Defang URL (Defang URLs, IPs and Emails)

Input

Defanged text

0lines0chars out

Shareable link

Settings are written to the URL as you change them. Nothing differs from the defaults yet.

Paste an incident write-up, a ticket comment or a list of indicators. The output is the same text with every network indicator rewritten so it cannot be opened by a click or turned into a link by Slack, Teams, Jira or a mail client:

https://evil.com/a.php becomes hxxps://evil[.]com/a.php
evil.com becomes evil[.]com
198.51.100.7 becomes 198[.]51[.]100[.]7
ops@corp.io becomes ops[@]corp[.]io
fe80::1 becomes fe80[:][:]1

What counts as an indicator

The same validation as the extractors applies: hosts and domains need a real top-level domain, IPs must be valid, and bare file names such as payload.zip are left alone. Hashes, MAC addresses and CVE IDs are not touched, because none of them can be followed.

One style for mixed input

Reports collected from several sources mix [.], (.), {.} and [dot]. Each is read as a dot first, then the whole text is defanged with [.], [@], [:] and hxxp, so the result is consistent.

Frequently Asked Questions

What does defanging change?

The scheme http or https becomes hxxp or hxxps, dots in a URL host, domain, IPv4 address or email become [.], the @ in an email becomes [@], and IPv6 colons become [:]. https://evil.com/a.php becomes hxxps://evil[.]com/a.php.

Is the rest of the text changed?

No. Only the matched indicators are rewritten, and everything between them, including line breaks and punctuation, is kept. A path keeps its own dots, so a.php stays a.php.

Can I defang text that is already partly defanged?

Yes. Existing defanged forms are read as the real characters first, then everything is defanged in one consistent style, so a mix of evil[.]com and evil(.)com comes out uniform.

How do I undo it?

Paste the defanged text into Refang URL, which turns hxxp, [.], [@] and [:] back into working addresses.