{"categories":[{"label":"Security","url":"https://skillfed.io/packages/category/security/3"}],"enrichment":{"capability":"Converts defanged indicators of compromise (IOCs) like `example[.]com` back to `example.com`, and conversely fangs normal IOCs to obfuscated forms for safe sharing in threat intelligence.","skillfed_tags":["threat-intelligence","ioc-processing","malware-analysis"],"use_cases":["Restore defanged IOCs from threat reports, security blogs, or social media posts for automated lookup and enrichment.","Defang URLs and domains before sharing them in emails, Slack, or documentation to prevent accidental clicks.","Normalize IOC formats in threat intelligence feeds or SIEM ingestion pipelines.","Parse mixed defanged and normal IOCs from unstructured security alerts or incident notes.","Build threat-hunting tools that accept user-pasted IOCs in either form and convert them for database queries."],"what_it_does":"IOC Fanger is a Python library that bidirectionally transforms indicators of compromise (IOCs) between defanged and normal forms. Defanging is a common practice in threat intelligence to prevent accidental execution or lookup of malicious URLs, domains, and email addresses\u2014replacing dots with `[.]`, colons with `[:]`, and using obfuscated URL schemes like `hXXp://`. This package reverses those transformations (fanging) and also applies them (defanging) using a conservative, unambiguous set of substitutions.\n\nThe library recognizes a wide range of defanging patterns: brackets, parentheses, and braces around special characters; literal words like `DOT` or `punto` substituted for dots; escaped characters; IPv4 addresses with commas; and malformed URL schemes. It combines these patterns, so complex inputs like `hXXp://bad[.]example[dot]com/file[.]php` are fully restored in a single call. The defang function applies the reverse\u2014replacing dots between word characters with `[.]`, URL schemes with obfuscated variants, and `@` symbols with `(at)`\u2014ensuring output that can be reliably re-fanged.","worth_installing":"Yes. Active maintenance, no known vulnerabilities, permissive MIT license, and low install friction make it a safe choice. The package solves a real, recurring problem in threat intelligence workflows. Use it when you need to reliably convert between defanged and normal IOC forms."},"id":"ioc-fanger","links":{"html":"https://skillfed.io/packages/ioc-fanger","md":"https://skillfed.io/packages/ioc-fanger.md","pypi":"https://pypi.org/project/ioc-fanger/"},"maintenance":{"status":"active"},"meta":{"latest_release":"2026-06-17","license_spdx":null,"license_treatment":"permissive","name":"ioc-fanger","python_support":"supports_current","summary":"Python package to defang and fang indicators of compromise from text."},"popularity":{"monthly_downloads":113267,"position":12348,"tier":"top_15000"},"security":{"n_vulnerabilities":0},"version":"5.1.1"}