Data / IOC Extractor

Paste any text — a log file, a security report, a raw email — and the tool extracts all structured data it can find: email addresses, URLs, IPv4 and IPv6 addresses, domains, file hashes (MD5, SHA-1, SHA-256), UUIDs, and MAC addresses. Each type is listed separately with counts. Useful for security analysis (extracting IOCs) or data mining from unstructured text.

What it does

▸Extracts email addresses with validation
▸Extracts URLs (http and https)
▸Extracts IPv4 addresses (with octet validation) and IPv6 addresses
▸Extracts domain names (common TLDs)
▸Extracts file hashes: MD5 (32 chars), SHA-1 (40 chars), SHA-256 (64 chars)
▸Extracts UUIDs and MAC addresses
▸Each type is listed separately with count and deduplicated

Use cases

▸Extracting indicators of compromise (IOCs) from a security report
▸Pulling email addresses and URLs from a raw email for analysis
▸Extracting IP addresses and hashes from a malware analysis report
▸Mining structured data from unstructured log files

How it works

Paste your text into the input pane

The tool runs regex patterns for each data type

Extracted items are grouped by type and displayed in the output

Copy the extracted data for use in your analysis or report

Frequently asked questions

1What are IOCs?

Indicators of Compromise are artifacts observed in a security incident — malicious IPs, domains, URLs, file hashes, etc. Security teams extract IOCs from threat reports to feed into detection systems like SIEMs, firewalls, and EDR platforms.

2How does it validate IP addresses?

For IPv4, the tool validates that each octet is 0-255. This prevents false positives like version numbers (1.2.3.4 in a version string) from being extracted as IPs. IPv6 addresses are matched by pattern.

3Can it extract custom patterns?

The tool extracts the predefined set of data types. For custom patterns, use the RegExp Tester to build and test a regex, then use the Line Filter tool to extract matching lines.