PhishingPublished 24 Sep 2026

One URL, Three Different Tricks, (Thu, Sep 24th)

Source SANS ISC Handlers Diary

phishing

Description

This report describes a phishing technique using a single URL crafted to evade detection by various security controls. The URL employs three tricks: embedding a userinfo field to create unique URLs and confuse filters, using a hostname with invalid hyphen placement to bypass strict validators, and appending the victim's email address in the path to mislead parsers. These tricks exploit differences in URL parsing rather than software vulnerabilities. The phishing link directs victims to a malicious page that may pre-fill their email address to increase credibility.

Impact

The impact is phishing attacks that evade detection by common URL filtering, blocklisting, and parsing tools, increasing the likelihood of successful victim interaction. There is no exploitation of software vulnerabilities, but the technique undermines security controls relying on strict URL validation or simple pattern matching. This can lead to credential theft or other phishing-related compromises if victims are deceived.

Defensive guidance

No software patch is applicable as this is not a software vulnerability but a phishing technique exploiting parser differences. Security teams should update detection rules to identify URLs with multiple '@' characters, hostnames with labels starting or ending with hyphens, and paths containing the recipient's email address. Awareness training for users about such deceptive URLs is recommended. Since this technique relies on URL parsing discrepancies, improving URL parsing robustness in security tools can help mitigate detection evasion.

Summary

The phishing URL uses the 'userinfo' component (random string before '@') to generate unique URLs that evade exact-match blocklists and may track victims. The hostname contains a label starting or ending with a hyphen, which is invalid per RFC 952/1123 but accepted by DNS and browsers, causing strict validators and regex-based extractors to skip it. The domain is a lookalike of a legitimate Croatian company domain, with a deceptive ccTLD replacement. The victim's email address is appended in the path, which can confuse parsers that split on the last '@', making it appear as if the URL points to the victim's own trusted domain. Browsers correctly interpret the URL and connect to the attacker's server. This technique exploits discrepancies in URL parsing across tools to bypass security controls without exploiting software vulnerabilities.

References

isc.sans.edu/diary/rss/33366 (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 24 Sep 2026, 06:32 UTC

References

Community reviews

Related threats