Defang / Fang IP
Defang / Fang IP. Defang turns a live indicator into inert text (won't render as a link); fang reverses it. Pure text substitution, on your device.
Runs on your device. The file is never uploaded.
Defang / Fang IP wraps every period in square brackets and treats every colon the same way, so 8.8.8.8 comes back as 8[.]8[.]8[.]8. An IPv6 address goes through the identical pass, and mode fang undoes both. Give it a URL and the scheme colon is bracketed too, which nobody writes.
Questions
How does it defang an address?
It replaces every period with [.] and every colon with [:], which covers IPv4 and IPv6 in one pass. So 8.8.8.8 becomes 8[.]8[.]8[.]8 and 2001:db8::1 becomes 2001[:]db8[:][:]1, neither of which will be picked up as a live address by tools that linkify text.
How do I undo it?
Set mode to fang. Every [.] becomes a period again and every [:] becomes a colon. That is useful for turning an indicator out of a report back into something you can paste into the CIDR calculator or the IOC extractor.
Does it change my whole file?
Yes. Both directions are plain text substitution over the entire input, not a scan for address shaped text. Every period and colon anywhere in the file is affected, timestamps and ordinary sentences included, so give it the indicator list rather than the surrounding narrative if you want a readable result.
Should I use this on a URL?
Use Defang / Fang URL instead. That one rewrites the scheme to hxxp and the :// to [://], which is the convention people expect. Running the IP defanger on a URL turns the scheme colon into [:] and produces something no one else writes.
Does anything get uploaded?
No. It is a text substitution running in a Web Worker in this tab, and the file is never transmitted anywhere. Drop several files and each comes back as its own result. Since indicator lists usually come out of an incident, doing this locally keeps the incident local too.