Cyber Threat Intelligence · 3 of 5
Defanging Indicators: Sharing Them Safely
A live malicious link is dangerous the moment it's written down. Defanging turns indicators into inert text so they can be shared without anyone — or anything — accidentally acting on them.
Imagine emailing a colleague a warning about a malicious website. If you paste the real address, your mail client turns it into a clickable link, a security scanner might visit it automatically, and one careless click could infect someone. The information you wanted to share safely has become a live hazard. Defanging solves this: it rewrites an indicator so it still reads clearly to a human but can no longer be clicked, resolved, or executed by anything that handles it.
What defanging is
Defanging is the practice of altering a malicious indicator — a web address, a domain, an internet address, an email — so that it is no longer 'live' but is still readable. The changes are small and reversible: replace the characters that software recognizes as actionable with lookalikes that a person can still read but a machine will not act on.
The most common conventions are simple. The 'http' or 'https' at the start of a link becomes 'hxxp', which breaks the link without hiding what it was. Dots in a domain or address are wrapped in brackets, so example.com becomes example[.]com and an address like 203.0.113.5 becomes 203[.]0[.]113[.]5. The '@' in an email becomes '[at]'. The meaning survives; the danger does not.
Live versus defanged
The transformation is small but the difference in risk is large. A live link is something software wants to help with: it gets highlighted, previewed, and sometimes visited automatically. A live internet address may be picked up by a tool and acted on. Once defanged, the same indicator is just text — safe to paste into a chat, a ticket, or a report.
Nothing is lost in the process. An analyst who needs to use the indicator can reverse the change in a moment, which the next sections cover.
Why it matters
Defanging guards against three everyday accidents. First, a human misclick: a live link in a warning email is one slip away from the very infection you are warning about. Second, automated action: mail filters, chat previews, and security tools may fetch or 'detonate' a link just by processing it, which can tip off an attacker or trigger harm. Third, live indicators travelling through systems that were never meant to act on them.
- A colleague clicks a live link in your warning by mistake
- A scanner or preview tool visits the address automatically
- An attacker sees the lookup and knows they've been spotted
- A live indicator sits armed inside a document or ticket
Defang, share, refang
In practice the indicator makes a short round trip. You defang it to make it inert. You share the defanged version — in an email, a report, a chat. The analyst who needs to act on it refangs it: reverses the change to restore the working indicator, usually inside a controlled tool rather than a mail client.
The discipline is to keep an indicator defanged for as long as it is 'in the open' — in transit, in a document, in front of people — and only refang it in the safe, deliberate place where it will actually be used.
Written for humans or machines
Defanging is a convenience for people, not a security control for machines. When the consumer is a human reading a report or a chat, defanged text is exactly right: clear and safe. When the consumer is a tool, the better answer is a structured feed built for the job — a standard format such as the OASIS Structured Threat Information Expression (STIX), where indicators live in fields that software ingests deliberately and never accidentally clicks.
Choosing the right channel avoids both failure modes: live indicators loose in human-facing text, and defanged strings jammed into a machine feed that then has to guess how to un-mangle them.
Defanging for AI pipelines
AI agents — software that uses a model to take real actions like fetching web pages or calling tools — raise the stakes for this old habit. Feed an agent a threat report that still contains a live web address, and the agent may helpfully follow it: reading the page, or worse, treating text on it as new instructions. A live indicator inside content an automated system reads is exactly the accident defanging was invented to prevent.
The rule carries over cleanly. Any indicator that will pass through an automated pipeline should be defanged in the human-facing parts and carried as structured data where a tool consumes it deliberately. Never let a live malicious indicator sit inside free text that an agent might read and act on.
Key takeaways
- Defanging rewrites a malicious indicator so it stays readable but can no longer be clicked, resolved, or executed.
- Common conventions: 'http' becomes 'hxxp', dots are bracketed (example[.]com), and '@' becomes '[at]'.
- It prevents three accidents: human misclicks, automated tools acting on the indicator, and live indicators sitting armed in transit.
- The round trip is defang, share, refang — only restore the indicator in the controlled place it will be used.
- Defanged text is for humans; a structured feed such as STIX is the right channel for tools.
- For AI agents, never leave a live indicator in free text an agent might read and auto-follow.
Glossary
- Defanging
- Rewriting a malicious indicator so it remains readable but can no longer be clicked, resolved, or executed.
- Refanging
- Reversing a defanged indicator back to its working form, done in a controlled tool where it will be used.
- hxxp
- A defanged form of 'http' that keeps a web address readable while breaking it as a live link.
- Detonate
- When a tool automatically opens or executes an indicator (such as visiting a link) just by processing it.
- STIX
- The OASIS Structured Threat Information Expression, a standard format for carrying indicators to tools deliberately.