Skip to main content
CompressNConvert

IOC Refanger

Restore common defanged IOC spellings locally without visiting or resolving them.

Runs locally in your browser

Recognizes HTTP(S) URLs, domains, IPv4, IPv6, and email addresses.

Handle restored indicators carefully. Refanged values can become clickable when copied elsewhere. Review before opening; this page never contacts them.

3 indicators changed

Refanged result

Review https://portal.example.com/login?source=email and 198.51.100.42.
Contact: [email protected]

Complete tool guide

IOC Refanger guide

The IOC Refanger restores common bracketed separators and hxxp schemes so indicators can be compared or exported in normalized form.

Your input is processed in the current browser tab and is not sent to the application server.

Why use this tool?

  • Handle untrusted indicator text without a lookup or enrichment request.
  • Keep the output as selectable plain text instead of opening recognized values.
  • Copy or download a result for a report, ticket, or investigation workflow.

Common use cases

  • Normalizing indicators copied from a threat report
  • Preparing defanged values for an approved analysis workflow
  • Comparing differently formatted copies of the same indicator

How to use it

  1. 1

    Paste defanged indicators or report text.

  2. 2

    Review how many recognized indicators changed.

  3. 3

    Inspect the restored values without opening them.

  4. 4

    Copy or download the plain-text result only when needed.

Refanging

The tool restores hxxp and hxxps schemes plus common bracketed, parenthesized, or braced dot, colon, and at-sign markers.

Plain-text output

Restored values are displayed as text, not links. Another application may automatically make them clickable after you paste them.

Local processing

Everything runs in this browser tab. The page never visits, resolves, enriches, or submits an indicator.

Practical tips for better results

  • Treat restored indicators as untrusted and do not open them casually.
  • Use an isolated, approved investigation environment for further analysis.
  • Compare restored output with the source before using it in automation.

Frequently asked questions

Does the IOC Refanger upload or look up indicators?

No. Processing stays in this browser tab. The tool does not visit, resolve, enrich, or submit an indicator.

Does a syntax match mean an indicator is malicious?

No. These tools only recognize and transform supported text patterns. They do not provide a reputation or safety verdict.

Keep working

Related cybersecurity tools

Continue with another focused tool from the same collection.

IOC DefangerDefang URLs, domains, IP addresses, and email addresses for safer sharing in reports and tickets.IOC ExtractorExtract, normalize, categorize, and deduplicate common indicators from incident text or threat reports.IP & CIDR CalculatorCalculate IPv4 and IPv6 network boundaries, address ranges, masks, and exact counts with CIDR-aware validation.Secret Scanner & RedactorDetect common API keys, tokens, credentials, and private keys in pasted text, then create a masked local copy.