Defanging Indicators: Why and How

CyberKit field guide

Defanging prevents accidental clicks and keeps automated systems from treating a pasted IOC as a live connection.

Common transformations

• http:// → hxxp://
• https:// → hxxps://
• . → [.] inside hostnames and IPs
• Email: user@example.com → user[at]example[.]com

Use the Defang / Refang tool to transform whole blocks of text instantly.