eBanking Phishing Delivered Through IPv4-Mapped IPv6 Address, (Fri, Jun 19th)

1. Executive summary

A phishing campaign targeting customers of Belfius, a major Belgian bank, has been observed using an IPv4-mapped IPv6 address notation (::ffff:) inside a URL to evade regex-based URL/domain extraction in security tooling. The literal IPv6 host ::ffff:5511:74be resolves to the IPv4 address 85.17.116.190 and contains no DNS record, defeating simple IOC-matching on domain names. The landing page redirects to hxxps://3439-aanmelden[.]verificatie[.]qzz[.]io/mon-belfius, a credential-harvesting kit impersonating Belfius. The risk to EMEA financial services is twofold: (1) end-user credential theft against Belgian retail and SMB banking customers, and (2) defensive-control blind spots where security stacks parse only IPv4 or extract domains via naive regex and therefore miss the malicious URL entirely. No CVE, no malware payload, and no threat-actor attribution are present in the source material; this advisory is treated as unconfirmed-attribution.

2. Regulatory framing

Article	Trigger (the fact in this item)	Practical impact
DORA Art. 17	Phishing email targeting bank customers constitutes an ICT-related incident requiring a documented management process.	Financial entities must ensure their ICT-related incident management process covers phishing-driven credential theft and the IPv4-mapped IPv6 URL bypass technique.
DORA Art. 18	The campaign is a cyber threat requiring classification against the entity's taxonomy.	Classify this as a phishing/credential-theft threat; tag the IPv4-mapped IPv6 URL pattern as a high-fidelity indicator for triage.
DORA Art. 19	A successful compromise of a customer or staff account would constitute a major ICT-related incident and trigger reporting to the competent authority.	Pre-stage reporting templates and ensure the IPv4-mapped IPv6 URL and the `qzz.io` redirect host are captured as evidence in the report.
DORA Art. 28	The phishing kit is hosted on a third-party provider (`qzz.io`), creating third-party risk exposure.	Assess concentration risk on free/personal hosting providers used for phishing infrastructure and ensure contractual/SLA coverage for takedown and abuse handling.
DORA Art. 29	Hosting on `qzz.io` is a potential concentration-risk vector for phishing infrastructure.	Inventory exposure to `qzz.io` and similar low-cost hosting providers; ensure exit/containment paths exist.
DORA Art. 30	Third-party hosting of phishing kit requires contractual provisions for abuse handling and takedown.	Verify that contracts with hosting/CDN providers include abuse-response SLAs covering credential-phishing infrastructure.
NIS2 Art. 21(2)(d)	Supply-chain attack vector: phishing infrastructure hosted on third-party platform `qzz.io`.	Apply supply-chain security measures: monitor and block `qzz.io` and subdomains where not business-justified; require vendors/hosters to respond to abuse within defined windows.
NIS2 Art. 23	A successful credential-theft incident would trigger incident-reporting obligations.	Ensure incident-reporting workflows capture the IPv4-mapped IPv6 URL bypass as a notable technique in the initial notification.
UK NIS 2018	OES/RDSP duties apply where the phishing affects essential services (e.g., banking/payments).	UK OES/RDSP entities must include this campaign in threat-intel feeds and ensure detection coverage for the IPv4-mapped IPv6 URL pattern.

3. Technical analysis & attack chain

The campaign uses a single-stage URL that combines an IPv4-mapped IPv6 literal with a redirect to a credential-harvesting kit. The technique is the headline: it weaponises RFC 4291 IPv4-mapped IPv6 address syntax to defeat regex-based URL/domain extraction in security tooling.

