The phishing URL uses the 'userinfo' component (random string before '@') to generate unique URLs that evade exact-match blocklists and may track victims. The hostname contains a label starting or ending with a hyphen, which is invalid per RFC 952/1123 but accepted by DNS and browsers, causing strict validators and regex-based extractors to skip it. The domain is a lookalike of a legitimate Croatian company domain, with a deceptive ccTLD replacement. The victim's email address is appended in the path, which can confuse parsers that split on the last '@', making it appear as if the URL points to the victim's own trusted domain. Browsers correctly interpret the URL and connect to the attacker's server. This technique exploits discrepancies in URL parsing across tools to bypass security controls without exploiting software vulnerabilities.

The impact is phishing attacks that evade detection by common URL filtering, blocklisting, and parsing tools, increasing the likelihood of successful victim interaction. There is no exploitation of software vulnerabilities, but the technique undermines security controls relying on strict URL validation or simple pattern matching. This can lead to credential theft or other phishing-related compromises if victims are deceived.

No software patch is applicable as this is not a software vulnerability but a phishing technique exploiting parser differences. Security teams should update detection rules to identify URLs with multiple '@' characters, hostnames with labels starting or ending with hyphens, and paths containing the recipient's email address. Awareness training for users about such deceptive URLs is recommended. Since this technique relies on URL parsing discrepancies, improving URL parsing robustness in security tools can help mitigate detection evasion.