// TOOLS

Security Tools

🧷 IOC Defang / Refang

Defang indicators (http→hxxp, .→[.]) so you can paste them into a ticket or report without them becoming clickable, or refang the ones you receive. And it extracts and classifies the IOCs from any text.

Result 

      
    


    Detected IOCs
    

  







  
Frequently asked questions

  

    What does it mean to "defang" an indicator (IOC)?
    
It means turning an indicator —URL, IP, domain— into a non-clickable form (http→hxxp, .→[.]) so you can paste it into a ticket, chat or report without anyone opening it by accident.

  

  

    Does it change the rest of the text?
    
No. It only alters what it detects as an indicator (URLs, IPs, domains, emails); the surrounding text is left intact.

  

  

    Can it restore already-defanged indicators?
    
Yes. The Refang mode reverses hxxp, [.] and [@] and gives you back the original indicator, ready to use again.