IOC defang / refang + classify API

Pure-compute IOC processor: scan text for indicators of compromise, detect and classify each (ipv4, ipv6, domain, url, email, md5/sha1/sha256 hash, cve), and convert safely between defanged (hxxp://, 1[.]2[.]3[.]4, evil[dot]com) and live forms — returning each indicator with its type, value, and defanged form plus counts by type. Deterministic and offline. Answers 'defang these IOCs', 'refang this hxxp link', 'what indicators are in this text', 'classify these IOCs by type'.

Price$0.01per request

MethodPOST

Route/v1/security/ioc-defang

StatusLive

MIME typeapplication/json

Rate limit60/minute

CacheNo cache

securityiocdefangrefangindicatorsthreat-intelclassifyiocs

API URLhttps://x402.hexl.dev/v1/security/ioc-defang

Integration docs

Example request

{
  "text": "see hxxp://evil[.]com/x and 1[.]2[.]3[.]4 hash 44d88612fea8a8f36de82e1278abb02f CVE-2021-44228"
}

Example response

{
  "op": "auto",
  "count": 4,
  "countsByType": {
    "url": 1,
    "ipv4": 1,
    "md5": 1,
    "cve": 1
  },
  "indicators": [
    {
      "type": "url",
      "raw": "hxxp://evil[.]com/x",
      "value": "http://evil.com/x",
      "defanged": "hxxp://evil[.]com/x",
      "wasDefanged": true
    },
    {
      "type": "ipv4",
      "raw": "1[.]2[.]3[.]4",
      "value": "1.2.3.4",
      "defanged": "1[.]2[.]3[.]4",
      "wasDefanged": true
    },
    {
      "type": "md5",
      "raw": "44d88612fea8a8f36de82e1278abb02f",
      "value": "44d88612fea8a8f36de82e1278abb02f",
      "defanged": "44d88612fea8a8f36de82e1278abb02f",
      "wasDefanged": false
    },
    {
      "type": "cve",
      "raw": "CVE-2021-44228",
      "value": "CVE-2021-44228",
      "defanged": "CVE-2021-44228",
      "wasDefanged": false
    }
  ]
}

Input schema

{
  "type": "object",
  "required": [
    "text"
  ],
  "properties": {
    "text": {
      "type": "string",
      "examples": [
        "see hxxp://evil[.]com/x and 1[.]2[.]3[.]4"
      ]
    },
    "op": {
      "type": "string",
      "enum": [
        "auto",
        "defang",
        "refang"
      ],
      "examples": [
        "auto"
      ]
    }
  }
}

Output schema

{
  "type": "object",
  "additionalProperties": true
}