> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # eBanking Phishing Delivered Through IPv4-Mapped IPv6 Address, (Fri, Jun 19th) - URL: https://f4n6.co.uk/security-feed/ebanking-phishing-delivered-through-ipv4-mapped-ipv6-address-fri-jun-19th/ - Published: 2026-06-19T12:10:26.000Z - Updated: 2026-06-19T12:10:26.000Z - Author: Jeff Davies - Tags: #security-feed ## 1\. Executive summary A phishing campaign targeting customers of Belfius, a major Belgian bank, has been observed using an IPv4-mapped IPv6 address notation (`::ffff:`) inside a URL to evade regex-based URL/domain extraction in security tooling. The literal IPv6 host `::ffff:5511:74be` resolves to the IPv4 address `85.17.116.190` and contains no DNS record, defeating simple IOC-matching on domain names. The landing page redirects to `hxxps://3439-aanmelden[.]verificatie[.]qzz[.]io/mon-belfius`, a credential-harvesting kit impersonating Belfius. The risk to EMEA financial services is twofold: (1) end-user credential theft against Belgian retail and SMB banking customers, and (2) defensive-control blind spots where security stacks parse only IPv4 or extract domains via naive regex and therefore miss the malicious URL entirely. No CVE, no malware payload, and no threat-actor attribution are present in the source material; this advisory is treated as unconfirmed-attribution. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 17 | Phishing email targeting bank customers constitutes an ICT-related incident requiring a documented management process. | Financial entities must ensure their ICT-related incident management process covers phishing-driven credential theft and the IPv4-mapped IPv6 URL bypass technique. | | DORA Art. 18 | The campaign is a cyber threat requiring classification against the entity's taxonomy. | Classify this as a phishing/credential-theft threat; tag the IPv4-mapped IPv6 URL pattern as a high-fidelity indicator for triage. | | DORA Art. 19 | A successful compromise of a customer or staff account would constitute a major ICT-related incident and trigger reporting to the competent authority. | Pre-stage reporting templates and ensure the IPv4-mapped IPv6 URL and the qzz.io redirect host are captured as evidence in the report. | | DORA Art. 28 | The phishing kit is hosted on a third-party provider (qzz.io), creating third-party risk exposure. | Assess concentration risk on free/personal hosting providers used for phishing infrastructure and ensure contractual/SLA coverage for takedown and abuse handling. | | DORA Art. 29 | Hosting on qzz.io is a potential concentration-risk vector for phishing infrastructure. | Inventory exposure to qzz.io and similar low-cost hosting providers; ensure exit/containment paths exist. | | DORA Art. 30 | Third-party hosting of phishing kit requires contractual provisions for abuse handling and takedown. | Verify that contracts with hosting/CDN providers include abuse-response SLAs covering credential-phishing infrastructure. | | NIS2 Art. 21(2)(d) | Supply-chain attack vector: phishing infrastructure hosted on third-party platform qzz.io. | Apply supply-chain security measures: monitor and block qzz.io and subdomains where not business-justified; require vendors/hosters to respond to abuse within defined windows. | | NIS2 Art. 23 | A successful credential-theft incident would trigger incident-reporting obligations. | Ensure incident-reporting workflows capture the IPv4-mapped IPv6 URL bypass as a notable technique in the initial notification. | | UK NIS 2018 | OES/RDSP duties apply where the phishing affects essential services (e.g., banking/payments). | UK OES/RDSP entities must include this campaign in threat-intel feeds and ensure detection coverage for the IPv4-mapped IPv6 URL pattern. | ## 3\. Technical analysis & attack chain The campaign uses a single-stage URL that combines an IPv4-mapped IPv6 literal with a redirect to a credential-harvesting kit. The technique is the headline: it weaponises RFC 4291 IPv4-mapped IPv6 address syntax to defeat regex-based URL/domain extraction in security tooling. ### Attack chain (confirmed steps) 1. **Phishing email delivery.** Email contains a malicious link. The phishing lure itself is described as "classic" and not detailed in the source. 2. **Malicious URL uses IPv4-mapped IPv6 literal.