Network & Web
URL Defanger
Defang URLs and domains for incident reports in your browser. https://example.com becomes hxxps[://]example[.]com so apps stop linking it.
This tool runs open-source code from CyberChef by GCHQ (Apache License 2.0). See open-source credits.
Process selects whether rewriting applies to domains, complete URLs, or all text.
The output retains surrounding text while replacing the selected address characters.
- Paste indicators of compromise into a ticket or chat without creating live links.
Defang a URL inside a report
Input: Seen https://example.com/http-guide and 203.0.113.5
Settings: Escape dots, Escape http, and Escape ://: on, Process: Valid domains and full URLs (the defaults)
Result: Seen hxxps[://]example[.]com/hxxp-guide and 203.0.113.5
Escape http also changed http-guide in the path. The bare IPv4 address stays unchanged in this mode.
Choose substitutions and check remaining addresses
- Paste the report text into Input.
- Choose Only full URLs to leave file names and email domains unchanged.
- Select the Escape options required by your reporting format.
- Everything can change sentence punctuation.
- Defanging does not check reputation or make an address safe to open.