IOC extraction

Extract URLs, domains, IPs, email addresses, hashes, CVEs, and context observables from logs, headers, alerts, and reports locally in the browser, then deduplicate into defanged and redacted handoff output.

Local extraction

IOC types URLs, domains, IPv4, basic IPv6, email, MD5/SHA hashes, CVEs, and context identifiers.

Normalization Recognizes common defanged forms such as hxxp, [.], [dot], [:], and [@].

Dedupe Deduplicates by type and normalized value, retaining counts, first line, and flags.

Share-safe summary Hides query values, fragments, userinfo, header values, and private/internal originals by default.

Trust boundary

No uploadPasted text stays in the current browser and is not written to the address bar or browser storage.

No network lookupNo DNS, WHOIS, TLS, HTTP, backend, or remote lookup runs.

Share-safe summaryOutput is defanged by default, query values are redacted, and private/internal originals are filtered.

No risk conclusionExtracted strings are observables and still need authorized context review.

URLs are not rendered as clickable external links.
CVE, ASN, and ATT&CK-like identifiers are context references, not confirmed IOCs.
Before sharing, review whether hashes, domains, and email addresses may be disclosed.

Common next steps

Defang/refang: normalize individual IOC strings.
URL parser: inspect one URL query shape in detail.
Hash tools: calculate or compare local text/file digests.
File analysis: triage an authorized local sample in the browser.

Kept: 0Waiting for local extraction.

Types: 0Waiting for type normalization.

Attention: 0Private/internal and special-use originals stay out of the share-safe summary by default.

Report boundary: Completequery redacted; raw lines omitted; network not run.

Results table

Type	Value	Normalized	Count	Source lines	Flags	Category
No extraction yet; this page does not read the address bar or request targets.

Typed export Default output is defanged/redacted IOC text.

Share-safe summary