** Link is `hxxp://[::ffff:5511:74be]/kWC5PHA1`. The `[...]` notation tells the URL parser the content is a literal IPv6 address (per RFC 3986 / RFC 6874). 3. **IPv4-mapped IPv6 expansion.** The leading `::` expands to `0000:0000:0000:0000:0000:ffff:5511:74be`. The `::ffff:` prefix is the IPv4-mapped IPv6 prefix defined in RFC 4291\. The trailing two 16-bit hex groups `5511` and `74be` are the four IPv4 octets in hex. 4. **Hex-to-decimal conversion.** `0x55`\=85, `0x11`\=17, `0x74`\=116, `0xBE`\=190\. The literal IPv6 host therefore resolves to `85.17.116.190`. 5. **No DNS resolution required.** Because the URL uses a literal IP, no DNS lookup is performed; this also means there is no DNS record to pivot on or block via DNS-layer controls. 6. **Redirect to credential-harvesting kit.** The IPv4 host redirects to `hxxps://3439-aanmelden[.]verificatie[.]qzz[.]io/mon-belfius`, a page impersonating Belfius (Belgian bank) login. 7. **Credential capture.** The phishing kit harvests Belfius banking credentials from victims. ### Technical specifics that matter to a defender - **Initial access vector:** Phishing email with embedded URL. No attachment, no macro, no exploit. - **Exploited component / "vulnerability":** Defensive-control blind spot. The technique bypasses security tooling that extracts domains/IPs from URLs using simple regex. Any control that: - Matches only IPv4 dotted-quad patterns, - Strips or fails to parse `[...]` IPv6 literals, - Only blocks by domain name (FQDN/SLD), will miss this URL. - **Vulnerability mechanism:** RFC 4291 IPv4-mapped IPv6 address format (`::ffff:a.b.c.d`) embedded inside an IPv6 literal URL host. The URL parser correctly resolves to IPv4 `85.17.116.190`, but the textual representation in logs and IOC feeds is the IPv6 literal. - **Payload / malware capabilities:** None observed in source. The "payload" is a credential-harvesting web page impersonating Belfius. - **Persistence:** None observed. Single-session credential theft. - **Privilege escalation:** None observed. - **Command-and-control:** None observed. The phishing kit is hosted on `qzz.io` (a third-party hosting platform). - **Lateral movement:** None observed. - **Data access / exfiltration:** Belfius banking credentials harvested client-side via the phishing kit; exfiltration path not described in source. - **Observed impact:** Targeted credential theft against Belfius customers. ### Caveats - The phishing email body, sender, and lure details are not described in the source ("classic" only). - The redirect chain beyond the second URL is not described. - The hosting provider `qzz.io` is referenced but not characterised; treat as unconfirmed third-party hosting. - No threat-actor attribution is provided in the source material; treat any attribution as unconfirmed. ## 4\. Mitigation & containment ### P1 — within 24 hours - **Block the IPv4-mapped IPv6 URL at the proxy / web gateway.** Add a literal-string block for `hxxp://[::ffff:5511:74be]/kWC5PHA1` and the expanded form `hxxp://[::ffff:85.17.116.190]/kWC5PHA1` in URL filtering policies. - **Block the IPv4 destination at the firewall / NDR.** Deny egress to `85.17.116.190` (port 80/443) at the perimeter. - **Block the redirect destination.** Add `3439-aanmelden.verificatie.qzz.io` and the parent `qzz.io` (where not business-justified) to the DNS sinkhole and web-proxy block list. - **Search email gateway logs** for the literal IPv6 URL pattern (`hxxp://[::ffff:`) and the redirect URL across the last 30 days; quarantine any matching messages and notify recipients. - **Hunt proxy / DNS logs** for any successful connections to `85.17.116.190` or `*.qzz.io` paths matching `mon-belfius` or `verificatie`. ### P2 — within 72 hours - **Takedown request.** Submit abuse notifications to the `qzz.io` provider and the IP owner of `85.17.116.190` requesting removal of the phishing kit and URL. - **Force credential resets** for any user observed connecting to either URL. - **Update SIEM correlation rules** to flag any URL containing the IPv4-mapped IPv6 prefix `::ffff:` followed by hex characters, regardless of destination. - **Review and harden URL-parsing logic** in any in-house security tooling (regex-based IOC extractors, SOAR enrichment, email parsing) to correctly handle IPv6 literals and IPv4-mapped IPv6 addresses per RFC 4291. ### P3 — within 7 days - **User awareness push.