iocextract
Extracts IPs, URLs, domains, emails and hashes from reports and text, including "defanged" ones like hxxp and [.].
Open iocextract ↗https://github.com/InQuest/iocextract
- Type
- Command line
- Cost
- Free
- Touches the target?
- No, passive
- Account needed
- No
- Category
- Threat intelligence
- Language
- Python
- License
- GPL-2.0
- Platforms
- linux, macos, windows
- Link status
- Online, checked 2026-09-26
Takes
Gives you
Install
pip install iocextractSource: github.com/InQuest/iocextract
Where to go next
Found something with iocextract? These tools take it as input.
IP address →
- AbuseIPDB
- AlienVault OTX
- ARIN WHOIS
- Blacklist Checker
- Blocklist.de
- BotScout
- BrightCloud URL/IP Lookup
- CC.LA
- Censys
- checkip
- CIRCL BGP Ranking
- Criminal IP
- DB-IP
- digga
- DNSlytics
- DNSRecon
- Domain Dossier
- DomainTools Whois
- ExoneraTor
- FireHOL IP Lists
- Focsec
- GreyNoise Visualizer
- HackerTarget Reverse DNS
- HoneyDB
- HoneyLabs
- Hurricane Electric BGP Toolkit
- IBM X-Force Exchange
- InfoSniper
- ip.thc.org
- IP2Location
- IPLocation.net
- IPtoASN
- IPVoid
- isMalicious
- Maltego
- Maltiverse
- Malwagon
- Masscan
- MaxMind GeoIP
- MetaDefender Cloud
- mnemonic Passive DNS
- MultiRBL
- MxToolbox
- Netlas.io
- Nmap
- Online Port scanner
- ONYPHE
- PeeringDB
- PhishStats
- Project Honey Pot
- Pulsedive
- Robtex
- SANS ISC / DShield
- SecurityTrails
- Shodan
- Spamhaus Reputation Checker
- SpiderFoot
- SynapsInt
- Team Cymru IP to ASN
- ThatsThem
- URLhaus
- urlscan.io
- utrace
- Validin
- ViewDNS.info
- VirusTotal
- Webscout
- Who.is
- YouGetSignal
Domain →
- AA419 Fake Sites Database
- AbuseIPDB
- AlienVault OTX
- AltDNS
- Apollo.io
- Blacklist Checker
- BrightCloud URL/IP Lookup
- BuiltWith
- CC.LA
- Censys
- Cerast Intelligence
- CertGraph
- CertKit CT Search
- CloudFail
- CompleteDNS DNS History
- CrawlGraph
- Criminal IP
- crt.sh
- Daily DNS Changes
- digga
- DNSDumpster
- DNSlytics
- DNSRecon
- dnstwist
- dnstwister
- DNSViz
- Domain Dossier
- DomainCrawler
- DomainHelp
- DomainTools Whois
- Email Format
- Email Permutator
- FullHunt
- Google Safe Browsing site status
- GrayhatWarfare Public Buckets
- Hunter
- Hurricane Electric BGP Toolkit
- IBM X-Force Exchange
- ICANN Lookup
- ImmuniWeb
- ip.thc.org
- IP2WHOIS
- isMalicious
- Maltego
- Maltiverse
- Malwagon
- MerkleMap
- mnemonic Passive DNS
- MultiRBL
- MxToolbox
- NameCheckup
- Namechk
- Netcraft Site Report
- Netlas.io
- Nikto Online
- Nmap
- onion-lookup
- ONYPHE
- OWASP Amass
- Pentest-Tools Google Hacking
- Pentest-Tools Subdomain Finder
- PhishStats
- PingCastle Azure Tenant Resolution
- Pulsedive
- Recon-ng
- Robtex
- scumware.org
- SecurityTrails
- Shodan
- Skymem
- Spamhaus Reputation Checker
- SpiderFoot
- SSL Labs Server Test
- Subfinder
- Sublist3r
- Sucuri SiteCheck
- SWITCH WHOIS (.ch / .li)
- SynapsInt
- theHarvester
- Trend Micro Site Safety Center
- urlDNA
- URLhaus
- urlscan.io
- URLVoid
- utrace
- Validin
- ViewDNS.info
- VirusTotal
- VoilaNorbert
- Wappalyzer
- Wayback Machine
- Web-Check
- Webscout
- Website Informer
- Who.is
- Whoisology
- YouGetSignal
- Zone-H
URL →
- ANY.RUN
- Archivarix Tube Search
- archive.today
- BrightCloud URL/IP Lookup
- Browserling
- changedetection.io
- CheckShortURL
- Find YouTube Video
- Google Safe Browsing site status
- IBM X-Force Exchange
- ImgOps
- ImmuniWeb
- Joe Sandbox
- Lookup-ID.com
- Maltiverse
- Malwagon
- MetaDefender Cloud
- Netcraft Site Report
- Nikto Online
- onion-lookup
- PhishStats
- Profile Image Intel
- Pulsedive
- ScamDB
- scumware.org
- Sucuri SiteCheck
- Telegram Finder
- TOsint
- Trend Micro Site Safety Center
- urlDNA
- URLhaus
- urlquery
- urlscan.io
- URLVoid
- VirusTotal
- Wappalyzer
- Wayback Machine
- Wayback Machine extension
- waybackpack
- waybackpy
- Web-Check
- Website Informer
- WhereGoes
- YouTube Metadata
- yt-dlp
- Zscaler Zulu
Email address →
- Blackbird
- BotScout
- Email Hippo
- Epieos
- Facebook account finder (recovery page)
- GHunt
- GitFive
- Have I Been Pwned
- holehe
- ID Ransomware
- isMalicious
- Lullar
- Maltego
- Minerva
- MIT PGP Key Server
- OSINT Industries
- Pipl
- Predicta Search
- Reacher
- Recon-ng
- ScamDB
- SearchPeopleFree
- SherlockEye
- Social Catfish
- SpiderFoot
- Spokeo
- SynapsInt
- Telegram Finder
- ThatsThem
- user-scanner
- UserSearch
- ViewDNS.info
- Whoisology
Similar tools
Interactive malware sandbox: run a file or URL in a virtual machine and watch its processes, network traffic and indicators live.
- Website
- Freemium
- Account
TakesDocument / fileURLFile hash
Extracts text and metadata (author, software, dates) from over a thousand file types, including Office files and PDFs.
- Command line
- Free
TakesDocument / fileImage
Reads and edits metadata in images, video, audio and documents, such as camera model, GPS coordinates, timestamps, author and software.
- Command line
- Free
TakesImageVideoDocument / file
The NSA's open-source reverse-engineering suite: disassembles and decompiles executables to show what a program really does.
- Desktop app
- Free
TakesDocument / file
Python tools (hachoir-metadata) that read metadata from dozens of binary file formats, including ones other tools skip.
- Command line
- Freemium
TakesDocument / fileImageVideo
Free OCR in 100+ languages: extract text from images and scanned PDFs so you can translate or search it.
- Website
- Free
TakesImageDocument / file