Does it refang emails written as ops[@]corp[.]com?

Yes. The bracketed and parenthesized at-sign ([@], (@)) and the bracketed dot ([.], (.), {.}) are refanged before detection, so a defanged sender address is recovered as a real email and flagged “was defanged”.

Can I re-defang the extracted emails before sharing?

The results table shows the real value for pivoting, and a “show defanged” toggle re-neutralizes it (ops[@]corp[.]com) so you can paste it into a ticket or write-up without creating a live mailto link.

Does it validate that the address is well-formed?

Yes. Each candidate is validated as a syntactically well-formed address (local part + domain), so stray @ mentions in prose are not mistaken for email indicators.

Extract email addresses from any text — free, client-side

The sample text

This 4-line snippet is fed verbatim into the extractor to produce every result on this page. It deliberately includes a defanged indicator so you can see refang detection at work.

Phishing sender addresses from the campaign: ops[@]corp-security[.]com and billing[@]invoice-update[.]xyz (both defanged).
Reply-to harvested from headers: attacker(@)mail-drop.example.
Legit contact for coordination: [email protected] — do not block.
BEC lure impersonated ceo@company-payroll[.]net requesting a wire transfer.

What was extracted

The extractor found 5 unique indicators across 5 occurrences, of which 5 were email addresses. 4 indicator swere only found after refanging — proof that defanged inputs are caught.

5unique IOCs

5total occurrences

1types found

4from defanged

Detected types

Every indicator type present in the sample, with email addresses highlighted. In the live tool these chips filter the table; here they show the mix the engine pulled out.

Extracted indicators

Deduped, counted, and honestly flagged. Rows marked was defanged appeared neutralized in the source and were recovered by the refang stage; private, benign and heuristic badges are kept, never silently dropped.

type	value	count	line	flags
Email	[email protected]	1	1	was defanged
Email	[email protected]	1	1	was defanged
Email	[email protected]	1	2	was defanged
Email	[email protected]	1	3
Email	[email protected]	1	4	was defanged

What was detected, in context

The refanged sample with every detected indicator underlined in its type color — the same preview the live tool paints as you type.

Phishing sender addresses from the campaign: [email protected] and [email protected] (both defanged). Reply-to harvested from headers: [email protected]. Legit contact for coordination: [email protected] — do not block. BEC lure impersonated [email protected] requesting a wire transfer.

FAQ

Does it refang emails written as ops[@]corp[.]com?: Yes. The bracketed and parenthesized at-sign ([@], (@)) and the bracketed dot ([.], (.), {.}) are refanged before detection, so a defanged sender address is recovered as a real email and flagged “was defanged”.
Can I re-defang the extracted emails before sharing?: The results table shows the real value for pivoting, and a “show defanged” toggle re-neutralizes it (ops[@]corp[.]com) so you can paste it into a ticket or write-up without creating a live mailto link.
Does it validate that the address is well-formed?: Yes. Each candidate is validated as a syntactically well-formed address (local part + domain), so stray @ mentions in prose are not mistaken for email indicators.

Extract other indicator types

See the full IOC types & defang-styles reference, or open the extractor and paste your own text.

Try it on your own text

Paste a report, advisory, or log, review the deduped indicators, filter to Email, and copy them with one click. Free, no account, nothing uploaded — extraction runs entirely in your browser.

Open this sample in the IOC Extractor →