← All Tools
IOC Defanger
Safely defang and refang malicious indicators for secure SOC sharing and documentation.
Warning: Refanged IOCs may be active malicious indicators. Handle with care and do not click or visit refanged URLs.
Defanging Reference
What is Defanging?
Defanging is the practice of modifying malicious indicators (IOCs) to prevent accidental clicks or automatic parsing. This makes it safe to share in reports, emails, and tickets.
Common Transformations
.→[.]http→hxxphttps→hxxps://→[://]@→[@]
Supported IOC Types
- URLs (http, https, ftp)
- IPv4 Addresses
- Domain Names
- Email Addresses
- Mixed Text Content
Use Cases
- Security incident reports
- Threat intelligence sharing
- SOC ticket documentation
- Email communications