Does it handle hxxp:// and other defanged schemes?

Yes. hxxp://, hxxps://, h**p://, meow:// and fxp:// are refanged back to http/https/ftp at a scheme boundary before detection, so a defanged link is recovered as a real URL and flagged “was defanged”.

Will the extracted URL be clickable?

The results table shows the real (refanged) value for copying, and a “show defanged” toggle re-neutralizes it (hxxp[://]…) so you can safely paste it into a ticket or email without accidentally creating a live link.

Does it also extract the domain inside each URL?

Domains and URLs are detected as distinct indicator types. A URL is captured whole; a bare host mentioned elsewhere in the text is captured as a domain. Use the type filter chips to narrow to just URLs.

Extract URLs from any text — free, client-side

The sample text

This 4-line snippet is fed verbatim into the extractor to produce every result on this page. It deliberately includes a defanged indicator so you can see refang detection at work.

Dropper phones home to hxxp://malicious[.]top/gate.php and hxxps://cdn-evil[.]xyz/beacon?id=42.
Second-stage payload hosted at meow://payload-host.example/stage2.bin (defanged scheme).
Exfil endpoint: http://data-exfil.io/upload observed in PCAP.
Phishing link in the lure: hxxp://login-secure(dot)net/verify.

What was extracted

The extractor found 5 unique indicators across 5 occurrences, of which 5 were URLs. 4 indicator swere only found after refanging — proof that defanged inputs are caught.

5unique IOCs

5total occurrences

1types found

4from defanged

Detected types

Every indicator type present in the sample, with URLs highlighted. In the live tool these chips filter the table; here they show the mix the engine pulled out.

Extracted indicators

Deduped, counted, and honestly flagged. Rows marked was defanged appeared neutralized in the source and were recovered by the refang stage; private, benign and heuristic badges are kept, never silently dropped.

type	value	count	line	flags
URL	http://malicious.top/gate.php	1	1	was defanged
URL	https://cdn-evil.xyz/beacon?id=42	1	1	was defanged
URL	http://payload-host.example/stage2.bin	1	2	was defanged
URL	http://data-exfil.io/upload	1	3
URL	http://login-secure.net/verify	1	4	was defanged

What was detected, in context

The refanged sample with every detected indicator underlined in its type color — the same preview the live tool paints as you type.

Dropper phones home to http://malicious.top/gate.php and https://cdn-evil.xyz/beacon?id=42. Second-stage payload hosted at http://payload-host.example/stage2.bin (defanged scheme). Exfil endpoint: http://data-exfil.io/upload observed in PCAP. Phishing link in the lure: http://login-secure.net/verify.

FAQ

Does it handle hxxp:// and other defanged schemes?: Yes. hxxp://, hxxps://, h**p://, meow:// and fxp:// are refanged back to http/https/ftp at a scheme boundary before detection, so a defanged link is recovered as a real URL and flagged “was defanged”.
Will the extracted URL be clickable?: The results table shows the real (refanged) value for copying, and a “show defanged” toggle re-neutralizes it (hxxp[://]…) so you can safely paste it into a ticket or email without accidentally creating a live link.
Does it also extract the domain inside each URL?: Domains and URLs are detected as distinct indicator types. A URL is captured whole; a bare host mentioned elsewhere in the text is captured as a domain. Use the type filter chips to narrow to just URLs.

Extract other indicator types

See the full IOC types & defang-styles reference, or open the extractor and paste your own text.

Try it on your own text

Paste a report, advisory, or log, review the deduped indicators, filter to URL, and copy them with one click. Free, no account, nothing uploaded — extraction runs entirely in your browser.

Open this sample in the IOC Extractor →