Intelligence & OSINT · free, no signup
IOC Normaliser & Correlator
Indicator lists arrive from three places at once — a PDF where everything was defanged, a SIEM export where nothing was, and a colleague's message where half of it is prose. This refangs, deduplicates and types them into one comparable set, and says out loud what the pile actually contains. It never claims an indicator is malicious: it consults no feed and makes no request, so the only honest statement available is about an indicator's FORM. That boundary is the tool rather than a gap in it — "this is a well-formed SHA-256" and "this is bad" are different claims, and conflating them is how a list of collection artefacts ends up in a blocklist and takes a network down.
Authorized, defensive use only. Check assets you own or lawfully public data. This tool is educational and never provides another party's private data.
Paste indicators from wherever they came from — a report where everything was defanged, an export where nothing was, a message that is half prose. This refangs, deduplicates and types them into one comparable set, and tells you what the pile actually contains.
It never claims an indicator is malicious. No feed is consulted and no request is made, so the only honest statement available is about an indicator's form — “this is a well-formed SHA-256” and “this is bad” are different claims, and conflating them is how a list of collection artefacts ends up in a blocklist.
What happens to what you enter
- The analysis runs on Solvex servers. What is recorded afterwards is a SHA-256 hash of your input and a coarse summary of the outcome — never the input itself, and never a result you could be identified from.
- Tools that read public sources (certificate logs, DNS, a public chain) contact those sources from our servers through a fetcher that refuses private and internal addresses.
- An email address is stored only where a tool offers to send you a report and you choose to give one.
Limits: ten runs of this tool per minute from one address, and three signed reports per minute. Past that the tool says so and tells you when to try again.
When a free check is not enough
This tool reads what is public and reports what it can see. The Managed Detection & Response (EDR/XDR) engagement is the authorized, specialist-led version: signed scope, findings proven by hand, a signed report, and a retest.
Explore Managed Detection & Response (EDR/XDR)