Extract IP addresses from any text

The sample text

This 4-line snippet is fed verbatim into the extractor to produce every result on this page. It deliberately includes a defanged indicator so you can see refang detection at work.

SOC triage 2026-07-04: outbound beacons observed from 185.220.101.45 and 45[.]66[.]77[.]88 (defanged in the advisory).
C2 resolved to 2001:db8::dead:beef over IPv6; scanner source 198.51.100.23 hit the perimeter 40x.
Lateral movement seen to internal host 10.0.0.5 and loopback probe 127.0.0.1.
Blocklist add: 203.0.113.66, 91.219.236.10, 1[.]2[.]3[.]4.

What was extracted

The extractor found 9 unique indicators across 9 occurrences, of which 8 were IP addresses. 2 indicator swere only found after refanging — proof that defanged inputs are caught.

Detected types

Every indicator type present in the sample, with IP addresses highlighted. In the live tool these chips filter the table; here they show the mix the engine pulled out.

Extracted indicators

Deduped, counted, and honestly flagged. Rows marked was defanged appeared neutralized in the source and were recovered by the refang stage; private, benign and heuristic badges are kept, never silently dropped.

What was detected, in context

The refanged sample with every detected indicator underlined in its type color — the same preview the live tool paints as you type.

FAQ

Does it extract both IPv4 and IPv6 addresses?

Yes. Every IPv4 (dotted-quad) and IPv6 address is validated and pulled out in the same pass. IPv6 forms — including compressed :: notation — are recognized, deduped and counted alongside IPv4 hits.

Can it find defanged IPs like 1[.]2[.]3[.]4?

Yes — that is the differentiator. The text is refanged before detection, so 1[.]2[.]3[.]4, 45[.]66[.]77[.]88 and similar neutralized forms are recovered as real addresses and flagged “was defanged” so you know they appeared neutralized in the source.

How are private and loopback IPs handled?

They are kept, never silently dropped, but labelled — private (RFC1918), loopback, documentation-range (TEST-NET / 2001:db8::/32) and reserved addresses each carry a visible badge so you can decide what to block and what to ignore.

Extract other indicator types

• domains
• URLs
• file hashes
• CVE IDs
• email addresses

See the full IOC types & defang-styles reference, or open the extractor and paste your own text.