IP Address Extractor

IP address extractor is a client-side utility that scans any block of text — server logs, firewall rules, configuration files, or documents — and returns every IPv4 and IPv6 address it finds as a deduplicated, line-separated list. Paste text of any length: from a single line to a multi-thousand-line log file. All detection runs in your browser via JavaScript regex against RFC 791 (IPv4 dotted-decimal) and RFC 5952 (IPv6, all notation forms) — no input text is transmitted to any server.

• IPv4 detection applies a dotted-decimal regex per RFC 791, then validates each octet within the 0–255 range — preventing false matches from sequences like 999.0.0.1. Both RFC 1918 private blocks (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and publicly routable ranges are extracted without filtering.
• IPv6 detection covers all standard notation forms defined in RFC 5952: full 8-group (2001:0db8:0000:0000:0000:0000:0000:0001), compressed (2001:db8::1), loopback (::1), link-local (fe80::1), and IPv4-mapped (::ffff:192.168.1.1). A multi-branch regex handles every valid compression pattern the RFC defines.
• Deduplication — each unique IP address appears exactly once in the output. If the same address occurs 100 times across a log file, it returns once. Output order reflects first occurrence in the input text.
• Processing model — all regex operations run synchronously in the browser's JavaScript engine. No HTTP request is made to any server during extraction. Input text and extracted addresses are never written to localStorage, sessionStorage, or any persistent storage.

Server log triage. A SOC analyst receives a 12,000-line Nginx access log during an incident response. Pasting the entire log into the IP Address Extractor returns a deduplicated source IP list in seconds — immediately ready for investigation using the IP Blacklist Checker or IP WHOIS Lookup, without opening a spreadsheet or writing a grep command.

Threat intelligence parsing. A threat intelligence team receives an industry report containing 40+ indicators of compromise embedded in paragraphs of prose. Copying the report text into the extractor isolates all IP-format IOCs from surrounding narrative — delivering a clean list for SIEM ingestion or bulk WHOIS investigation in one pass.

Configuration file audit. A network engineer needs to document every IP referenced across three firewall ruleset exports before a datacenter migration. Concatenating the configs and running the extractor returns a single deduplicated address inventory — turning a multi-hour manual review into a five-second operation.