Indicia

Defang / refang URLs and IPs

Make URLs, IPs, domains and email addresses unclickable (hxxps[://]evil[.]example) before sharing them, or turn defanged indicators back into real values.

Runs in your browser. Nothing you paste is uploaded, stored or logged.

How it works

Security teams share malicious indicators all day, in tickets, chat, email and reports. A live link in any of those is one careless click away from an infection, and many tools turn a bare domain into a link automatically. Defanging prevents that.

Paste any text and choose Defang: every IP address, domain, URL and email address in it is rewritten in the common defanged style (hxxps[://], [.], [@]), and the rest of the text stays as it was. Choose Refang to reverse it, for example before pasting indicators into a block list or a lookup tool.

Questions

What does defanging a URL mean?
Defanging changes an indicator just enough that it can no longer be clicked or turned into a link automatically. For example https://evil.example becomes hxxps[://]evil[.]example. It stops anyone opening a malicious link by accident when it is pasted into a ticket, email, chat or report.
Which defanged formats does refang understand?
hxxp, hxxps, fxp, [://], [.], (.), {.}, [dot], (dot), [:], [@], (@) and [at]. Each is turned back into the real character.
Does it change the rest of my text?
No. Only IP addresses, domains, URLs and email addresses are changed, in place. Everything else, including file hashes and normal words, is left exactly as it was, so you can defang a whole incident write-up in one go.
Is what I paste sent anywhere?
No. Both run entirely in your browser, and nothing is uploaded, stored or logged. Refanged links are shown as plain text in a read-only box, never as clickable links, because they may be live malicious addresses.