IOC Defang, Refang, and Extractor - SimeonOnSecurity

NOTE: This tool runs entirely in your browser with client-side JavaScript. Indicators you paste are processed locally and are never transmitted, logged, or stored. That matters here, because indicators from an active incident are the last thing you want to hand to a third party.

Input

Output

What Defanging Is For

Defanging makes an indicator inert. So http:// becomes hxxp:// and dots become [.], so nothing in the text is clickable or auto-linked.
Refanging makes it usable again. Paste defanged indicators from a report and convert them back before running them through your own tooling.
Extraction pulls indicators out of prose. Paste a raw email or a chat log and get the URLs, addresses, hashes and domains separated from everything else.
Order matters. Refanging handles the bracketed forms first, because [://] contains [:] and a careless replace would mangle it.