# osintverse-community/ioc-finder

Extracts indicators such as URLs, domains, IPs, emails, hashes and CVEs from a piece of text

## Install and run

```sh
ot install osintverse-community/ioc-finder
ot run osintverse-community/ioc-finder --text "Contact example@example.com about 1.1.1.1 and https://example.com/a"
```

The first `ot run` installs the tool after asking once. New to `ot`? See https://otinstaller.com/docs/getting-started.

From an AI agent, through ot's MCP server (`ot mcp`):

```
run_tool {"tool":"osintverse-community/ioc-finder","inputs":{"text":"Contact example@example.com about 1.1.1.1 and https://example.com/a"}}
```

## Inputs

| Name | Type | Required | Default | Description |
| --- | --- | --- | --- | --- |
| `text` | string | yes |  | Text to parse (defanged indicators like example[.]com are refanged) |

## Outputs

Finds: url, domain, ip, email, crypto_address, other.

- `other`: Hashes, CVEs, ASNs, file paths and other observables

## What a run does

- Does not contact the target.
- Does not collect personal data.
- Does not need an account.
- Does not notify the target.
- Usually takes about 2 seconds.
- Runs offline (no network access).

This tool is passive, so an agent can run it without asking. See https://otinstaller.com/docs/agents#consent.

## Trust

- Latest version: 9.4.1
- Signed: yes
- Verified publisher: yes
- Health: unknown
- Installs in the last 30 days: 0
- License: LGPL-3.0
- Runtime: Python wheel (pipx), pinned by hash
- Repository: https://github.com/osintverse-community/ioc-finder
- Packaged by the community from a third-party tool

## Links

- Web page: https://otinstaller.com/osintverse-community/ioc-finder
- JSON: https://api.otinstaller.com/v1/tools/osintverse-community/ioc-finder
- README: https://github.com/osintverse-community/ioc-finder#readme
- Homepage: https://github.com/fhightower/ioc-finder
- Security details: https://otinstaller.com/osintverse-community/ioc-finder/security