# OSINT Indicator Extractor

> Find URLs, domains, IPs, e-mails, hashes and crypto identifiers in pasted text. Extract URLs, email addresses, domains, IPv4 addresses, common hexadecimal hashes, checksum-valid Bitcoin addresses and 0x-prefixed Ethereum addresses and hashes from pasted text, including bracket-dot defanged forms.

Part of usefulweb.site (https://usefulweb.site/). Results are deterministic calculations from the inputs and the listed assumptions; the API returns exactly what the web page shows.

## Use it
- Human interface: https://obscuriqindicatorextractor.usefulweb.site/ (interactive tool at https://obscuriqindicatorextractor.usefulweb.site/tool)
- JSON API: POST https://obscuriqindicatorextractor.usefulweb.site/api/v1/calculate with a JSON object of inputs (schema: https://obscuriqindicatorextractor.usefulweb.site/api/v1/tool)
- OpenAPI: https://obscuriqindicatorextractor.usefulweb.site/openapi.json
- MCP (Streamable HTTP): https://obscuriqindicatorextractor.usefulweb.site/mcp - tool `obscuriq_indicator_extractor`

## Inputs
- text (textarea): Text to inspect - Paste text you are authorized to review. No lookups are performed.

## Method
- Identify conservative ASCII patterns for HTTP URLs, email addresses, domains, IPv4 addresses and 32-, 40- or 64-character hexadecimal hashes.
- Bitcoin mainnet addresses count only when their Base58Check or Bech32/Bech32m checksum is valid; 0x followed by 40 hex characters is reported as an Ethereum address and 0x followed by 64 as an EVM hash (format only).
- Tokens that end in a common file extension such as .pdf, .txt or .exe are treated as file names, not domains.
- Keep the original matched text and count repeated indicators; domains, IPv4 addresses, hashes and Ethereum identifiers are grouped without regard to letter case and bracket-dot notation.

## Limits
- Matches are leads, not evidence that a host exists, a file is malicious, or an address belongs to a person. Unicode domains, IPv6 and unusual email formats are not covered; review results manually.