# IOC Converter

URL: https://phishdestroy.io/developer-tools/ioc-converter
Category: Reporting & IOC
Where it runs: Runs locally (nothing you enter is uploaded)

Paste indicators of compromise or any text. The converter refangs and classifies URLs, domains, IP addresses, e-mail addresses and hashes, merges duplicates and writes them as a STIX 2.1 bundle, a MISP event, CSV, Suricata rules or a YARA skeleton.

## Example input

Drainer campaign IOCs with comments

```
hxxps://connect.wallet-verify[.]example/claim  # drainer landing page
wallet-verify.example
198.51.100.23
2001:db8::23
support@wallet-verify.example
44d88612fea8a8f36de82e1278abb02f  # EICAR test file
```

A STIX 2.1 bundle with six indicators, for example [url:value = 'https://connect.wallet-verify.example/claim'] and [file:hashes.MD5 = '44d88612fea8a8f36de82e1278abb02f'], with each comment as the indicator description.

## FAQ

### Which IOC types are recognised and how are they mapped?

URLs, domains, IPv4 and IPv6 addresses (CIDR ranges too), e-mail addresses, MD5, SHA-1, SHA-256 and SHA-512 hashes, and Bitcoin and Ethereum addresses with checksum checks. STIX gets url, domain-name, ipv4-addr, ipv6-addr, email-addr and file:hashes patterns; MISP gets url, domain or hostname, ip-dst, email-src and the hash types.

### What should I check before importing the result?

Free-text extraction can pick up file names that end in a real TLD (readme.md, archive.zip) or hex strings that are not file hashes, so review the IOC table first. Crypto addresses have no STIX object, Suricata rules cover only domains, URLs and IPs, and the YARA hash module has no SHA-512, so those entries are listed as not converted.

### Is anything uploaded?

No. Parsing and conversion run in your browser, and the output is only copied or downloaded when you ask for it.

## Related tools

- [Blocklist Converter](https://phishdestroy.io/developer-tools/blocklist-converter)
- [URL Defanger & IOC Extractor](https://phishdestroy.io/developer-tools/url-defanger)
- [Abuse Report Generator](https://phishdestroy.io/developer-tools/abuse-report-generator)
- [Abuse Contact Lookup](https://phishdestroy.io/developer-tools/abuse-contact-lookup)
- [EML Analyzer](https://phishdestroy.io/developer-tools/eml-analyzer)
- [File Hash Calculator](https://phishdestroy.io/developer-tools/file-hash)

All tools: https://phishdestroy.io/developer-tools