Discussions

Malware reports and threat intel feeds often use defanged notations to safely share indicators without risking accidental resolution.
Common examples include

• example[.]com
• hxxp://example[.]com
• hxxps://example[.]com
• http://example<.>com
• example(.).com

It would be awesome if the tool could automatically strip these safe notations by
removing [ and ]
replacing hxxp with http (and hxxps with https)
and handling other rare replacements like < . > or (.) as a dot
This small addition would let me copy-paste domains directly from reports and instantly check if they're already blocked or need to be added.