Broken Phishing URLs, (Thu, Feb 5th)

The author reports a resurgence of phishing emails that use intentionally malformed URL query parameters (examples include worker.dev and netlify.app links with broken parameter fragments) to evade detection and break IOC extraction or URL normalization; browsers still follow the links, enabling the malicious site visit while many security controls and regex-based pipelines may miss these IOCs.