IOC defang and refang
Make URLs, domains, IP addresses, and email addresses safe to paste into reports and chat, or turn defanged indicators back into usable ones.
How it works
Defanging rewrites http and https as hxxp and hxxps with [://], replaces dots in URLs, domains, IPv4 addresses, and emails with [.], and @ in emails with [@]. Running it twice gives the same result.
Refanging reverses the common forms: [.], (.), {.}, [dot], [@], [at], [://], [:], hxxp, hxxps, and fxp.
Limitations: IPv6 addresses are not changed. Anything shaped like name.tld, such as a file name like invoice.pdf, is treated as a domain and defanged, which errs on the safe side.