This document codifies a consistent and reversible convention used in the threat intelligence and security communities for sharing potentially malicious indicators of compromise (IOCs), such as URLs, IP addresses, email addresses, and domain names. It describes a safe obfuscation format that reduces the risk of accidental execution or activation when IOCs are displayed or transmitted. These conventions aim to improve interoperability among tools and feeds that exchange threat intelligence data. This specification references the URI syntax defined in RFC 3986 and follows the key word conventions from RFC 2119.