Defang / Fang IP

It replaces every period with [.] and every colon with [:], which covers IPv4 and IPv6 in one pass. So 8.8.8.8 becomes 8[.]8[.]8[.]8 and 2001:db8::1 becomes 2001[:]db8[:][:]1, neither of which will be picked up as a live address by tools that linkify text.

Set mode to fang. Every [.] becomes a period again and every [:] becomes a colon. That is useful for turning an indicator out of a report back into something you can paste into the CIDR calculator or the IOC extractor.

Yes. Both directions are plain text substitution over the entire input, not a scan for address shaped text. Every period and colon anywhere in the file is affected, timestamps and ordinary sentences included, so give it the indicator list rather than the surrounding narrative if you want a readable result.

Use Defang / Fang URL instead. That one rewrites the scheme to hxxp and the :// to [://], which is the convention people expect. Running the IP defanger on a URL turns the scheme colon into [:] and produces something no one else writes.

No. It is a text substitution running in a Web Worker in this tab, and the file is never transmitted anywhere. Drop several files and each comes back as its own result. Since indicator lists usually come out of an incident, doing this locally keeps the incident local too.