Attack chain (confirmed steps)

Phishing email delivery. Email contains a malicious link. The phishing lure itself is described as "classic" and not detailed in the source.
Malicious URL uses IPv4-mapped IPv6 literal. Link is hxxp://[::ffff:5511:74be]/kWC5PHA1. The [...] notation tells the URL parser the content is a literal IPv6 address (per RFC 3986 / RFC 6874).
IPv4-mapped IPv6 expansion. The leading :: expands to 0000:0000:0000:0000:0000:ffff:5511:74be. The ::ffff: prefix is the IPv4-mapped IPv6 prefix defined in RFC 4291. The trailing two 16-bit hex groups 5511 and 74be are the four IPv4 octets in hex.
Hex-to-decimal conversion. 0x55=85, 0x11=17, 0x74=116, 0xBE=190. The literal IPv6 host therefore resolves to 85.17.116.190.
No DNS resolution required. Because the URL uses a literal IP, no DNS lookup is performed; this also means there is no DNS record to pivot on or block via DNS-layer controls.
Redirect to credential-harvesting kit. The IPv4 host redirects to hxxps://3439-aanmelden[.]verificatie[.]qzz[.]io/mon-belfius, a page impersonating Belfius (Belgian bank) login.
Credential capture. The phishing kit harvests Belfius banking credentials from victims.

Technical specifics that matter to a defender

Initial access vector: Phishing email with embedded URL. No attachment, no macro, no exploit.
Exploited component / "vulnerability": Defensive-control blind spot. The technique bypasses security tooling that extracts domains/IPs from URLs using simple regex. Any control that:
Matches only IPv4 dotted-quad patterns,
Strips or fails to parse [...] IPv6 literals,
Only blocks by domain name (FQDN/SLD), will miss this URL.
Vulnerability mechanism: RFC 4291 IPv4-mapped IPv6 address format (::ffff:a.b.c.d) embedded inside an IPv6 literal URL host. The URL parser correctly resolves to IPv4 85.17.116.190, but the textual representation in logs and IOC feeds is the IPv6 literal.
Payload / malware capabilities: None observed in source. The "payload" is a credential-harvesting web page impersonating Belfius.
Persistence: None observed. Single-session credential theft.
Privilege escalation: None observed.
Command-and-control: None observed. The phishing kit is hosted on qzz.io (a third-party hosting platform).
Lateral movement: None observed.
Data access / exfiltration: Belfius banking credentials harvested client-side via the phishing kit; exfiltration path not described in source.
Observed impact: Targeted credential theft against Belfius customers.

Caveats

The phishing email body, sender, and lure details are not described in the source ("classic" only).
The redirect chain beyond the second URL is not described.
The hosting provider qzz.io is referenced but not characterised; treat as unconfirmed third-party hosting.
No threat-actor attribution is provided in the source material; treat any attribution as unconfirmed.

4. Mitigation & containment

P1 — within 24 hours

Block the IPv4-mapped IPv6 URL at the proxy / web gateway. Add a literal-string block for hxxp://[::ffff:5511:74be]/kWC5PHA1 and the expanded form hxxp://[::ffff:85.17.116.190]/kWC5PHA1 in URL filtering policies.
Block the IPv4 destination at the firewall / NDR. Deny egress to 85.17.116.190 (port 80/443) at the perimeter.
Block the redirect destination. Add 3439-aanmelden.verificatie.qzz.io and the parent qzz.io (where not business-justified) to the DNS sinkhole and web-proxy block list.
Search email gateway logs for the literal IPv6 URL pattern (hxxp://[::ffff:) and the redirect URL across the last 30 days; quarantine any matching messages and notify recipients.
Hunt proxy / DNS logs for any successful connections to 85.17.116.190 or *.qzz.io paths matching mon-belfius or verificatie.

P2 — within 72 hours

Takedown request. Submit abuse notifications to the qzz.io provider and the IP owner of 85.17.116.190 requesting removal of the phishing kit and URL.
Force credential resets for any user observed connecting to either URL.
Update SIEM correlation rules to flag any URL containing the IPv4-mapped IPv6 prefix ::ffff: followed by hex characters, regardless of destination.
Review and harden URL-parsing logic in any in-house security tooling (regex-based IOC extractors, SOAR enrichment, email parsing) to correctly handle IPv6 literals and IPv4-mapped IPv6 addresses per RFC 4291.

P3 — within 7 days

User awareness push. Targeted warning to staff and (where applicable) customers about the Belfius-themed lure and the IPv4-mapped IPv6 URL technique.
Detection engineering. Roll out the Sigma rule in Section 6 across all log sources.
Third-party risk review. Confirm contractual abuse-response SLAs with hosting/CDN providers cover credential-phishing infrastructure takedown.

