---
id: ioc-fanger
version: "5.1.1"
license: MIT
license_treatment: permissive
maintenance: active
---

# ioc-fanger — Python package to defang and fang indicators of compromise from text.

License: permissive · Maintenance: active · Downloads: 113.3K/mo

## What it is and what it does

IOC Fanger is a Python library that bidirectionally transforms indicators of compromise (IOCs) between defanged and normal forms. Defanging is a common practice in threat intelligence to prevent accidental execution or lookup of malicious URLs, domains, and email addresses—replacing dots with `[.]`, colons with `[:]`, and using obfuscated URL schemes like `hXXp://`. This package reverses those transformations (fanging) and also applies them (defanging) using a conservative, unambiguous set of substitutions.

The library recognizes a wide range of defanging patterns: brackets, parentheses, and braces around special characters; literal words like `DOT` or `punto` substituted for dots; escaped characters; IPv4 addresses with commas; and malformed URL schemes. It combines these patterns, so complex inputs like `hXXp://bad[.]example[dot]com/file[.]php` are fully restored in a single call. The defang function applies the reverse—replacing dots between word characters with `[.]`, URL schemes with obfuscated variants, and `@` symbols with `(at)`—ensuring output that can be reliably re-fanged.

Use it for:

- Restore defanged IOCs from threat reports, security blogs, or social media posts for automated lookup and enrichment.
- Defang URLs and domains before sharing them in emails, Slack, or documentation to prevent accidental clicks.
- Normalize IOC formats in threat intelligence feeds or SIEM ingestion pipelines.
- Parse mixed defanged and normal IOCs from unstructured security alerts or incident notes.
- Build threat-hunting tools that accept user-pasted IOCs in either form and convert them for database queries.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Converts defanged indicators of compromise (IOCs) like `example[.]com` back to `example.com`, and conversely fangs normal IOCs to obfuscated forms for safe sharing in threat intelligence.

Yes. Active maintenance, no known vulnerabilities, permissive MIT license, and low install friction make it a safe choice. The package solves a real, recurring problem in threat intelligence workflows. Use it when you need to reliably convert between defanged and normal IOC forms.

## Install

pip install ioc-fanger
uv add ioc-fanger
poetry add ioc-fanger

## Installing ioc-fanger

Before you install: Low friction: pure Python wheel with a single runtime dependency (click). Active maintenance—last commit 2026-08-11, 58 days since latest release. Supports Python 3.10 through 3.14.

License in practice: MIT license (permissive). No restrictions on use, modification, or redistribution in commercial or proprietary projects.

Quickstart:

pip install ioc-fanger

from ioc_fanger import fang, defang

defanged = defang('example.com')
restored = fang('example[.]com')

Requires Python 3.10 or later.

Verify before relying:

- Whether the package is suitable for real-time processing of large IOC batches or primarily for ad-hoc text transformation.
- Performance characteristics when processing complex multi-pattern defanged strings (e.g., mixed escaping styles).

## Package facts

- License: MIT (permissive)
- Python support: supports_current
- Install friction: low
- Maintenance: active
- Downloads: 113.3K/month (top 15,000 on PyPI)
- Known vulnerabilities: none known

## Tags

defang refang IOC indicators of compromise, convert defanged URLs domains, threat intelligence IOC obfuscation, malware sample URL defanging, restore fanged network observables, threat-intelligence, ioc-processing, malware-analysis

[View on SkillFed](https://skillfed.io/packages/ioc-fanger) · [View on PyPI](https://pypi.org/project/ioc-fanger/)