URL Defanger

When you paste a suspicious link into a ticket, a chat or an e-mail, there is a real risk that someone clicks it, or that a mail client fetches it to build a preview. Security teams therefore rewrite indicators so that they stop working as links. This is called defanging. The reverse step, refanging, restores the original so the indicator can be looked up. This page does both for whole blocks of text, and has a third task for the opposite problem: stripping tracking junk from ordinary links.

What defanging changes

Four substitutions cover nearly every convention. The scheme http becomes hxxp, so https:// turns into hxxps://. Dots become [.], (.) or [dot]. An @ in an address can become [@], and the :// can be written [://] if a system still links the rest. You can choose which of these to apply, and whether every dot is rewritten or only the one before the top-level domain. IPv4 addresses are handled too, so 203.0.113.9 becomes 203[.]0[.]113[.]9.

A worked example

The sample text is a short phishing report: a login-lookalike URL with utm_source and fbclid parameters, a command-and-control address with a port and a path, a reply-to address, and a line saying “report.txt and notes.md are not domains”. With the default options the page produces hxxps://secure-login[.]bank-update[.]example[.]com/verify?id=42&utm_source=mail&fbclid=XYZ, then 203[.]0[.]113[.]9 and hxxp://evil[.]example[.]net:8080/gate[.]php, then billing[@]invoice-pay[.]example[.]org. The last line is untouched: report.txt and notes.md do not end in a real top-level domain, so they are left readable.

Refanging

Switch to Refang to turn such text back into live indicators before you search for them. The page understands the styles above, plus [at] for the at sign, and leaves anything else alone. Refang only in a place where an accidental click is harmless, and never in a document that others will open.

Cleaning tracking from links

The third task takes one URL per line and returns a tidier version. It removes the utm_* family, fbclid, gclid, msclkid and similar click identifiers, the fragment after #, and any user name and password written into the address. A note under the result lists what was removed from each line. This is useful when you share a link publicly and do not want to pass along who clicked it or where from.

Limits

Defanging only prevents accidents; a defanged link is still a pointer to a hostile site, and automated scanners may refang it. The page does not look up reputation, resolve domains or check redirects. Unusual obfuscation, such as Base64 or split strings, is not reversed.

Good habits when sharing indicators

Defang at the moment of writing, not later, and say in the document which style you used. Keep a refanged copy only in the tool that needs it, such as a sandbox or a threat-intelligence platform. In chat tools that auto-link text, check that the defanged form really stays inert, since some linkers recognise bracketed dots. When you must share a live link with a colleague, send it in a message of its own with a warning rather than hiding it in a long paragraph.

Related tools

• IOC Extractor pulls indicators out of long text before you defang them.
• IDN Homograph Detector checks whether a domain uses look-alike letters.
• Typosquatting Domain Generator lists the mistyped variants of a name.
• Punycode Converter converts between Unicode domains and their xn– form.