Home/IOC Parser
🔬 Threat Intelligence & Incident ResponseIOC Defanger & Converter

IOC Extractor, Defanger & Threat Intel Converter

Extract, normalize, and defang Indicators of Compromise (IOCs) from unstructured threat reports, email headers, malware analyses, or raw telemetry. Detect RFC 1918 private IPs and cloud metadata SSRF targets, launch 1-click VirusTotal/AbuseIPDB investigations, and export directly to STIX 2.1, Snort/Suricata, iptables, and CSV.

CTI Investigation Scenarios & Presets

Select an authentic threat intelligence report or paste your own raw artifacts.

Total IOCs
13
Public IPs
2
Domains
3
URLs
1
Hashes
2
CVEs
1

Extracted Indicators of Compromise

13 found
URLhxxps[://]telemetry-azure-sync[.]net/api/v2/beacon
Emailapt-drop[at]protonmail[.]com
SHA-256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
MD544d88612fea8a8f36de82e1278abb02f
IPv4185[.]220[.]101[.]5Public Routable
IPv4198[.]51[.]100[.]42Public Routable
IPv410[.]0[.]4[.]15RFC 1918 Private
IPv4192[.]168[.]1[.]100RFC 1918 Private
IPv4169[.]254[.]169[.]254🚨 Cloud Metadata (SSRF Target)
Domaincdn-update-service[.]com
Domaintelemetry-azure-sync[.]net
Domainprotonmail[.]com

Defensive Export & Security Integration Hub

Export verified IOCs directly into SIEMs, Firewalls, IDS/IPS rules, or STIX 2.1 feeds.

{
  "type": "bundle",
  "id": "bundle--secopspulse-1790028947635",
  "spec_version": "2.1",
  "objects": [
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--0-1790028947636",
      "created": "2026-09-21T22:15:47.635Z",
      "modified": "2026-09-21T22:15:47.635Z",
      "name": "CVE: CVE-2022-26923",
      "pattern": "[vulnerability:name = 'CVE-2022-26923']",
      "pattern_type": "stix",
      "valid_from": "2026-09-21T22:15:47.635Z"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--1-1790028947636",
      "created": "2026-09-21T22:15:47.635Z",
      "modified": "2026-09-21T22:15:47.635Z",
      "name": "URL: https://telemetry-azure-sync.net/api/v2/beacon",
      "pattern": "[url:value = 'https://telemetry-azure-sync.net/api/v2/beacon']",
      "pattern_type": "stix",
      "valid_from": "2026-09-21T22:15:47.635Z"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--2-1790028947636",
      "created": "2026-09-21T22:15:47.635Z",
      "modified": "2026-09-21T22:15:47.635Z",
      "name": "EMAIL: [email protected]",
      "pattern": "[email-addr:value = '[email protected]']",
      "pattern_type": "stix",
      "valid_from": "2026-09-21T22:15:47.635Z"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--3-1790028947636",
      "created": "2026-09-21T22:15:47.635Z",
      "modified": "2026-09-21T22:15:47.635Z",
      "name": "SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
      "pattern": "[file:hashes.'SHA-256' = 'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855']",
      "pattern_type": "stix",
      "valid_from": "2026-09-21T22:15:47.635Z"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4-1790028947636",
      "created": "2026-09-21T22:15:47.635Z",
      "modified": "2026-09-21T22:15:47.635Z",
      "name": "MD5: 44d88612fea8a8f36de82e1278abb02f",
      "pattern": "[file:hashes.MD5 = '44d88612fea8a8f36de82e1278abb02f']",
      "pattern_type": "stix",
      "valid_from": "2026-09-21T22:15:47.635Z"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--5-1790028947636",
      "created": "2026-09-21T22:15:47.635Z",
      "modified": "2026-09-21T22:15:47.635Z",
      "name": "IPV4: 185.220.101.5",
      "pattern": "[ipv4-addr:value = '185.220.101.5']",
      "pattern_type": "stix",
      "valid_from": "2026-09-21T22:15:47.635Z"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6-1790028947636",
      "created": "2026-09-21T22:15:47.635Z",
      "modified": "2026-09-21T22:15:47.635Z",
      "name": "IPV4: 198.51.100.42",
      "pattern": "[ipv4-addr:value = '198.51.100.42']",
      "pattern_type": "stix",
      "valid_from": "2026-09-21T22:15:47.635Z"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7-1790028947636",
      "created": "2026-09-21T22:15:47.635Z",
      "modified": "2026-09-21T22:15:47.635Z",
      "name": "IPV4: 10.0.4.15",
      "pattern": "[ipv4-addr:value = '10.0.4.15']",
      "pattern_type": "stix",
      "valid_from": "2026-09-21T22:15:47.635Z"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--8-1790028947636",
      "created": "2026-09-21T22:15:47.635Z",
      "modified": "2026-09-21T22:15:47.635Z",
      "name": "IPV4: 192.168.1.100",
      "pattern": "[ipv4-addr:value = '192.168.1.100']",
      "pattern_type": "stix",
      "valid_from": "2026-09-21T22:15:47.635Z"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9-1790028947636",
      "created": "2026-09-21T22:15:47.635Z",
      "modified": "2026-09-21T22:15:47.635Z",
      "name": "IPV4: 169.254.169.254",
      "pattern": "[ipv4-addr:value = '169.254.169.254']",
      "pattern_type": "stix",
      "valid_from": "2026-09-21T22:15:47.635Z"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--10-1790028947636",
      "created": "2026-09-21T22:15:47.635Z",
      "modified": "2026-09-21T22:15:47.635Z",
      "name": "DOMAIN: cdn-update-service.com",
      "pattern": "[domain-name:value = 'cdn-update-service.com']",
      "pattern_type": "stix",
      "valid_from": "2026-09-21T22:15:47.635Z"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--11-1790028947636",
      "created": "2026-09-21T22:15:47.635Z",
      "modified": "2026-09-21T22:15:47.635Z",
      "name": "DOMAIN: telemetry-azure-sync.net",
      "pattern": "[domain-name:value = 'telemetry-azure-sync.net']",
      "pattern_type": "stix",
      "valid_from": "2026-09-21T22:15:47.635Z"
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--12-1790028947636",
      "created": "2026-09-21T22:15:47.635Z",
      "modified": "2026-09-21T22:15:47.635Z",
      "name": "DOMAIN: protonmail.com",
      "pattern": "[domain-name:value = 'protonmail.com']",
      "pattern_type": "stix",
      "valid_from": "2026-09-21T22:15:47.635Z"
    }
  ]
}