Defang / Refang IOCs
Neutralize URLs, IP addresses, domains and email addresses so they're safe to share in a report, ticket or email — or refang a defanged blob back to the real indicator. Runs entirely in your browser, no server, no sign-up.
What this tool does
Defanging rewrites an indicator of compromise (IOC) — a URL, IP address, domain or email address — so that a mail client, chat app or terminal will not turn it into a clickable link or run it. It's the standard safety practice when you share malicious indicators in a threat report, a ticket, or an email to a colleague. Refanging is the inverse: it restores a defanged blob back to the real, clickable indicator so you can copy it straight into a sandbox or tool.
Everything runs locally in your browser — nothing is sent to a server, it works offline, and there's no sign-up. Paste your text, pick an Action, and copy the result.
What gets neutralized
| Original | Defanged (square) |
|---|---|
http://evil.com | hxxp[://]evil[.]com |
https://10.0.0.1 | hxxps[://]10[.]0[.]0[.]1 |
evil.example.com | evil[.]example[.]com |
[email protected] | bad[.]actor[at]evil[.]com |
ftp://files.bad.net | fxp[://]files[.]bad[.]net |
It neutralizes three things: the scheme
(http/https/ftp → hxxp/hxxps/fxp), every dot between labels
(. → [.]), and the @ in an email (@ → [at]). The :// separator is
bracketed too ([://]).
Bracket styles
Pick the convention your team uses:
| Style | . | @ | :// |
|---|---|---|---|
| square (default) | [.] | [at] | [://] |
| round | (.) | (at) | (://) |
| curly | {.} | {at} | {://} |
| dot (spelled out) | [dot] | [at] | [://] |
Refang
Switch the Action to refang to reverse the process. It recognizes square
[], round () and curly {} brackets, the spelled-out [dot]/[at] forms,
and the meow:// convention — so a blob copied from almost any report restores
cleanly:
| Defanged | Refanged |
|---|---|
hxxps[://]10[.]0[.]0[.]1 | https://10.0.0.1 |
bad[at]evil[dot]com | [email protected] |
meow://1.2.3.4 | http://1.2.3.4 |
FAQ
Is it free and private?
Yes — your input never leaves your device, and it keeps working offline once the page has loaded. That matters when the text you're handling contains live malicious indicators.
Why neutralize the scheme and dots?
A bare http://evil.com becomes a
clickable link in most apps, and an accidental click can detonate a payload or
leak that you visited an attacker's infrastructure. Replacing http with hxxp
and . with [.] breaks the auto-linking while keeping the indicator readable.
Does it work on a whole paragraph?
Yes. It rewrites the indicator characters wherever they appear and leaves your surrounding prose untouched, so you can paste a full sentence or a list of IOCs at once.
Will refang restore every defanged format?
It handles the common
conventions — [.], (.), {.}, [dot], [at], [://], and hxxp/fxp
plus meow://. Exotic, hand-rolled obfuscations may need a manual touch-up.
Developer & Automation Access
Run it from the terminal
Same engine as this page, headless — via the gizza CLI:
gizza tool ioc-defang "http://evil.example.com/path or [email protected]"New to the CLI? Get gizza →
Open it by URL
Pre-fill and auto-run this tool with query parameters — the names match the API/CLI:
https://gizza.ai/tools/ioc-defang/?text=http%3A%2F%2Fevil.example.com%2Fpath%20or%20bad.actor%40evil.com&mode=defang&style=squareMachine-readable descriptor: tool.json — title + parameters JSON Schema for agents.