Turn domains and URLs into hosts, AdGuard, Pi-hole, RPZ, dnsmasq or Unbound blocklists.
New
IOC Converter
Runs locallyNew
Use IOC Converter
What it does
Paste indicators of compromise or any text. The converter refangs and classifies URLs, domains, IP addresses, e-mail addresses and hashes, merges duplicates and writes them as a STIX 2.1 bundle, a MISP event, CSV, Suricata rules or a YARA skeleton.
It runs entirely in your browser: nothing you enter is uploaded.
Example
Drainer campaign IOCs with comments
hxxps://connect.wallet-verify[.]example/claim # drainer landing page
wallet-verify.example
198.51.100.23
2001:db8::23
support@wallet-verify.example
44d88612fea8a8f36de82e1278abb02f # EICAR test file6 unique IOCs: URL 1 Domain 1 IPv4 1 IPv6 1 E-mail 1 MD5 1
Each IOC is an indicator (spec_version 2.1, indicator_types malicious-activity) with a STIX pattern; the bundle and indicator IDs are random UUIDv4 values.
STIX 2.1 bundle (JSON)
{
"type": "bundle",
"id": "bundle--9bbd66dc-1735-4610-9fa4-1728d2d24160",
"objects": [
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--76bed4a1-d4de-40e2-990f-618d4808917c",
"created": "2026-10-20T17:09:59.108Z",
"modified": "2026-10-20T17:09:59.108Z",
"name": "https://connect.wallet-verify.example/claim",
"indicator_types": [
"malicious-activity"
],
"pattern": "[url:value = 'https://connect.wallet-verify.example/claim']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2026-10-20T17:09:59.108Z",
"description": "drainer landing page"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--795d119e-5917-4254-a8be-be240749baf6",
"created": "2026-10-20T17:09:59.108Z",
"modified": "2026-10-20T17:09:59.108Z",
"name": "wallet-verify.example",
"indicator_types": [
"malicious-activity"
],
"pattern": "[domain-name:value = 'wallet-verify.example']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2026-10-20T17:09:59.108Z"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--b44a4ee9-3bf6-41f7-9b7f-a74eee60b8be",
"created": "2026-10-20T17:09:59.108Z",
…A STIX 2.1 bundle with six indicators, for example [url:value = 'https://connect.wallet-verify.example/claim'] and [file:hashes.MD5 = '44d88612fea8a8f36de82e1278abb02f'], with each comment as the indicator description.
FAQ
Which IOC types are recognised and how are they mapped?
URLs, domains, IPv4 and IPv6 addresses (CIDR ranges too), e-mail addresses, MD5, SHA-1, SHA-256 and SHA-512 hashes, and Bitcoin and Ethereum addresses with checksum checks. STIX gets url, domain-name, ipv4-addr, ipv6-addr, email-addr and file:hashes patterns; MISP gets url, domain or hostname, ip-dst, email-src and the hash types.
What should I check before importing the result?
Free-text extraction can pick up file names that end in a real TLD (readme.md, archive.zip) or hex strings that are not file hashes, so review the IOC table first. Crypto addresses have no STIX object, Suricata rules cover only domains, URLs and IPs, and the YARA hash module has no SHA-512, so those entries are listed as not converted.
Is anything uploaded?
No. Parsing and conversion run in your browser, and the output is only copied or downloaded when you ask for it.