Belgian bank phish uses IPv4-mapped IPv6 address
Attackers bypass simple regex security controls by embedding IPv4 addresses as IPv4-mapped IPv6 literals (::ffff:5511:74be) to deliver eBanking phishing pages.
A phishing campaign targeting a major Belgian bank employs an unusual obfuscation technique to evade basic URL detection controls. The malicious link uses IPv4-mapped IPv6 address notation (hxxp://[::ffff:5511:74be]/kWC5PHA1) where the IPv6 literal format masks the actual IPv4 destination. When expanded per RFC 4291, the address 0000:0000:0000:0000:0000:ffff:5511:74be reveals the embedded IPv4 address 85.17.116.190, as the trailing hex groups 5511 and 74be represent the four IPv4 octets in hexadecimal.
The technique exploits simple regular expression-based security controls that may fail to parse this valid but uncommon URL format. The initial URL redirects to the actual phishing kit hosted at hxxps://3439-aanmelden.verificatie.qzz.io/mon-belfius. Notably, the IPv4-mapped address has no associated DNS record, further complicating detection. While the underlying phishing campaign itself is conventional, the delivery mechanism demonstrates attackers' continued evolution in bypassing automated defenses.
Detection guidance
Phishing URL Using IPv4-Mapped IPv6 Address Notation
Detects HTTP requests or logged URLs containing an IPv4-mapped IPv6 literal (e.g. http://[::ffff:x:x]/) used to obfuscate the true destination IP and evade simple regex-based URL filters. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Phishing URL Using IPv4-Mapped IPv6 Address Notation
id: 75ff5fe1-d3a0-5586-a991-e07d79980be3
status: experimental
description: 'Detects requests or logged URLs that use IPv4-mapped IPv6 address notation
(::ffff:xxxx:xxxx) inside a bracketed literal host.
This format is technically valid but rarely used by legitimate sites, and has been
observed as an obfuscation technique in phishing campaigns to bypass simple URL/IP
regex-based security controls.
'
references:
- RFC 4291
logsource:
category: proxy
detection:
selection:
c-uri|contains:
- '[::ffff:'
- ://[::ffff
condition: selection
fields:
- c-uri
- c-useragent
- src_ip
falsepositives:
- Internal diagnostic tooling or network testing scripts that intentionally craft
IPv4-mapped IPv6 literals
- Legacy or dual-stack applications explicitly configured to test IPv6 transition
mechanisms
level: medium
tags:
- attack.t1027
- attack.t1566.002
author: Vorant
HTTP Request to Bracketed IPv6 Literal Host With No Prior DNS Resolution
Detects outbound HTTP(S) connections where the request Host/URL is a bracketed IPv6 literal rather than a domain name, a pattern used by a phishing redirector to mask an embedded IPv4 destination and avoid domain reputation checks. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: HTTP Request to Bracketed IPv6 Literal Host With No Prior DNS Resolution
id: 13916a3b-7d17-5555-a32c-dbe86f54d081
status: experimental
description: 'Detects web/proxy log entries where the requested URL host portion is
a bracketed IPv6 literal (e.g. [::ffff:5511:74be]) instead of a resolvable domain
name.
Legitimate browsing rarely targets raw IPv6 literals directly, and phishing kits
have used this format specifically because it lacks an associated DNS record, complicating
detection and correlation.
'
logsource:
category: proxy
detection:
selection:
c-uri|re: ://\[[0-9a-fA-F:]+\]/
filter_common_ipv6_services:
c-uri|contains:
- ://[::1]
- ://[fe80
condition: selection and not filter_common_ipv6_services
fields:
- c-uri
- dst_ip
- src_ip
falsepositives:
- Internal network management interfaces addressed by link-local or loopback IPv6
literals
- Developer or QA testing directly against IPv6 literal endpoints
level: medium
tags:
- attack.t1566.002
- attack.t1027
author: Vorant
2 more detection artefacts for this report (IOC-atomic rules, Splunk/KQL/Elastic conversions, YARA, Suricata) are available to subscribers.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://isc.sans.edu/diary/rss/33090
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free