eBanking Phishing Delivered Through IPv4-Mapped IPv6 Address, (Fri, Jun 19th)
ID: 0e536f87-b529-5005-909b-f4f110ec5d0e
STIX ID: report--0e536f87-b529-5005-909b-f4f110ec5d0e
Feed Name: SANS ISC Diary
Threat Score
The report documents a phishing email targeting a major Belgian bank that uses an IPv6-mapped IPv4 literal (`http://[::ffff:5511:74be]/kWC5PHA1`) to hide the real IPv4 address (`http://85.17.116.190/kWC5PHA1`) and redirect victims to a hosted phishing kit at `https://3439-aanmelden.verificatie.qzz.io/mon-belfius`, illustrating an evasion technique to bypass simple regex-based URL/IP extraction.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.