WebIOC
Local URL and IOC investigation
Turn a suspicious link into a structured investigation without uploading the page to the cloud. WebIOC captures what loaded, where it tried to send you, and which indicators are worth checking.
What you get in one capture
01
Redirect chain
Record HTTP redirects, meta refresh, JavaScript navigation, SPA history changes, and hop metadata in one collection.
02
Page evidence
Snapshot titles, request and response headers, view-source HTML, rendered DOM, and favicons with MD5, SHA1, and SHA256 hashes.
03
IOC extraction
Pull domains, URLs, IPs, emails, inline scripts, stylesheets, and linked assets from each hop in the chain.
04
Export and organize
Group investigations into collections, rename tabs, and export JSON, Markdown, HTML, or IOC CSV for tickets and reports.
WebIOC runs locally in your browser. Captured data stays on your machine in extension storage until you delete it. Capture runs only when you start it, not as background monitoring of everyday browsing.
Created by Mark Liapustin (clizSec) for the ScaMatrix security toolkit. Use it responsibly and only on content you are authorized to analyze.