Text Pattern Extractor

Extract every pattern from a paste or a log

Paste text or open a file, tick the types you want, and the output lists every match in the order it first appears. With Unique on, repeats collapse to one line, and the CSV export keeps the count and the line number where each value first appears.

Each type is validated, not only matched by shape:

• IPv4 octets must be 0-255, and a run like 1.2.3.4.5 (a version string) is refused.
• IPv6 candidates go through a full parser and come out in the RFC 5952 short form, so 2001:0DB8:0000:0000:0000:0000:0000:0001 becomes 2001:db8::1. Clock times like 12:30:45 and C++ scopes like std::vector never match.
• Domains and emails must end in one of the 1,437 top-level domains in the IANA root zone list. x@host.local and notes.zzzz are dropped.
• URLs lose trailing punctuation from the sentence around them, keep a closing bracket only when it pairs with an opening one (Mercury_(planet) stays whole), and come out of Markdown links and <angle brackets>.
• MAC addresses in AA:BB:CC:DD:EE:FF, aa-bb-cc-dd-ee-ff and Cisco aabb.ccdd.eeff notation are all printed as lowercase colon pairs.

File names that look like domains

Plenty of file extensions are also real top-level domains: .py is Paraguay, .sh is Saint Helena, .md is Moldova, and .zip and .mov were sold as generic domains. A bare deploy.sh in a build log is a script, not a host. Names ending in those extensions are listed only when they sit inside a URL (https://bun.sh/install) or an email address, where they can only be a host.

Domains also come from URLs and email addresses, so https://www.Example.org/x adds www.example.org, and admin@corp.io adds corp.io.

Defanged indicators

Threat reports and incident tickets write addresses in a broken form, such as hxxps://evil[.]com or ops[at]corp[dot]io, so nobody opens them by accident. The extractor reads those forms as the real characters before matching, so a defanged report extracts as cleanly as a raw log.

Defang works the other way, on the output. URLs become hxxps://evil[.]com/a.php (only the host’s dots are bracketed), emails become ops[@]corp[.]io, IPv4 dots and IPv6 colons are bracketed, and hashes, MACs and CVE IDs are left alone because they never resolve.

Output formats

• List prints one value per line, under a # Emails (12) heading per type when more than one type has matches.
• CSV writes type,value,count,first_line, or type,value,line for every occurrence when Unique is off. Hash rows use md5, sha1, sha256 or sha512 as the type.
• JSON writes one array of strings per type, ready for a script or a blocklist import.
• Text returns the whole input with every indicator rewritten in place, defanged when Defang is on and refanged when it is off.

Large logs

Open or drop a file instead of pasting it. Above 256 KB the scan runs in a background worker, so the page stays responsive, and a 10 MB access log takes about a second on a desktop machine. Files over 2 MB are scanned in full but shown only as a name and size, and output over 1 MB is previewed in the pane with the full result in the download.

Limits

Email local parts are matched in ASCII (a-z, digits and ._%+-), so an address like josé@exemple.fr is missed. Bare domains must be ASCII too; a URL with an internationalised host is still found and its domain comes out in xn-- form. Obfuscation without brackets, such as name at example dot com, is not read as an address, because ordinary prose would produce false matches.