IOC Defanger

Ticketing systems, mail clients and chat tools autolink anything shaped like a URL. That is a problem in an incident: a colleague clicks a live C2 address by accident, or a link previewer, URL scanner or mail gateway fetches it on their behalf and tells the operator their infrastructure has been found. Defanging breaks the pattern so none of that can happen.

Three transformations are applied, and nothing else. The scheme is disguised —http and https become hxxp and hxxps. Every dot is wrapped. Every at-sign is wrapped. The host, path and query are left byte-identical, which is what makes the operation exactly reversible: running the output through the IOC Refanger returns the original string character for character.

Which style to pick

Square brackets are the most widely recognised convention and the default here. Parentheses appear in some vendor reporting. The escaped style suits contexts where brackets themselves get mangled — some Markdown renderers and chat clients among them.

https://cdn.evil.com/pixel becomes hxxps[:]//cdn[.]evil[.]com/pixel, and drop@evil.net becomes drop[@]evil[.]net. The path /pixel is untouched, so nothing about the indicator is lost — only its ability to be clicked.