[IN]Input URLs
URL Defanger & Safelink Decoder
Extract original URLs from MS Safelinks/Proofpoint, and Defang IOCs (hxxps://evil[.]com) for safe sharing in incident reports.
Local processing
This tool processes your input in your browser.
[OUT]Defanged IOCs
Supports Microsoft Safelinks
Supports Proofpoint URLDefense (v2)
Related Tools
Investigation Workspace
Analyze and organize security indicators, logs, files, and timelines in one local workspace.
Interactive Playbook Builder
Design and execute structured security incident response workflows.
Sigma Rule Builder
Create portable Sigma detection rules locally for SIEM and EDR workflows.
Email Security Analyzer
Inspect email headers locally for SPF, DKIM, DMARC and phishing indicators.