IOC Defanger, Refanger & Extractor
Defang URLs, domains, IPs and emails so they are safe to share, restore them, or extract indicators from a report.
Runs in your browser Your input never leaves your device.
Report a problem with this tool
About this tool
Security teams share indicators of compromise such as malicious URLs, domains, IP addresses and email addresses in tickets, chats and reports. Pasted as they are, they become clickable and can be opened by accident. Defanging makes them safe: http becomes hxxp, dots in hosts and IP addresses become [.], and @ in emails becomes [@], while the rest of your text is left as it is. Refanging reverses it, and understands the common styles: hxxp and fxp, [.], (.), {.}, [dot], [@], [at], [:] and meow://. The extractor reads a report or log, restores any defanged indicators, and lists the URLs, domains, IPv4 addresses, email addresses, MD5, SHA-1, SHA-256 and SHA-512 hashes and CVE identifiers it finds, without duplicates, defanged if you want. Details to know: bare domains are recognised only when they end in a country code or one of about a hundred common top-level domains, to avoid treating file names like index.html or version numbers as domains; only IPv4 addresses are handled; and path and query dots inside URLs are not changed. Refanging a defanged text gives back the original in our round-trip tests on ten kinds of indicator. Refanging only rewrites forms that sit inside an indicator, such as bob[at]evil.com, and leaves ordinary words like (at) alone. The tool accepts up to 500,000 characters, and tested on hostile texts of that size it answers within seconds; unbroken text of more than 2,000 characters is not scanned for domains, addresses and emails, and the tool says so. Version numbers like v1.2.3.4 are not treated as IP addresses. Everything runs in your browser; nothing is uploaded.
How to use it
- Choose defang, refang or extract.
- Paste your text.
- Copy the result.
- For extraction, tick whether the list should be defanged.
Common problems
- A domain was not defanged
- Bare domains are recognised only with a common top-level domain such as .com or .net. Add the full URL, or defang it by hand.
- A file name or version number was changed
- Only text that looks like a URL, domain with a known ending, IPv4 address or email is changed. If something else was changed, untick Defang bare domains.
- IPv6 addresses are not handled
- This tool covers IPv4 addresses. IPv6 addresses should be defanged by hand.