{"id":13787,"date":"2026-06-23T04:03:34","date_gmt":"2026-06-23T04:03:34","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2026\/06\/23\/33090\/"},"modified":"2026-06-23T04:03:34","modified_gmt":"2026-06-23T04:03:34","slug":"33090","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2026\/06\/23\/33090\/","title":{"rendered":"eBanking Phishing Delivered Through IPv4-Mapped IPv6 Address, (Fri, Jun 19th)"},"content":{"rendered":"

eBanking Phishing Delivered Through IPv4-Mapped IPv6 Address, (Fri, Jun 19th)
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

I detected an interesting phishing email this morning. It targets a major Belgian bank:<\/p>\n

\"\"<\/p>\n

The phishing in itself is a classic one, not relevant but the malicious link is interesting:<\/p>\n

\nhxxp:\/\/[::ffff:5511:74be]\/kWC5PHA1<\/pre>\n
The technique used by the attacker is to bypass simple security controls trying to extract domain names and IP addresses via simple regular expressions. The notation \u201c[\u2026]\u201d tells the URL parser that what’s inside is a literal IPv6 address. But it\u2019s not a real IPv6 address. What\u2019s the magic?<\/p>\n
The started \u201c::\u201d in the address means that it can be expanded to this address:<\/p>\n
\n0000:0000:0000:0000:0000:ffff:5511:74be<\/pre>\n
The trick is the fifth group (::ffff:) means that we are facing a IPv4-mapped IPv6 address. This is defined in RFC 4291[1<\/a>]:<\/p>\n
\"\"<\/p>\n
In the URL above, the two trailing 16-bit hex groups \u201c5511\u201d and \u201c74be\u201d are just the four IPv4 octets written in hex.<\/p>\n\n\n\n\n\n\n\n\n
Hex<\/th>\nDec<\/th>\n<\/tr>\n<\/thead>\n
0x55<\/td>\n85<\/td>\n<\/tr>\n
0x11<\/td>\n17<\/td>\n<\/tr>\n
0x74<\/td>\n116<\/td>\n<\/tr>\n
0xBE<\/td>\n190<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
The real URL is therefore:<\/p>\n
\nhxxp:\/\/85[.]17[.]116[.]190\/kWC5PHA1<\/pre>\n
Another good news from the attacker\u2019s point of view, there is no DNS record!<\/p>\n
When visited, this URL redirects to another link where the real phishing kit is hosted:<\/p>\n
\nhxxps:\/\/3439-aanmelden[.]verificatie[.]qzz[.]io\/mon-belfius<\/pre>\n
[1]\u00a0https:\/\/www.rfc-editor.org\/info\/rfc4291\/<\/a><\/p>\n
Xavier Mertens (@xme)<\/b>
\nXameco
\nSenior ISC Handler – Freelance Cyber Security Consultant
\nPGP Key<\/a><\/p>\n
 (c) SANS Internet Storm Center. https:\/\/isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.<\/p><\/div>\n
 \t

\n 
<\/BR><\/p>\n
 \t

\n
<\/BR>
\nGo to isc.sans.edu<\/a>
\n \t

\n 
<\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"
eBanking Phishing Delivered Through IPv4-Mapped IPv6 Address, (Fri, Jun 19th) I detected an interesting phishing email this morning. It targets a major Belgian bank: The phishing in itself is a classic one, not relevant but the malicious link is interesting: hxxp:\/\/[::ffff:5511:74be]\/kWC5PHA1 The technique used by the attacker is to bypass simple security controls trying to […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[56],"tags":[69],"class_list":["post-13787","post","type-post","status-publish","format-standard","hentry","category-isc-sans-edu","tag-isc-sans-edu"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/13787"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=13787"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/13787\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=13787"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=13787"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=13787"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}