title: How to properly defang/disarm URLs with scheme ftp/ftps?
body: <h1>No problems with: HTTP/HTTPS</h1>
  
  <p>When defanging/disarming URL schemes (e.g. with <a href="https://pypi.org/project/defang/" rel="nofollow noreferrer">python-defang</a>):</p>
  
  <ul>
  <li><code>http</code> becomes <code>hXXp</code></li>
  <li><code>https</code> becomes <code>hXXps</code></li>
  </ul>
  
  <p>So, no problem here.</p>
  
  <h1>But what happens with: FTP/FTPS/FXP</h1>
  
  <p>But how can these schemes be properly defanged?</p>
  
  <ul>
  <li><p><code>ftp</code> becomes <code>fXp</code></p>
  
  <ul>
  <li>how do I know, if a given URL is defanged or if it's a real URL which just makes use of the <a href="https://en.wikipedia.org/wiki/File_eXchange_Protocol" rel="nofollow noreferrer"><code>File eXchange Protocol (fxp)</code></a> instead of the normal <code>File Transfer Protocol (ftp)</code>?</li>
  </ul></li>
  <li><p><code>ftps</code> becomes what? <code>fXps</code>?</p>
  
  <ul>
  <li>what is the "official defanged" version of <code>ftps</code>?!</li>
  </ul></li>
  <li><p><code>fxp</code> becomes what? <code>fXxp</code>?</p>
  
  <ul>
  <li>what is the "official defanged" version of <code>fxp</code>?!</li>
  </ul></li>
  </ul>
  
  <h1>Alternative?</h1>
  
  <p>Is there something like a rule of thumb for defanging/disarming: just to make sure that a URL doesn't work anymore within a browser so that the client won't open a malicious URL accidentally?</p>