IOC Enrichment
Paste indicators or a report. Get a verdict, evidence and pivots.
Paste indicators and press Enrich, or load the sample.
Each indicator goes only to the public source for its type. Hashes and file names stay in this tab.
Sources and verdict rulesMethod: sources and verdict rules
The page splits the text into tokens, refangs each one (hxxp, [.], (dot), {.}, [:], [@], [://]), classifies it and merges duplicates. A domain must end in a TLD from the IANA root zone list. Unicode names are looked up as punycode. An IP keeps its port or CIDR prefix, a wheel file name becomes its PyPI package, and a hash after the word imphash or authentihash keeps that label. Other words are counted and skipped. Lookups run on 100 indicators at a time, four in parallel, from your browser. Results sort by verdict, worst first. Clean means none of these sources returned a signal; it is no reputation score.
| Type | Sources | Verdict rules |
|---|---|---|
| IPv4, IPv6 | RDAP from the regional registry (owner, block, abuse contact), RIPEstat (ASN), Tor Project Onionoo (exit relays) | Suspicious if a Tor exit. Info if a hosting or VPS network matched on the owner or ASN name, or a private, reserved or documentation range. Otherwise clean. |
| Domain, email | RDAP from the TLD registry for the registered domain (age, registrar, status, nameservers), Cloudflare DNS over HTTPS (A, AAAA, MX, NS) | Suspicious if registered under 30 days ago, on client or server hold, or a subdomain of a tunnel or dynamic DNS service. Info if it does not resolve, is under 90 days old, or sits on a shared platform such as pages.dev or github.io. Otherwise clean. |
| URL | The host, as an IP or domain | The host's verdict. A URL on a bare IP is at least suspicious. |
| npm, PyPI package | OSV query API, npm registry or PyPI JSON API | Malicious if OSV has a MAL- record for the name, or npm shows a security holding package. Suspicious if the given version has advisories. Info if versions have advisories and none was given, or the name is on no registry. Otherwise clean. |
| CVE | CISA KEV (kev-data on GitHub), CVE.org record (summary, CVSS), FIRST EPSS | Malicious if on KEV (exploited in the wild), with ransomware use noted. Suspicious if EPSS is 50% or more. Otherwise info. |
| Hash, file name | None; pivots only | Info. Hash services need an API key or block cross-site requests, so the type and pivot links are what a page can give. |
- IP
149.28.17.9,185[.]220[.]101[.]1,2a0b:f4c2::1- Domain, URL, email
evil[.]example,hxxps[://]evil[.]example/login,billing[@]evil[.]example- Package
[email protected],npm:@scope/[email protected],pypi:requests,requests==2.19.0,pkg:pypi/[email protected]- CVE, hash
CVE-2024-3400,CVE 2023-4966, MD5, SHA1, SHA256 or SHA512 hex, with or without asha256:prefix,imphash: <md5>- In report text
185.220.101.1:443,45.9.148.0/24,evil[.]example/gate.php,evil[.]example:8443,münchen.de,pkg-1.0-py3-none-any.whl,?u=https%3A%2F%2Fevil.example
Accuracy and how it compares
Extraction measured on 6 November 2026 with the same code this page runs, against iocextract 1.16.1 and ioc-finder 9.4.1. F1 over IPv4, IPv6, domains, URLs, emails, hashes and CVEs. For the ESET reports the truth is the MISP event and IOC tables of each report, plus any value a tool found that fixed rules accept as a well-formed indicator in the text (TLD on the IANA list, valid address, standalone hex).
