IOC defang and refang

Domain matching ends in a list of common top-level domains, so sentence periods, abbreviations like e.g., and decimal numbers are left alone; the trade is that a domain on an unusual TLD passes through as prose. IPv6 detection skips clock times by shape, so 10:30:45 stays a time. The round trip holds: defanging then refanging returns the original text. Two things refang anyway: text that already contains the markers, and a dotted chain of eight-hex-digit groups, which is read back as a chunked hash. Defanged reports are usually unpublished incident notes, which is why nothing here leaves the tab.