# IOC Defang and Refang

> Make common indicators less clickable or restore them for analysis. Convert recognized HTTP URLs, email domains, domains and IPv4 addresses in pasted text between normal and bracket-dot defanged notation. Hashes and crypto identifiers stay unchanged.

Part of usefulweb.app (https://usefulweb.app/). Results are deterministic calculations from the inputs and the listed assumptions; the API returns exactly what the web page shows.

## Use it
- Human interface: https://obscuriqiocconverter.usefulweb.app/ (interactive tool at https://obscuriqiocconverter.usefulweb.app/tool)
- JSON API: POST https://obscuriqiocconverter.usefulweb.app/api/v1/calculate with a JSON object of inputs (schema: https://obscuriqiocconverter.usefulweb.app/api/v1/tool)
- OpenAPI: https://obscuriqiocconverter.usefulweb.app/openapi.json
- MCP (Streamable HTTP): https://obscuriqiocconverter.usefulweb.app/mcp - tool `obscuriq_ioc_converter`

## Inputs
- text (textarea): Text to inspect - Paste text you are authorized to review. No lookups are performed.
- mode (select): Conversion

## Method
- Recognize the same conservative indicator patterns as the extractor; preserve surrounding text and punctuation.
- Defanging replaces HTTP schemes with hxxp/hxxps and dots in hostnames with [.] while keeping URL paths intact. Refanging reverses these forms.

## Limits
- Refanged indicators can become clickable or active. Do not open unknown links. Defanging is a formatting aid, not a security guarantee; unsupported patterns may remain unchanged.