ioc-fanger

What it is and what it does

IOC Fanger is a Python library that bidirectionally transforms indicators of compromise (IOCs) between defanged and normal forms. Defanging is a common practice in threat intelligence to prevent accidental execution or lookup of malicious URLs, domains, and email addresses—replacing dots with `[.]`, colons with `[:]`, and using obfuscated URL schemes like `hXXp://`. This package reverses those transformations (fanging) and also applies them (defanging) using a conservative, unambiguous set of substitutions.

The library recognizes a wide range of defanging patterns: brackets, parentheses, and braces around special characters; literal words like `DOT` or `punto` substituted for dots; escaped characters; IPv4 addresses with commas; and malformed URL schemes. It combines these patterns, so complex inputs like `hXXp://bad[.]example[dot]com/file[.]php` are fully restored in a single call. The defang function applies the reverse—replacing dots between word characters with `[.]`, URL schemes with obfuscated variants, and `@` symbols with `(at)`—ensuring output that can be reliably re-fanged.

Use it for:

• Restore defanged IOCs from threat reports, security blogs, or social media posts for automated lookup and enrichment.
• Defang URLs and domains before sharing them in emails, Slack, or documentation to prevent accidental clicks.
• Normalize IOC formats in threat intelligence feeds or SIEM ingestion pipelines.
• Parse mixed defanged and normal IOCs from unstructured security alerts or incident notes.
• Build threat-hunting tools that accept user-pasted IOCs in either form and convert them for database queries.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Converts defanged indicators of compromise (IOCs) like `example[.]com` back to `example.com`, and conversely fangs normal IOCs to obfuscated forms for safe sharing in threat intelligence.

Yes. Active maintenance, no known vulnerabilities, permissive MIT license, and low install friction make it a safe choice. The package solves a real, recurring problem in threat intelligence workflows. Use it when you need to reliably convert between defanged and normal IOC forms.

Install

ioc-fanger on PyPI

pip install ioc-fanger

uv add ioc-fanger

poetry add ioc-fanger

Installing ioc-fanger

Before you install

Low friction: pure Python wheel with a single runtime dependency (click). Active maintenance—last commit 2026-08-11, 58 days since latest release. Supports Python 3.10 through 3.14.

License in practice

MIT license (permissive). No restrictions on use, modification, or redistribution in commercial or proprietary projects.

Quickstart

pip install ioc-fanger

from ioc_fanger import fang, defang

defanged = defang('example.com')
restored = fang('example[.]com')

Requires Python 3.10 or later.

Verify before relying

• Whether the package is suitable for real-time processing of large IOC batches or primarily for ad-hoc text transformation.
• Performance characteristics when processing complex multi-pattern defanged strings (e.g., mixed escaping styles).

Package facts

Evidence: ioc_fanger-5.1.1-py3-none-any.whl

Keywords: defang, defanging, fang, fanging, indicators of compromise, iocs, malware, observables, refang, threat hunting, threat intelligence

Tags

More Security packages