URL & IP Defanger and Refanger
Defang a URL, domain, IP or email for safe IOC sharing — http becomes hxxp and dots become [.] — or refang it back, tolerant of (dot) and [at] styles.
Neutralize indicators so they cannot be clicked or auto-linked when shared — http becomes hxxp and ftp becomes fxp.
Every dot, @, http and ftp in the text is changed while its part is switched on, ordinary sentences included — a full stop becomes [.] and “leftpad” becomes “lefxpad”. Nothing is picked out: to keep only the indicators from a log or an email, pull them out first with Data Extractor.
What defanging a URL means
Defanging rewrites a dangerous URL, domain, IP address, or email into a form that cannot be clicked or auto-linked — http becomes hxxp, ftp becomes fxp, :// becomes [://], every dot becomes [.], and @ becomes [at]. Security teams defang indicators of compromise (IOCs) before pasting them into tickets, chat, wikis, or email so a colleague cannot accidentally open a malicious link. Refanging is the reverse: it turns a defanged indicator back into a working URL or IP for use in a sandbox or scanner.
Defang and refang in your browser
Paste a whole block of text and switch between Defang and Refang — every match in the block is converted at once, so many indicators can be processed together. Nothing is picked out, though: every dot, @, http and ftp in the text changes while its part is switched on, ordinary sentences included, so a full stop becomes [.] and “leftpad” becomes “lefxpad”. To defang only the indicators in a log or an email, pull them out with Data Extractor first, then use “Send the result to:” under its result to open them here, one per line. Refang is tolerant of the styles other tools emit, including hxxp[:]//, fxp[://], [dot], (dot), (.), (at) and [@]. The folded Line by line table ends in Download JSON, Download Markdown and Download CSV, each holding every line of the result rather than only the rows drawn; the Markdown puts each indicator in a code span, so a live one does not turn into a link where the table is pasted. Everything runs locally in your browser and nothing is uploaded, which matters when the text is a live threat indicator.
Frequently asked questions
What is the difference between defang and refang?
Defang neutralizes an indicator so it cannot be clicked — for example http://evil.com becomes hxxp[://]evil[.]com. Refang does the reverse and restores the original URL or IP. Defang before sharing an indicator, and refang before submitting it to a scanner or sandbox.
Does it work on IP addresses and emails too?
Yes. Every dot is bracketed, so 8.8.8.8 becomes 8[.]8[.]8[.]8, and the @ sign becomes [at], so alert@example.com becomes alert[at]example[.]com. Refang reverses both.
Can I choose which parts get defanged, or defang a port?
Yes. In Defang mode the Parts to defang switches pick what changes: Protocols (hxxp, [://]), Dots ([.]), At-sign ([at]) and Port colons. The first three start on and Port colons starts off. With Port colons on, host:port becomes host[:]port after a name, an IPv4 address or a bracketed IPv6 literal, while a bare IPv6 address is left alone, because its last group cannot be told from a port.
Can I export the line-by-line table?
Yes. Line by line ends in Download JSON, Download Markdown and Download CSV. Each file holds every line of the result, not only the rows the table draws: the JSON with keys that stay the same whatever the page's language, the CSV under the table's own column names, and the Markdown with each indicator in a code span, so a live one does not turn into a clickable link where the table is pasted.