IOC Defang and Refang

What it is for

When you paste a phishing link into a ticket, chat or report, many programs turn it into a clickable link — and someone eventually clicks it. Defanging prevents that by rewriting the indicator: https:// becomes hxxps:// and the dots in the host become [.]. Analysts read it just as easily, but mail clients and chat apps no longer link it. Refanging does the reverse when a tool needs the normal form again.

The converter changes only recognized indicators and leaves the rest of your text untouched. It never opens, resolves or checks an address.

Worked example

Choose Defang and paste: Block https://login.examplecorp-verify.example/owa/?id=8812 and 192.0.2.44; reply-to helpdesk@mail.examplecorp-verify.example; wallet bc1qw508d6qejxtdg4y5r3zarvary0c5xw7kv8f3t4.

The result is: Block hxxps://login[.]examplecorp-verify[.]example/owa/?id=8812 and 192[.]0[.]2[.]44; reply-to helpdesk@mail[.]examplecorp-verify[.]example; wallet bc1qw508d6qejxtdg4y5r3zarvary0c5xw7kv8f3t4.

The summary says 3 of 4 recognized indicators changed. The URL, the IP address and the e-mail domain were defanged. The Bitcoin address was recognized but stays as it is — crypto identifiers and hashes contain no dots or schemes to change. The URL path /owa/?id=8812 is kept exactly, and so is the final full stop of the sentence.

Switch to Refang and paste hxxps://example[.]org/path; the answer is https://example.org/path and the summary reads The recognized indicator was changed.

How to read the result

The converted text keeps every character outside the recognized indicators. The two counts tell you how many indicators were found and how many actually changed; a gap usually means hashes or crypto identifiers, or indicators that were already in the requested form. In an e-mail address only the domain part is defanged, so the mailbox name stays readable.

Tips and common mistakes

• Defang before you paste indicators into tickets, chats, slides or reports that other people open.
• Compare the counts with what you expected; an unusual spelling such as hxxp[:]// or example(.)org is not recognized and stays unchanged.
• Refanged links become clickable again. Do the refang step only inside the tool that needs it, not in a shared document.
• Keep the original evidence separately; the converted text is a formatted copy, not a record of the source.
• IPv6, Unicode domains and unusual e-mail forms are not covered; review the output before sharing.

FAQ

Does refanging open or check the address?

No. The converter only rewrites text. Another program may turn the restored URL into a link, so handle it with care.

Why did a hash or crypto address not change?

They have no scheme or dots, so there is nothing to defang. They are still counted as recognized indicators.

Is defanged text safe?

It is safer to share because it is not clickable, but it is still the same indicator. Defanging is a formatting aid, not a security control.

How long can the text be?

Up to 100,000 characters and 2,000 recognized indicators. Split longer reports and check that no indicator is cut at the boundary.