Skip to content
COEUS
Install

IOC Extractor

Extract domains, IP addresses, URLs, hashes and other identifiers from pasted text while keeping their original context.

Processed in your browser. Your input is not uploaded.

Source text

0 / 100,000

Results

Run the extractor to see results.

Results stay empty until you choose Extract indicators.

A recognised identifier is a lead, not a verdict. Investigate sends only the selected value to Coeus, where you can check sources and explicitly Save it. Getting started. To continue, use Chrome or Edge on a computer; these local results remain here.

How to use it

  1. 1

    Add your text

    Paste a report, email, log excerpt or other plain text.

  2. 2

    Extract identifiers

    Run the local detector to find and deduplicate supported identifier types.

  3. 3

    Review and act

    Use the original context, copy what you need, or hand one identifier to Coeus.

What the results mean

A match is an identifier, not a verdict.

This tool recognises formats. It does not assess reputation, intent or whether a value is malicious.

Context comes from your original text.

Results show a short excerpt around the first occurrence. Duplicate occurrences are counted, not repeated.

Related tools

Keep working with the same local-first toolkit.

URL ParserRead URL structure and reveal supported Safe Links destinations.Email AnalyzerInspect supplied email evidence without uploading the message.