Refang URL (Restore Defanged Indicators)

Input

Refanged text

0lines0chars out

Shareable link

Settings are written to the URL as you change them. Nothing differs from the defaults yet.

Restore defanged indicators

Threat reports and tickets write hxxps://evil[.]com/a and 10[.]0[.]0[.]1 so nobody opens them by accident. Before feeding them to a scanner, a blocklist or a DNS lookup, they need their real form back. Paste the text and the output returns it with every defang notation replaced:

hxxps://evil[.]com/a becomes https://evil.com/a
hXXp[:]//10(.)0(.)0(.)1 becomes http://10.0.0.1
ops [at] corp [dot] io becomes ops@corp.io

Handle with care

The output contains live addresses. Paste it into a tool, not into a chat or a document where it will be turned into a link. To list the restored indicators instead of rewriting the whole text, use the IOC Extractor or the full Text Pattern Extractor.

Frequently Asked Questions

Which notations are restored?

hxxp and hxxps (any case) become http and https; [.], (.), {.}, [dot], (dot) and {dot} become a dot; [@], (@), [at], (at) and {at} become @; and [:] or [://] become : or ://. Spaces around a bracketed dot or at sign are removed too.

Is the rest of the text changed?

Only those notations are replaced. Everything else, including line breaks, is kept as written.

Could it change normal text by mistake?

A bracketed [at] or [dot] in ordinary prose is replaced as well, since there is no way to tell it from a defanged address. Plain words like at and dot without brackets are never touched.