** Targeted warning to staff and (where applicable) customers about the Belfius-themed lure and the IPv4-mapped IPv6 URL technique. - **Detection engineering.** Roll out the Sigma rule in Section 6 across all log sources. - **Third-party risk review.** Confirm contractual abuse-response SLAs with hosting/CDN providers cover credential-phishing infrastructure takedown. ## 5\. Indicators of compromise | Type | Value | Confidence | Source | | ------ | ----------------------------------------------------- | -------------------------------- | ---------------------------------------------------- | | url | hxxp://\[::ffff:5511:74be\]/kWC5PHA1 | High | SANS ISC diary 33090 | | ipv4 | 85.17.116.190 | High | SANS ISC diary 33090 (derived from ::ffff:5511:74be) | | url | hxxps://3439-aanmelden.verificatie.qzz.io/mon-belfius | High | SANS ISC diary 33090 | | domain | 3439-aanmelden.verificatie.qzz.io | High | SANS ISC diary 33090 | | domain | qzz.io | Medium (parent hosting platform) | SANS ISC diary 33090 | ```iocs url hxxp://[::ffff:5511:74be]/kWC5PHA1 ipv4 85.17.116.190 url hxxps://3439-aanmelden.verificatie.qzz.io/mon-belfius domain 3439-aanmelden.verificatie.qzz.io domain qzz.io ``` ## 6\. Detection ### Sigma rule — IPv4-mapped IPv6 URL in proxy / web logs ```yaml title: Web Request to IPv4-Mapped IPv6 Literal URL (Belfius Phishing) id: 9c1f3b2a-7e4d-4a1b-8f3a-1b2c3d4e5f60 status: experimental description: | Detects HTTP(S) requests where the URL host is an IPv4-mapped IPv6 address literal (RFC 4291 ::ffff: prefix) or contains the known Belfius phishing redirect path on qzz.io. Used by AT-2026-06-19-125. author: Adverse Trace date: 2026-06-19 reference: https://isc.sans.edu/diary/rss/33090 logsource: category: proxy detection: selection_ipv4_mapped_literal: cs-uri-host|startswith: '[' cs-uri-host|contains: '::ffff:' selection_known_ioc: cs-uri-host: - '3439-aanmelden.verificatie.qzz.io' - 'qzz.io' cs-uri-stem|contains: 'mon-belfius' condition: selection_ipv4_mapped_literal or selection_known_ioc fields: - cs-uri-host - cs-uri-stem - c-ip - c-user falsepositives: - Legitimate IPv4-mapped IPv6 URLs from internal services (rare; review) level: high ``` ### Sigma rule — DNS query to phishing redirect domain ```yaml title: DNS Query to qzz.io Belfius Phishing Redirect Domain id: 4d2e8a91-1c5b-4f6e-9a2d-3e4f5a6b7c80 status: experimental description: | Detects DNS queries resolving to the qzz.io subdomain used to host the Belfius credential-phishing kit described in AT-2026-06-19-125. author: Adverse Trace date: 2026-06-19 reference: https://isc.sans.edu/diary/rss/33090 logsource: category: dns detection: selection_query: query|contains: - '3439-aanmelden.verificatie.qzz.io' - 'verificatie.qzz.io' condition: selection_query fields: - query - answer - src_ip falsepositives: - None expected level: high ``` ## 7\. Sources - SANS Internet Storm Center, "eBanking Phishing Delivered Through IPv4-Mapped IPv6 Address" by Xavier Mertens (@xme), 2026-06-19\. https://isc.sans.edu/diary/rss/33090 - RFC 4291, "IP Version 6 Addressing Architecture" (referenced for IPv4-mapped IPv6 prefix definition). https://www.rfc-editor.org/info/rfc4291/ ## 8\. Adverse Trace position This is a phishing campaign, not a vulnerability — there is no CVE, no CVSS score, and no CISA KEV state to report. Severity is driven by the credential-theft impact against Belfius customers and the defensive-control bypass technique, which is the campaign's primary innovation. The IPv4-mapped IPv6 URL pattern is the high-fidelity detection signal: any URL whose host begins with `[` and contains `::ffff:` should be treated as suspect until reviewed, regardless of the destination IP. EMEA financial services clients should (1) confirm proxy / email-gateway coverage for the IOCs in Section 5, (2) audit in-house URL-parsing logic for IPv6-literal handling, and (3) push the Sigma rules in Section 6 to detection engineering for rollout. Adverse Trace will continue to monitor for reuse of the `::ffff:` URL pattern against other EU banking brands and will update this advisory if additional infrastructure or attribution emerges. --- [Read the original source →](https://isc.sans.edu/diary/rss/33090?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*