How to defang URLs, IPs and domains for safe sharing
What defanging is, the common styles (hxxp, [.], [@]), when to defang and when not to, and how to defang or refang a whole list in one go.
Paste a malicious URL into a ticket, a chat or an email and three things can go wrong. Someone clicks it. The app turns it into a link and fetches it to build a preview, which can tip off the attacker that you're looking. Or your own mail filter blocks the message because it contains a known-bad link. Defanging stops all three by changing the indicator just enough that nothing treats it as a live address, while any analyst can still read it.
What defanging looks like
| Indicator | Live | Defanged |
|---|---|---|
| URL | https://login-update.example.com/verify | hxxps[://]login-update[.]example[.]com/verify |
| Domain | login-update.example.com | login-update[.]example[.]com |
| IPv4 | 203.0.113.45 | 203.0.113[.]45 or 203[.]0[.]113[.]45 |
[email protected] | billing[@]example[.]com |
The common conventions are:
hxxpandhxxpsin place ofhttpandhttps, so the scheme isn't recognised.[.]in place of dots. Some teams use(.)or[dot].[://]or[:]around the scheme separator.[@]or[at]in email addresses.
Square brackets are the most widely understood. Whatever you pick, pick one style for the team. Mixed styles are harder to read and break the tools that refang them later.
What not to defang
- File hashes. A hash isn't clickable, so there's nothing to defang.
- Block lists and detection rules. Firewalls, proxies, EDR and SIEM queries need the real value. A defanged entry in a block list blocks nothing.
- Threat intel platforms. MISP, OpenCTI and similar store indicators in their live form and handle display safely themselves.
- Private or internal addresses in an internal ticket. Defanging them does no harm, but it adds noise.
Where to defang
Anywhere a human reads the indicator and software might act on it: tickets, chat channels, emails to clients, incident reports, shift handovers and slide decks. Link previews in Slack and Teams are the one people forget. The preview service fetches the URL from its own servers, so the attacker's logs show a visit seconds after you paste it.
Refanging: turning it back
When you need to look an indicator up or add it to a block list, you refang it: hxxps back to https, [.] back to a dot. Doing that by hand on a list of 50 is slow and error-prone, and a missed bracket means a lookup that silently returns nothing.
How to defang a whole list
- IOC Extractor (free, in your browser): paste the alert, email or log. It finds every IP, domain, URL, email and hash, recognises ones that are already defanged, and copies them defanged or refanged. Nothing is uploaded.
- CyberChef: the "Defang URL" and "Defang IP Addresses" operations, and "Fang URL" to reverse them.
- A one-liner for scripts:
$ioc = 'https://login-update.example.com/verify'
$ioc -replace '^http', 'hxxp' -replace '://', '[://]' -replace '\.', '[.]'That simple version also brackets dots in the path and query string. That's fine for a ticket, but don't use it to build anything a tool will parse.
FAQ
Is a defanged URL completely safe to share?
It can't be clicked or previewed by accident, which is the point. Someone can still refang it and visit it on purpose, so treat the indicator itself as sensitive if it reveals a client's name or an internal system.
Should I defang IPs as well as URLs?
Yes, in anything people read. Many apps make IP addresses clickable, and a raw IP in an email can trip your own filters.
Why does my tool not find the indicators in a defanged report?
Many extractors only recognise one style. Use one that understands the common variants ([.], (.), [dot], hxxp), or refang the text first.
Paste any text into the IOC Extractor: it finds every IP, domain, URL, email address and hash, and copies them defanged or refanged, one click.
IOC Triage, our free browser extension, checks any URL, domain, IP or hash against 15 threat-intel sources and copies ticket notes and block lists with the indicators defanged for you.