Defang and Refang: Handle hxxp and IOCs Correctly

An IOC shared as hxxps://portail[.]example/connexion cannot be directly compared with the URL produced by a browser. This notation, called defanging, reduces accidental activation when sharing indicators. The reverse operation, refanging, restores a representation usable for analysis.

The risk comes from implicit conversions. A tool can modify an indicator, create a clickable link or trigger a preview before the analyst has decided to contact the destination. A reliable procedure handles the received text, its conversion and any network action as separate steps.

Retain three distinct representations

First, preserve the received value exactly as it appears in the report or message. Add its source, location within the document and collection date. This version helps determine whether an error came from the producer, extraction or your own processing.

Next, create a technical value intended for validation and comparison. Record its expected type, the conversion recipe and any warnings. Finally, generate a defanged display representation for tickets, notifications and documents intended for readers.

These forms can look similar while serving different purposes. Copying the display form into a detection rule can prevent matching. Displaying the technical value in a tool that automatically converts URLs to links can trigger actions the author did not intend.

Identify the convention before converting

Common forms include hxxp, hxxps and [.] in place of a dot. Other reports use parentheses or words. Do not assume that every producer follows the same convention or that a string containing brackets is necessarily defanged.

CyberChef’s Defang URL operation illustrates an implementation with defined transformations and options. Document the accepted forms for your pipeline in the same way. A precise recipe can be tested; a series of improvised replacements cannot provide the same assurance.

In this fictional example, the scheme and domain separator follow an identified convention:

received: hxxps://portail[.]example/connexion
restored: https://portail.example/connexion
displayed: hxxps://portail[.]example/connexion

The conversion preserves the path. It does not determine whether the site is malicious, reachable or even exists. The .example domain is illustrative and does not represent a service to visit.

Restrict replacements to their expected positions

A global replacement of hxxp can affect a value in a path or parameter when only the scheme was meant to change. Globally removing brackets can break an IPv6 URL. Identify the expected structure first, then apply recognized transformations.

After conversion, use a parser appropriate to the IOC type. An IP address, domain and URL cannot all be validated with the same regular expression. A relative URL does not become absolute until its base is known; do not assign a domain for convenience.

A parsing failure should stop automatic export and create an explicit item for review. Do not repeatedly repair the string until the parser accepts something. That approach can manufacture an indicator different from the one originally published.

The IOC pipeline guide places this validation within ingestion. Defanging remains a representation convention and must not become a threat classification.

Keep refanging separate from network activity

Text conversion can happen without a DNS query or HTTP connection. Preserve that property in your tools: disable previews on indicator fields and avoid automatic enrichment before the necessary checks.

In particular, examine whether the URL contains a recipient identifier, login token or internal resource. Submission to an external service can disclose that information or cause its scanner to visit the destination. Replacing http with hxxp has removed none of those details.

The guide to scanning confidential URLs examines this sharing decision. In a routine ticket, display a defanged and, where necessary, redacted version while retaining the complete evidence in the location authorized by your policy.

Describe the data correctly in structured exchanges

An exchange format cannot infer your presentation convention. If you use STIX, the defanged property applies to the observable objects covered by that part of the model. The STIX 2.1 specification defines it for Cyber-observable Objects, defaults it to false and does not apply it indiscriminately to every object.

Check the object actually being sent and the consumer’s expectations. Adding this field to an Indicator object that does not support it cannot replace correct encoding of the pattern. Test the export with the validator and receiving system used by your team.

For a plain CSV exchange, explicitly include a type and representation state instead of expecting the recipient to guess them. A file mixing raw IPs, defanged domains and partly restored URLs needs to be identified as such before import.

Test errors that are easy to miss

Prepare positive and negative cases based on approved conventions. Check a URL that is already usable, a known defanged URL, an IPv6 address in brackets and an ambiguous string. Add links with sensitive parameters to verify how they are displayed.

Applying the same conversion a second time should not continue changing an already processed value. Also test the complete path through ingestion, validation, export and import in a test environment. Correct display in the first tool does not guarantee that the second recovers the same indicator.

Retain cases that caused parsing incidents, using fictional or redacted data. They form a useful test corpus when a library changes. Track converted, rejected and manually reviewed inputs separately; silent rejection hides lost intelligence.

Base the conclusion on the value actually analyzed

The case record must connect the published indicator to the validated value and the lookup performed. Record every transformation that changed its representation. If ambiguity remains, ask the producer for clarification before deploying a broad rule.

For a validated public domain or IP, you can open an IsMalicious report as a separate enrichment step. The preceding conversion performed no reputation assessment. Keeping these operations separate lets you share a readable IOC while retaining control over its interpretation and use.