IOC Extractor & Defanger
Pull URLs, domains, IP addresses, email addresses, hashes and CVE IDs out of any text — defanged and ready for a ticket — and brute-force single-byte XOR.
How to use
- Paste a threat report, an email with its headers, log lines or a sandbox report.
- Filter by type, then copy the list defanged (safe for tickets and chat) or as CSV.
- For obfuscated data, open “Single-byte XOR brute force” and send the best key to the workbench.
Single-byte XOR brute force
Malware often hides strings and payloads with one-byte XOR. All 255 keys are tried on the input; the most readable results come first.
Paste hex, Base64 or text above.
What counts as an indicator
Indicators of compromise are the concrete values you can search, block or share: URLs, domains, IP addresses, email addresses, file hashes and the CVEs being exploited. The extractor finds them in any text — reports, email headers, logs, sandbox output — removes duplicates, counts how often each appears, and labels private, loopback, documentation and other reserved IP ranges so you do not block your own network by mistake.
Domains are recognised by their top-level domain, so names like System.Net.WebClient or invoice.pdf are not listed. Names ending in a TLD that is also a file extension, such as .sh or .zip, are listed only when they appear in a URL or an address.
Defang before you share
Ticket systems, chat and email turn plain URLs into live links, and some even fetch them for a preview — which can alert an attacker or infect an analyst. Defanged indicators such as hxxps://evil[.]example stay readable but inert. With “Refang first” on, defanged input from other reports is read as the real indicator, so lists from different teams can be merged and de-duplicated.
Single-byte XOR
Malware often hides strings, configuration and second stages with a one-byte XOR key. The brute force tries all 255 keys, ranks the results by how much readable text they contain and by clues such as URLs, Windows API names or an MZ header, and sends the best key to the workbench as a ready chain. Multi-byte and rolling keys need a debugger or a dedicated tool.
Common questions
What does defanging an IOC mean?
Changing a URL or address so it can’t be clicked or resolved by accident — hxxps://evil[.]example instead of https://evil.example. Ticket systems, chat and email turn plain URLs into live links; defanged ones stay inert.
Can it read indicators that are already defanged?
Yes. With “Refang first” on, hxxp, [.], (dot), [at] and similar forms are read as the real indicator, so reports from other teams can be re-extracted and de-duplicated.
Why is a private IP like 10.0.0.5 marked?
Private, loopback, documentation and other reserved ranges can’t be attacker infrastructure on the internet. They are kept — they often identify the affected host — but labelled so you don’t block them by mistake.
Known limitations
- Domains are recognised by their TLD; file-like ones (.sh, .zip) need a URL or address.
- No reputation, WHOIS or DNS lookups.
- XOR search: one-byte keys on the first 64 KB. Up to 5 MB of text.
- Browser extensions can read any page — use a private window for sensitive data. How the lock works
Related reading on CipherMind
Standards & references
- CISA — sharing indicators (STIX/TAXII) (opens in a new tab)
- RFC 5952 — IPv6 text representation (opens in a new tab)
- RFC 6890 — special-purpose IP address ranges (opens in a new tab)
- MITRE ATT&CK T1027 — Obfuscated files or information (opens in a new tab)
- CVE program — ID format (opens in a new tab)