diff --git a/grimoire_elk/raw/mbox.py b/grimoire_elk/raw/mbox.py
index e6ddd60e9..d45117c25 100644
--- a/grimoire_elk/raw/mbox.py
+++ b/grimoire_elk/raw/mbox.py
@@ -23,6 +23,7 @@
 
 from .elastic import ElasticOcean
 from ..elastic_mapping import Mapping as BaseMapping
+from ..enriched.utils import anonymize_url
 
 
 logger = logging.getLogger(__name__)
@@ -79,3 +80,7 @@ def _fix_item(self, item):
         for field in fields:
             if field.lower().startswith("x-"):
                 item["data"].pop(field)
+
+        # Remove credentials from URL
+        item['origin'] = anonymize_url(item['origin'])
+        item['tag'] = anonymize_url(item['tag'])
diff --git a/releases/unreleased/mbox-origin-url-anonymized.yml b/releases/unreleased/mbox-origin-url-anonymized.yml
new file mode 100644
index 000000000..0dd603f8d
--- /dev/null
+++ b/releases/unreleased/mbox-origin-url-anonymized.yml
@@ -0,0 +1,7 @@
+---
+title: MBOX origin URL anonymized
+category: fixed
+author: Jose Javier Merchante <jjmerchante@bitergia.com>
+issue: null
+notes: >
+  Remove credentials from MBOX origin URL and tag fields.