IOC Defanger / Refanger

The IOC Defanger rewrites URLs, domains, IPv4 addresses and email addresses so they can't be accidentally clicked, resolved, or auto-linked when pasted into email, chat, tickets or reports. "Refang" reverses the process, restoring the original indicator so it can be fed into scanners, SIEMs or threat intel platforms.

When analysts share indicators of compromise (IOCs) with colleagues, vendors, or in public writeups, an active hyperlink or clickable email address is a real risk -- someone might click it, a mail gateway might follow it, or an auto-linking tool might render it as a live link. Defanging is a long-standing SOC and threat-intel convention: replacing characters like ., @ and :// with bracketed equivalents ([.], [@], [://]) keeps the indicator readable and identifiable without it being "live."

Defanging replaces http with hxxp, https with hxxps, every literal dot with [.], @ with [@], and :// with [://]. Refanging applies the inverse substitutions in the opposite order so a previously defanged indicator becomes usable again.

1. 1Paste one or more IOCs -- URLs, domains, IPs or emails -- into the text box, one per line or inline in a sentence.
2. 2Click Defang to make every indicator safe to paste elsewhere.
3. 3Click Refang on defanged text to restore the original, clickable/resolvable form for tooling.
4. 4Use Copy to grab the result, or Clear to start over.

http://evil-domain.com/login becomes hxxp[://]evil-domain[.]com/login.

attacker@phish.net becomes attacker[@]phish[.]net.

185.220.101.7 becomes 185[.]220[.]101[.]7.

• Forgetting to defang before pasting into ticketing systems or chat tools that auto-preview links.
• Defanging indicators that are meant to go directly into a scanner or SIEM query -- refang first.
• Assuming defanging alone makes a sample or link 'safe' to interact with; it only prevents accidental auto-resolution, not investigation risk.
• Manually retyping dots and slashes, which is slow and easy to get wrong on long IOC lists.

Defanging is a communication safeguard, not a technical control. It doesn't sandbox, sanitize, or neutralize malicious content -- it just stops the text from being interpreted as a live link or address by mail clients, chat apps and browsers. Continue to follow your organization's safe handling procedures (isolated analysis environments, no direct browsing to suspicious URLs) when actually investigating an indicator.