XARF URL defanging about xarf

[Maximilian-Staab]

The schema currently doesn't allow for defanged URLs in any way, and I don't think it's something we will support in the future.

Here's the reasoning behind that:

1. Defanged urls often used to prevent accidental clicks from abuse-desk workers. This should be a non issue for XARF, because the schema is intended to be processed automatically.
2. Spam filters on abuse addresses are never a good Idea¹ and should't be a reason for adding defanged urls. We even made a video about this issue a while ago: https://www.youtube.com/watch?v=1xeLcHIkTMo
3. Someone who runs a spam filter on their abuse address probably won't be diligent about the incoming messages anyway.

I know this won't help you, but I hope this clarifies a few things.

Footnotes

1. A spam filter could dislike many things about XARF reports and trying to circumvent them won't increase the quality of such reports. ↩