IOC Defanger
Safely defang and refang malicious indicators for secure SOC sharing and documentation.
Defanging Reference
What is Defanging?
Defanging is the practice of modifying malicious indicators (IOCs) to prevent accidental clicks or automatic parsing. This makes it safe to share in reports, emails, and tickets.
Canonical defang output
.→[.]http/https→hxxp/hxxps://→[://]@→[@]:→[:](inside IPv6 only)
Refang accepts
- Dots:
[.](.){.}[dot](dot){dot} - At:
[@](@){@}[at](at){at} - Colon:
[://](://){://}[:] - Scheme:
hxxp(s)h**p(s)h__p(s)fxp(s)://
Supported IOC Types
- URLs (with port, path, query)
- IPv4 and IPv6 addresses
- Domain names
- Email addresses
- Mixed / multi-line text
- File hashes and CVE IDs are left untouched
Use Cases
- Security incident reports
- Threat intelligence sharing
- SOC ticket documentation
- Email communications
How to defang a URL or IOC
- Paste your indicators into the Defang IOCs box: one per line, or a whole paragraph copied from an alert. For example
https://login-update.example.net/verify,203.0.113.45andbilling@example.net. - Leave all four options ticked for the usual style, or untick the ones your team does not use.
- Press Defang, check the output and the URL, IP and email counts, then Copy to Clipboard and paste into your ticket or report.
- To go the other way, open Refang IOCs, paste the defanged list and press Refang.
What the output means
With every option on, the three examples above become hxxps[://]login-update[.]example[.]net/verify, 203[.]0[.]113[.]45 and billing[@]example[.]net. Each change breaks a different auto-linker: hxxps and [://] stop URL detection, [.] stops bare domains and IPs from being linked, and [@] stops mail clients from creating mailto: links.
The counts show how many URLs (http and https), IPv4 addresses and email addresses were found in what you pasted, so you can confirm nothing was missed. Running Defang on text that is already defanged gives the same result; it does not produce [[.]].
Refanged output is live again. Paste it into tools, not into a browser address bar, and keep it out of chat channels where it will be auto-linked.
Frequently asked questions
What does it mean to defang a URL?
Defanging rewrites an indicator so it can no longer be clicked or auto-linked: https://evil.example.com/login becomes hxxps[://]evil[.]example[.]com/login. People can still read it and copy it, but mail clients, chat apps and ticket systems will not turn it into a live link.
How do I refang an IOC?
Switch to the Refang IOCs tab, paste the defanged text and press Refang. It reverses [.], [dot], (dot), {.}, [@], [at], [://], hxxp and hxxps, so you can feed the indicators to a blocklist, SIEM search or sandbox.
Is there a standard way to defang IOCs?
No formal standard exists, but hxxp and [.] are the most widely used conventions in threat reports, and most parsers and threat intel platforms can refang them. Stick to one style within a report.
Why did it change every dot in my text?
The defanger works on the whole text, not only on recognised indicators, so sentence periods and version numbers get [.] too. Paste only the indicator list, or untick Defang dots if you only need the scheme broken.
Are the indicators I paste sent anywhere?
No. Defanging and refanging run in your browser. To track indicators across an incident, use IOC pivoting; to inspect a suspicious URL before refanging it, try the URL parser.