Searching for Defanged Observable Values

The ThreatStream observables search supports defanged domain, email address, IP address, and URL observable queries. When you enter a defanged value, ThreatStream queries and returns non-defanged observable values.

The following types of defanged values are supported for both basic and advanced searches:

• [.] or [:]

  Examples:

  • analyst@security[.]com returns analyst@security.com
  • https[:]//test[.]com returns https://test.com
  • 1[.]1[.]1[.]1 returns 1.1.1.1

• {.}

  Examples:

  • 1{.}1{.}1{.}1 returns 1.1.1.1
  • https{:}//test{.}com returns https://test.com

• hxxp://

  Examples:

  • hxxp://test.com returns http://test.com
  • hxxp[:]//test[.]com returns http://test.com

• hxxps://

  Examples:

  • hxxps://test.com returns https://test.com
  • hxxps{:}//test{.}com returns https://test.com

• meow://

  Example: meow://test.com returns http://test.com

• meows://

  Example: meows://test.com returns https://test.com

The following is supported for basic search only:

(.)

Example: test(.)com returns test.com.