| Test set | This page, before | This page, now | ioc-finder | iocextract |
|---|---|---|---|---|
| ESET malware-ioc: 24 reports with a MISP event, 2,866 labelled indicators (commit 825b826) | F1 0.922 | F1 0.997 | F1 0.957 | F1 0.827, no domains or CVEs |
| ioc-finder test cases: 94 cases, ioc-finder's own labels (commit 1fb7d7b) | F1 0.736 | F1 0.911 | F1 0.983 | F1 0.717 |
| iocextract valid list: lines that hold an indicator (commit 653b8b5) | 40 of 48 | 45 of 48 | 44 of 48 | 48 of 48 |
| Edge cases: defang styles, IDN and homoglyphs, ports, CIDR, nested and encoded URLs, version strings (45, written by us) | 32 of 45 | 45 of 45 | 38 of 45 | 20 of 29 it covers |
| Report pasted whole: rows sent to lookup that were plain words, ESET set | 72% | 0% | n/a | n/a |
| Feature | This page | IntelOwl 6.8.0 | Cortex analyzers 3.10.2 | MISP 2.5.50 | CyberChef 11.5.0 |
|---|---|---|---|---|---|
| Setup | None, runs in the browser | Self-hosted server | Self-hosted server | Self-hosted server | Browser |
| Indicators from report text | Yes, with refang, IDN, ports and nested URLs | Takes typed observables | Takes typed observables | Freetext import | Extract recipes per type |
| Keyless lookups | RDAP, DNS, Tor, ASN, OSV, KEV, EPSS, CVE record | Many analyzers, most need keys | Many analyzers, most need keys | misp-modules, some keyless | None |
| Hash reputation | Pivot links only | Yes, with keys | Yes, with keys | Via modules, with keys | None |
| Exports | Markdown, CSV, STIX 2.1 bundle, MISP event JSON | JSON over the API | JSON report | STIX, CSV and more | Text |
| TLP | TLP 2.0 marking on STIX and MISP exports | Per job | Per job, with PAP | Taxonomy tags | None |
Exports checked: every STIX bundle, with each TLP level, passes the OASIS stix2-validator 3.3.1 against cti-stix2-json-schemas 9af1db4. The MISP event loads in PyMISP 2.5.34.4 with every attribute type and category on MISP's list. TLP 2.0 marking IDs match the OASIS cti-stix-common-objects definitions.
Known limits: hashes get no reputation, since every hash service needs a key or blocks other sites. An sdist name such as pkg-1.0.tar.gz stays a file name, so the ESET PyPI report gives 26 of its 53 projects (the wheels). XMPP addresses count as email. A .zip or .mov name counts as a domain unless it carries a second extension or a version. Domains inside URL paths and query strings are kept only when they sit in a nested URL.
IOC enrichment FAQ
What do the verdicts mean?
Malicious: a source names it as malware or as exploited in the wild (an OSV MAL record, an npm security holding package, or a CVE on CISA KEV). Suspicious: a signal worth a closer look, such as a Tor exit, a domain under 30 days old or on hold, a URL on a bare IP, or a package version with known vulnerabilities. Info: context with no judgement, such as a hosting network or a hash. Clean: none of the checked sources returned a signal. Lookup failed: the sources did not answer.
Where do my indicators go?
Each indicator goes only to the public source that answers for its type, straight from your browser: RDAP, Cloudflare DNS over HTTPS, RIPEstat and the Tor Project for IPs and domains, OSV and the npm or PyPI registry for packages, and CVE.org, FIRST and the CISA KEV file for CVEs. Hashes and file names never leave the page. pwnsy has no server in the path and stores nothing.
Why are hashes not looked up?
VirusTotal, MalwareBazaar and the other hash services need an API key or block requests from other websites, so a page cannot query them without a server holding a key. The tool names the hash type and gives one-click pivots to each service instead.
How does it know a package is malicious?
OSV publishes malicious package reports from the OpenSSF malicious-packages project and GitHub's malware advisories under IDs starting with MAL-. Any MAL record for the package name marks it malicious, whatever the version. npm also replaces removed malware with a placeholder version ending in -security, which the tool reads from the registry.
Can I paste a whole threat report?
Yes. Paste the text or open a .txt, .md, .csv, .json or .html file. The page keeps IPs, domains, URLs, emails, hashes, CVEs and packages, skips the other words, and looks up 100 indicators at a time. On 24 ESET reports it found 99.9% of the labelled indicators with 99.5% precision.
Which export goes into MISP, OpenCTI or a SIEM?
MISP event JSON imports into MISP as a new event, with to_ids set on malicious and suspicious rows and the TLP as a tag. The STIX 2.1 bundle imports into OpenCTI and other STIX tools: one indicator per IP, domain, URL, email, hash or package, a vulnerability object per CVE, and the TLP 2.0 marking definition. CSV suits a spreadsheet or a SIEM lookup table.
Why is a Tor exit only suspicious?
Many people share each exit relay, so the address says the traffic was anonymised and says nothing about who sent it. Treat a Tor exit in a sign-in or admin log as a reason to check the session, and block on the full exit list if policy says so.
Registration data over RDAP from each registry, found through the IANA bootstrap files, with rdap.org as fallback. DNS from Cloudflare DNS over HTTPS. ASN from RIPEstat. Tor relays from the Tor Project's Onionoo. Packages from OSV, npm and PyPI. CVEs from the CISA KEV catalog, CVE.org and FIRST EPSS. The sample uses real public indicators: a malicious npm package (MAL-2024-8847), a Tor exit relay, a Vultr address, CVE-2024-3400 and the EICAR test file hash.