# Defanging

Defanging is rewriting a malicious URL, domain or email address (for example hxxps://evil[.]com) so it cannot be clicked or auto-linked while it is shared.

## How it works

Common conventions replace http with hxxp, dots with [.] and @ with [at]. The indicator stays readable for people and tools that refang it, but chat apps, email clients and documents no longer turn it into a live link.

Defanging is standard practice in abuse reports, threat reports and IOC lists.

## How to protect yourself

- Defang every malicious indicator before pasting it into a ticket, chat or report.
- Refang only inside isolated analysis tools.

## Related tools

- [URL Defanger & IOC Extractor](https://phishdestroy.io/developer-tools/url-defanger)
- [IOC Converter](https://phishdestroy.io/developer-tools/ioc-converter)

## Related terms

- [Indicator of compromise (IOC)](https://phishdestroy.io/glossary/ioc/)
- [STIX](https://phishdestroy.io/glossary/stix/)

## Further reading

- [Phishing Takedowns: Detect, Verify, Report](https://phishdestroy.io/takedown-anatomy)

## Glossary

- [All terms](https://phishdestroy.io/glossary/)

Canonical: https://phishdestroy.io/glossary/defanging/