Defanging
Defanging is rewriting a malicious URL, domain or email address (for example hxxps://evil[.]com) so it cannot be clicked or auto-linked while it is shared.
How it works
Common conventions replace http with hxxp, dots with [.] and @ with [at]. The indicator stays readable for people and tools that refang it, but chat apps, email clients and documents no longer turn it into a live link.
Defanging is standard practice in abuse reports, threat reports and IOC lists.
How to protect yourself
- Defang every malicious indicator before pasting it into a ticket, chat or report.
- Refang only inside isolated analysis tools.