Accepts domains, IPs, URLs, emails, file hashes, and CIDR ranges — defanged IOCs like hxxp, [.], and [at] are auto-refanged.
hxxp
[.]
[at]