Your files stay on your device

IOC defang and refang

Defang indicators of compromise for safe sharing or refang them back for tooling, in bulk across prose, live in your browser.

Paste text and the conversion happens live.

Domain matching ends in a list of common top-level domains, so sentence periods, abbreviations like e.g., and decimal numbers are left alone; the trade is that a domain on an unusual TLD passes through as prose. IPv6 detection skips clock times by shape, so 10:30:45 stays a time. The round trip holds: defanging then refanging returns the original text. Two things refang anyway: text that already contains the markers, and a dotted chain of eight-hex-digit groups, which is read back as a chunked hash. Defanged reports are usually unpublished incident notes, which is why nothing here leaves the tab.
Options

More text tools

- Escape / unescape (/text/escape)
- Find & replace (/text/find-replace)
All text tools (/text)

Was this tool useful?
YesNo

Canonical HTML: https://nutter.tools/text/ioc-defang-refang-tool
Markdown version: https://nutter.tools/text/ioc-defang-refang-tool.md
Plain-text version: https://nutter.tools/text/ioc-defang-refang-tool.txt
Agent index: https://nutter.tools/llms.txt