IOC Fang / Defang
Transform, normalize, extract, classify, and export indicators safely with idempotent browser-local handling for URLs, domains, IPs, hashes, and email addresses.
Local-only
JSON / Markdown / CSV
Options
Processed
4
Changed
3
Warnings
1
Types
URL 2IPv4 1IPv6 0Domain 0Email 1Hash 0Unknown 0
1 warning
History
Saved conversions are stored locally in this browser.
Indicator Breakdown
| Line | Type | Input | Output | State |
|---|---|---|---|---|
| 1 | url | https://malicious-site.com/payload.exe | hxxps://malicious-site[.]com/payload[.]exe | changed |
| 2 | ipv4 | 192.168.1.1:4444 | 192[.]168[.]1[.]1:4444 | changed |
| 3 | attacker@evil.com | attacker[@]evil[.]com | changed | |
| 4 | url | hxxps://already[.]defanged[.]com/path | hxxps://already[.]defanged[.]com/path | sameAlready defanged tokens were normalized or preserved. |
Reference
Defang: makes URLs, domains, IPs, and email addresses safe to paste into reports and chats.
Normalize: refangs first, then applies one consistent defanged style so repeated runs do not create double brackets.
Extract: pulls indicators from prose, dedupes/sorts if selected, and exports report-ready Markdown, CSV, or JSON.
Defang Notes
- Defang replaces live-link primitives such as protocols, dots, at-signs, and optional ports.
- Refang restores common safe styles for controlled tooling or enrichment workflows.
- Normalize prevents double-defanging by refanging first, then applying one consistent safe format.
- Extract pulls indicators out of notes and prose before transforming them.
- IPv6 colon handling is conservative so address structure is not destroyed by port defanging.
- Exports include line-level type classification, change state, and warnings for evidence review.