Turn a list of IOCs into STIX 2.1, MISP JSON, CSV, Suricata rules or a YARA skeleton.
New
URL Defanger & IOC Extractor
Runs locally
Use URL Defanger & IOC Extractor
What it does
Defang URLs, IP addresses and email addresses so they can be shared without accidental clicks, refang them, or extract every URL, IPv4 address and email from a block of text in the IOC Extractor tab.
It runs entirely in your browser: nothing you enter is uploaded.
Example
Three IOCs, one per line
https://login.example.com/verify?id=42
203.0.113.7
support@example.nethxxps://login[.]example[.]com/verify?id=42
203[.]0[.]113[.]7
support[at]example[.]netDefang returns hxxps://login[.]example[.]com/verify?id=42, 203[.]0[.]113[.]7 and support[at]example[.]net on separate lines; Refang turns them back.
FAQ
What exactly does Defang change?
http://, https:// and ftp:// become hxxp://, hxxps:// and fxp://, every dot becomes [.] and every @ becomes [at], including dots in paths and file names. Refang reverses this and also accepts (.) and (at).
What does the IOC Extractor find, and what does it miss?
Links that start with http://, https:// or ftp://, IPv4-looking numbers and email addresses. Bare domains without a scheme and already defanged links are not extracted, the IP pattern also matches version strings like 1.2.3.4, and trailing punctuation can stick to a URL, so review the list before copying.
Is my text sent anywhere?
No. Defanging, refanging and extraction are text replacements in your browser; nothing is uploaded and no link is opened.