip for a one-click copy.

extract CVE IDs →

Phishing sender addresses from the campaign: ops[@]corp-security[.]com and billing[@]invoice-update[.]xyz (both defanged). Reply-to harvested from headers: attacker(@)mail-drop.example. Legit contact for coordination: [email protected] — do not block. BEC lure impersonated ceo@company-payroll[.]net requesting a wire transfer.

Extract every email address from a phishing report, header dump, or log — including defanged ones written as ops[@]corp-security[.]com or attacker(@)mail-drop.example. The [@] / (@) and bracketed-dot styles are refanged before detection, so a neutralized sender address is recovered as a real, copy-ready indicator flagged “was defanged”.

extract email addresses →