Defanging

Defanging is the practice of changing a malicious URL, domain, IP address or email address slightly so that it can be shared safely without becoming a clickable link. It is standard in security reports, tickets, chat messages and threat intelligence, and it is the convention used for the example domains in this glossary.

How it works

Defanging breaks the parts of an address that software uses to recognise a link. Common conventions include:

• replacing http with hxxp, and https with hxxps;
• wrapping dots in square brackets, as in examplebank-login[.]com;
• bracketing the colon, as in hxxps[:]//;
• writing email addresses as user[@]example[.]com;
• applying the same bracket style to IP addresses, such as 192.0.2[.]10.

This stops email clients, chat apps and document editors from turning the address into a link, and prevents automatic link previews, which would otherwise visit the malicious site and might alert the attacker. "Refanging" reverses the process when an analyst deliberately needs the working address in an isolated environment. Defanging only changes how an address is written; it does not make the site itself any less dangerous.

Example

As an illustration, an analyst sharing a finding with a colleague writes: "Credential page live at hxxps://examplebank-login[.]com/secure/, hosted on 203.0.113[.]25." The colleague can read and copy it, but nobody opens the site by mistake, and no chat preview requests the page.

When to use it

• In abuse reports and support tickets that describe malicious addresses in free text.
• In internal chats, emails and incident notes.
• In public write-ups, training material and glossaries.
• When forwarding customer reports that contain suspicious links.

What brands can do

Make defanging the default in your security and support teams, and tell customers how to report suspicious links safely. Note one exception: when a provider's abuse report form has a dedicated URL field, enter the real address there so it can be processed automatically, and defang only the free-text description. Phishvoid uses defanged notation in all its reports and communications; report a site to us in either form.

Read more: How to Report a Scam Website (and Get It Taken Down)