Defanging makes indicators of compromise (IOCs) safe to share in emails, reports, and chat.
Common defanging patterns
- hxxp:// instead of http://
- example[.]com instead of example.com
- 192.168.1[.]1 instead of 192.168.1.1
- user@example[.]com instead of [email protected]
Why defang?
- Prevent accidental clicks in threat intelligence reports.
- Stop email scanners from following malicious links.
- Protect analysts from visiting dangerous sites.
- Avoid triggering security tools that crawl links.
Refanging
- Reverse the process to get original IOC for investigation.
- Tools can automate defanging/refanging for IOC extraction.
Related Articles
View all articlesWhat are Defanged IOCs?
Discover why security professionals defang indicators of compromise and how to recognize and unfang defanged IOCs for threat analysis.
Read article →Indicators of Compromise & Threat Hunting Complete Guide: IOC Extraction, Validation & Detection
Master indicators of compromise and threat hunting techniques. Learn IOC types, extraction methods, validation, defanging, sharing formats, and how to use IOCs for proactive threat detection.
Read article →Malware Analysis & Reverse Engineering: A Comprehensive Toolkit Workflow
Master the complete malware analysis workflow from initial triage to threat intelligence sharing. Learn static analysis, dynamic analysis, unpacking techniques, and reverse engineering using industry-standard tools and methodologies.
Read article →Explore More Threat Intelligence
View all termsAdvanced Persistent Threat (APT)
A sophisticated, long-term cyberattack where an intruder gains unauthorized access and remains undetected for an extended period to steal data or cause damage.
Read more →Credential Stuffing
An automated attack that uses stolen username/password pairs from data breaches to gain unauthorized access to user accounts on other services.
Read more →IP Reputation
A trustworthiness score (0-100) assigned to IP addresses based on observed malicious behavior, spam activity, and threat intelligence data.
Read more →Keylogger
Malicious software or hardware that secretly records keystrokes to capture passwords, credit card numbers, and other sensitive information typed by users.
Read more →Malware
Malicious software designed to damage, disrupt, or gain unauthorized access to computer systems and data.
Read more →Phishing
A social engineering attack that uses fraudulent communications to trick recipients into revealing sensitive information or installing malware.
Read more →