IOC Refanger

Indicators arrive defanged in advisories, reports and email. Before they can be loaded into a SIEM, pushed to a blocklist or run through a lookup, the original form has to come back. That is all this does — and it is the exact inverse of the IOC Defanger, so a value round-trips through both unchanged.

Output is rendered as plain text and is never turned into a link. A restored indicator cannot be followed from this page by accident, which matters precisely because what you have just restored is live.

Which markers are recognised

Delimited ones: [.], (.), {.}, \., [dot], [at], (at), [@], [:], [://], and hxxp / hxxps.

Space-separated styles — evil dot com, user at evil.com — are deliberately not recognised. The words "at" and "dot" occur constantly in ordinary prose, and refanging them turns the log line "c2 at evil[.]com" into the email address "c2@evil.com", inventing an indicator that was never in the source. A tool that quietly manufactures indicators is worse than one that misses an unusual notation.

hxxps[://]cdn[.]evil[.]com/pixel restores to https://cdn.evil.com/pixel. Note the order of operations: [://] is handled before the bare [:], or the first would resolve to :// with a stray bracket pair left behind.