usefulweb.siteDependable little tools for people and AI agents. OSINT Indicator Extractor
Theme: Auto

Theme

Premium apps

OSINT Indicator Extractor

Find URLs, domains, IPs, e-mails, hashes and crypto identifiers in pasted text.

Paste text you are authorized to review. No lookups are performed.

☁ Sign in to save to your Google Drive

Try an example: Extract indicators from a note · Find crypto identifiers

More about this tool

How it works

Extract URLs, email addresses, domains, IPv4 addresses, common hexadecimal hashes, checksum-valid Bitcoin addresses and 0x-prefixed Ethereum addresses and hashes from pasted text, including bracket-dot defanged forms.

  • Identify conservative ASCII patterns for HTTP URLs, email addresses, domains, IPv4 addresses and 32-, 40- or 64-character hexadecimal hashes.
  • Bitcoin mainnet addresses count only when their Base58Check or Bech32/Bech32m checksum is valid; 0x followed by 40 hex characters is reported as an Ethereum address and 0x followed by 64 as an EVM hash (format only).
  • Tokens that end in a common file extension such as .pdf, .txt or .exe are treated as file names, not domains.
  • Keep the original matched text and count repeated indicators; domains, IPv4 addresses, hashes and Ethereum identifiers are grouped without regard to letter case and bracket-dot notation.

Matches are leads, not evidence that a host exists, a file is malicious, or an address belongs to a person. Unicode domains, IPv6 and unusual email formats are not covered; review results manually.

Sources

Part of OBSCURIQ

How to use the OSINT Indicator Extractor

Pull URLs, domains, e-mail addresses, IPs, hashes and Bitcoin or Ethereum identifiers out of pasted text — without any lookup.

What it is for

Security alerts, phishing e-mails, chat logs and incident write-ups bury the useful details in prose. The extractor reads text you are allowed to review and lists the indicators in it: HTTP and HTTPS URLs, e-mail addresses, domains, IPv4 addresses, 32-, 40- and 64-character hexadecimal hashes, Bitcoin addresses and 0x-prefixed Ethereum addresses and hashes. It understands defanged forms such as hxxps:// and example[.]org.

Nothing is looked up. The tool does not resolve a domain, open a link or ask a blockchain explorer anything; it only recognizes patterns. In the OBSCURIQ workspace the same engine runs in your browser and lets you add the matches to a case.

Worked example

Paste this gateway alert: Gateway alert: helpdesk@mail.examplecorp-verify.example linked hxxps://login.examplecorp-verify[.]example/owa/?id=8812 (resolved to 192.0.2.44, later 198.51.100.7). Attachment invoice.pdf, MD5 44d88612fea8a8f36de82e1278abb02f. The second mail asks for a fee to bc1qw508d6qejxtdg4y5r3zarvary0c5xw7kv8f3t4 or 0x000000000000000000000000000000000000dEaD. Mirror at EXAMPLECORP-VERIFY[.]example and examplecorp-verify.example.

The tool answers 8 unique indicators in 9 occurrences: one e-mail address, the defanged URL, two IPv4 addresses, the MD5 hash, a Bitcoin address, an Ethereum address and the domain. The two spellings of the mirror domain are grouped into one row with two occurrences. invoice.pdf is not listed: tokens ending in a common file extension count as file names, not domains.

How to read the result

Each row has a type, the text exactly as it was first written, and how often it occurred. Domains, IPv4 addresses, hashes and Ethereum identifiers are grouped regardless of letter case and bracket-dot notation; URLs and e-mail addresses are counted as written, because a path or a mailbox name can be case-sensitive. A host inside a URL or e-mail address is not listed again on its own.

Bitcoin address means the checksum (Base58Check or Bech32/Bech32m) is valid, so a typo is unlikely. Ethereum address and EVM hash are format checks only. Hash is any 32, 40 or 64 hex characters — it may be MD5, SHA-1 or SHA-256, or something else entirely.

Tips and common mistakes

  • Treat every row as a lead. A match says nothing about whether a host exists, a file is malicious or who controls an address.
  • Keep the original text next to the result so a reviewer can see the context of each indicator.
  • A 64-character hex string can be a SHA-256 file hash or a Bitcoin transaction id; the surrounding sentence usually tells you which.
  • IPv6, Unicode domains and unusual e-mail forms are not recognized, so an empty table does not prove the text is clean.
  • Inputs are limited to 100,000 characters and 2,000 matches; split long reports and check the boundaries.

FAQ

Does the tool contact any of the domains or addresses?

No. It works on the submitted text only and performs no DNS, web or blockchain request.

Why is a Bitcoin address with one wrong character missing?

Bitcoin addresses are listed only when their checksum is valid. A mistyped address fails the checksum and is left out, which avoids recording a wrong lead.

Why does the extractor show the defanged spelling?

It keeps the first spelling it saw so you can trace it back to the source. Use IOC Defang and Refang to convert the whole text.

Can it prove that two indicators belong together?

No. Appearing in the same message is context, not a relationship. Corroborate links between indicators with independent sources.

Guide last updated:

For scripts and AI agents

  • JSON API: POST https://obscuriqindicatorextractor.usefulweb.site/api/v1/calculate (same calculation as this page)
  • Interface description: OpenAPI 3.1 · AI guide: llms.txt
  • MCP server (Streamable HTTP): https://obscuriqindicatorextractor.usefulweb.site/mcp · tool name obscuriq_indicator_extractor
Example request
curl -s -X POST https://obscuriqindicatorextractor.usefulweb.site/api/v1/calculate \
  -H 'content-type: application/json' \
  -d '{"text":"Suspicious link hxxps://example[.]org/login and analyst@example.org. Host 192.0.2.10 appears twice: 192.0.2.10."}'
Feedback · ideas & bug reports welcome