How to use it
- Paste the text. Reports, SIEM alerts, email headers and chat logs all work.
- Extract. Indicators are grouped by type. Each one has links to the right Max Intel tool and the main outside databases.
- Quick check if you want a first look. It adds open ports and Shodan tags for IPs, the network owner, and Team Cymru’s malware rate for MD5 and SHA-1 hashes.
- Export for your notes or your platform. Markdown and the copied list are defanged. STIX 2.1 imports into MISP and OpenCTI.
Why refang and defang?
Reports write evil[.]com or hxxp:// so a link cannot be clicked by mistake. Lookup tools need the real value, so this page refangs everything it reads. It recognises [.] (.) {.} [dot] [:] [@] [at] and hxxp. Copies go out defanged again, so your notes stay safe to share.
What it does not do
It does not score or judge an indicator. A quick check that finds nothing means no evidence, not a clean bill of health. The IP threat triage goes deeper on a single address. The hash page checks hashes against malware and known-file lists. For when a browser tool is not enough, read checking an IOC without a threat-intel platform.
Frequently asked questions
What is an IOC?
An indicator of compromise is a technical clue left by an attack. Common ones are IP addresses, domains, URLs, file hashes and email addresses. Threat reports list them so defenders can search their own logs.
What does refang and defang mean?
Reports defang indicators, such as evil[.]com or hxxp://, so nobody clicks them by accident. Refanging turns them back into working values for lookups. This tool refangs on input and can defang again for copying.
Does this tool send my text anywhere?
No. Extraction runs in your browser. Only the optional quick check sends indicators out: IPs to Shodan InternetDB, and IPs, hashes and domains as DNS queries to Google Public DNS.
Why are private IP addresses hidden?
Addresses such as 10.x, 192.168.x and 100.64.x belong to internal networks. Public threat feeds know nothing about them. They are listed separately so you can still find them in your own logs.
What is STIX and why export it?
STIX 2.1 is the standard format threat-intel platforms use to share indicators. The export creates one indicator per IOC, ready to import into MISP or OpenCTI.
Is a clean quick check proof an indicator is safe?
No. A blank result means no evidence was found in the sources checked. Read the full reports, and check the indicator against your own logs.