5. Indicators of compromise

Type	Value	Confidence	Source
url	`hxxp://[::ffff:5511:74be]/kWC5PHA1`	High	SANS ISC diary 33090
ipv4	`85.17.116.190`	High	SANS ISC diary 33090 (derived from `::ffff:5511:74be`)
url	`hxxps://3439-aanmelden.verificatie.qzz.io/mon-belfius`	High	SANS ISC diary 33090
domain	`3439-aanmelden.verificatie.qzz.io`	High	SANS ISC diary 33090
domain	`qzz.io`	Medium (parent hosting platform)	SANS ISC diary 33090

url       hxxp://[::ffff:5511:74be]/kWC5PHA1
ipv4      85.17.116.190
url       hxxps://3439-aanmelden.verificatie.qzz.io/mon-belfius
domain    3439-aanmelden.verificatie.qzz.io
domain    qzz.io

6. Detection

Sigma rule — IPv4-mapped IPv6 URL in proxy / web logs

title: Web Request to IPv4-Mapped IPv6 Literal URL (Belfius Phishing)
id: 9c1f3b2a-7e4d-4a1b-8f3a-1b2c3d4e5f60
status: experimental
description: |
  Detects HTTP(S) requests where the URL host is an IPv4-mapped IPv6 address
  literal (RFC 4291 ::ffff: prefix) or contains the known Belfius phishing
  redirect path on qzz.io. Used by AT-2026-06-19-125.
author: Adverse Trace
date: 2026-06-19
reference: https://isc.sans.edu/diary/rss/33090
logsource:
  category: proxy
detection:
  selection_ipv4_mapped_literal:
    cs-uri-host|startswith: '['
    cs-uri-host|contains: '::ffff:'
  selection_known_ioc:
    cs-uri-host:

      - '3439-aanmelden.verificatie.qzz.io'
      - 'qzz.io'
    cs-uri-stem|contains: 'mon-belfius'
  condition: selection_ipv4_mapped_literal or selection_known_ioc
fields:

  - cs-uri-host
  - cs-uri-stem
  - c-ip
  - c-user
falsepositives:

  - Legitimate IPv4-mapped IPv6 URLs from internal services (rare; review)
level: high

Sigma rule — DNS query to phishing redirect domain

title: DNS Query to qzz.io Belfius Phishing Redirect Domain
id: 4d2e8a91-1c5b-4f6e-9a2d-3e4f5a6b7c80
status: experimental
description: |
  Detects DNS queries resolving to the qzz.io subdomain used to host the
  Belfius credential-phishing kit described in AT-2026-06-19-125.
author: Adverse Trace
date: 2026-06-19
reference: https://isc.sans.edu/diary/rss/33090
logsource:
  category: dns
detection:
  selection_query:
    query|contains:

      - '3439-aanmelden.verificatie.qzz.io'
      - 'verificatie.qzz.io'
  condition: selection_query
fields:

  - query
  - answer
  - src_ip
falsepositives:

  - None expected
level: high

7. Sources

SANS Internet Storm Center, "eBanking Phishing Delivered Through IPv4-Mapped IPv6 Address" by Xavier Mertens (@xme), 2026-06-19. https://isc.sans.edu/diary/rss/33090
RFC 4291, "IP Version 6 Addressing Architecture" (referenced for IPv4-mapped IPv6 prefix definition). https://www.rfc-editor.org/info/rfc4291/

8. Adverse Trace position

This is a phishing campaign, not a vulnerability — there is no CVE, no CVSS score, and no CISA KEV state to report. Severity is driven by the credential-theft impact against Belfius customers and the defensive-control bypass technique, which is the campaign's primary innovation. The IPv4-mapped IPv6 URL pattern is the high-fidelity detection signal: any URL whose host begins with [ and contains ::ffff: should be treated as suspect until reviewed, regardless of the destination IP. EMEA financial services clients should (1) confirm proxy / email-gateway coverage for the IOCs in Section 5, (2) audit in-house URL-parsing logic for IPv6-literal handling, and (3) push the Sigma rules in Section 6 to detection engineering for rollout. Adverse Trace will continue to monitor for reuse of the ::ffff: URL pattern against other EU banking brands and will update this advisory if additional infrastructure or attribution emerges.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.