Question 1

What does defanging a URL mean?

Accepted Answer

Defanging replaces parts of a URL or IP address that would make it clickable or resolvable. Common transformations: http:// → hxxp[://], https:// → hxxps[://], and dots → [.]. For example, https://evil.com becomes hxxps[://]evil[.]com. This lets analysts share indicators of compromise (IoCs) in reports, emails, and tickets without risk of accidentally clicking a malicious link.

Question 2

What is refanging (fanging)?

Accepted Answer

Refanging (also called fanging) is the reverse of defanging — it restores a defanged URL or IP back to its original clickable form. hxxps[://]evil[.]com becomes https://evil.com again. Use refanging when you need to actually visit or query the indicator, for example to run it through a sandbox or WHOIS lookup.

Question 3

Why are brackets used around dots in defanged URLs?

Accepted Answer

Brackets prevent automatic hyperlinking by email clients, SIEM platforms, ticketing systems, and messaging tools. A plain dot in a hostname like evil.com may be auto-converted to a clickable link. Wrapping it as evil[.]com breaks that auto-detection while still making the original value obvious to a human analyst.

Question 4

What are common defanging conventions for IPs and emails?

Accepted Answer

For IP addresses: replace dots with [.] — e.g. 192.168.1[.]1. For email addresses: replace @ with [@] — e.g. attacker[@]evil[.]com. For URLs: replace http with hxxp and dots with [.]. Some analysts also bracket the colon: hxxp[://]. This tool applies all these transformations automatically and can reverse them all when fanging.

ابزارهای رایگان توسعه‌دهندگان وب

Defang / Fang برای URLها و IPها

ورودی

خروجی

ابزار Defang/Fang برای URLها و IPها چگونه کار می‌کند

این ابزار چه کاری انجام می‌دهد

موارد استفادهٔ رایج برای توسعه‌دهندگان

قالب‌ها، نوع‌ها یا گونه‌های داده

دام‌های رایج و حالت‌های لبه‌ای

چه زمانی از این ابزار استفاده کنیم در برابر کُد