> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # One URL, Three Different Tricks - URL: https://f4n6.co.uk/security-feed/one-url-three-different-tricks/ - Published: 2026-09-24T08:37:22.000Z - Updated: 2026-09-24T08:37:22.000Z - Author: Jeff Davies - Tags: #security-feed ## 1\. Executive summary A SANS Internet Storm Center handler received a phishing email on 2026-09-23 whose link is built so that different URL parsers disagree about where it points. The URL carries a userinfo token, a hostname label that ends in a hyphen, and the recipient's own email address in the path, so a naive filter sees a trusted domain, a strict validator sees an invalid hostname and drops it, and the browser resolves and visits the attacker's server. No software vulnerability is exploited and no CVE applies; the technique abuses parser differences in email gateways, link rewriters, sandboxes and URL reputation services. For EMEA financial services the exposure is a control gap rather than a patchable flaw: any mail security stack that fails open on an unparseable URL, or that splits the string on the last "@", will deliver an unscanned link to the user. The item is single-sourced from one handler's observation of one email, and no landing-page content, payload or actor attribution is available. ## 2\. Regulatory framing No specific DORA/NIS2 article is directly engaged by this item. The obvious candidates do not pass the trigger test. DORA Art. 17 (ICT-related incident management process) requires an incident at the client; this is a technique note describing one email received by a third-party handler, not an incident at any client. NIS2 Art. 23 (incident reporting obligations) is likewise not triggered. NIS2 Art. 21(2)(d) (supply chain security measures) would only apply if a client's mail security or link-rewriting provider were shown to be the failing component, and the source does not identify any provider. If a client's own gateway is later found to have passed this URL through unscanned, that becomes a control failure to assess under the client's existing incident and testing processes, not a new obligation created by this advisory. ## 3\. Technical analysis & attack chain Confirmed steps, as described by the source: 1. A phishing email is delivered to the recipient. The message body carries a single link. 2. The link is constructed so that three separate parsing conventions produce three different answers about the destination. 3. The recipient's browser parses the URL per the WHATWG URL standard. The authority ends at the first "/", so the userinfo token is discarded and the browser connects to `gynd--.koncar-hr.com`. 4. The landing page reads the path, which contains the recipient's own email address, and uses it to pre-fill the login form and, in the source's description of phishing-kit behaviour generally, sometimes adapt the branding to the email domain. 5. Credential submission to the attacker-controlled host is implied by the pre-filled login form. The source does not state that credentials were captured in this case. The three constructs, in the order the source presents them. **Userinfo field.** Per RFC 3986, everything between the scheme and an "@" inside the authority is treated as credentials in the form `user:password@host`. Browsers ignore it. The random string `YKZjqa7A` makes every URL unique, which defeats exact-match blocklists and URL reputation lookups, and the source assesses it probably also acts as a per-victim or per-campaign tracking token. A side effect is that the whole string resembles an email address to any tool that does not parse URLs strictly. **Hostname.** The host is `gynd--.koncar-hr.com`. Under the classic hostname rules in RFC 952 and RFC 1123, a label cannot start or end with a hyphen. DNS does not enforce this and browsers resolve and visit the name anyway, but strict validators, regex-based URL extractors, and some link-rewriting or sandboxing products may treat it as invalid and skip it. A URL that is never extracted is never scanned. The random subdomain suggests wildcard DNS, so each victim receives a fresh hostname that no blocklist knows. The parent domain is a lookalike of the legitimate `koncar.hr`, a Croatian industrial group, with the ccTLD turned into a hyphenated `.com`. Note that the double hyphen in `gynd--` is part of the actual hostname, not a defanging artefact. **Recipient address in the path.** The victim's email address is appended in the path. A parser that splits the string on the last "@" concludes the host is the recipient's own trusted domain. Per the WHATWG URL standard the authority ends at the first "/", so the browser correctly connects to the attacker's server. The source's hunting tip is to look for URLs with more than one "@", hostname labels starting or ending with a hyphen, and paths containing the recipient's own email address. The source renders the URL as `hxxps://YKZjqa7A@gynd--[.]koncar-hr[.]com/handlers@isc.sans.edu`; the related feed copy of the same diary renders the path as an obfuscated mailto form. This is a rendering difference in the feed, not a second URL, and the path element is the recipient address either way. Confidence caveats. This is a single-sourced observation from one SANS ISC handler, based on one email received. The source does not confirm what the landing page actually served, whether credentials were submitted, whether any payload was delivered, or who operated the campaign. No CVE is involved and no software vulnerability is exploited; the technique works because parsers disagree. No actor attribution is offered by the source and none is made here. ## 4\. Mitigation & containment P1, within 24 hours: - Block the parent domain `koncar-hr[.]com` at the DNS resolver, secure web gateway and email gateway. Because the source assesses wildcard DNS, blocking the observed subdomain alone is insufficient; block the parent and any subdomain of it. - Hunt email gateway, proxy and DNS logs for URLs matching the three constructs: more than one "@" in the authority, a hostname label starting or ending with a hyphen, and a path containing the recipient's own email address. The Sigma rule in §6 is a starting point. - Establish whether your link-rewriting or sandboxing layer failed open on this URL. If the extractor dropped the link as invalid, the user received an unscanned URL. That is the finding to escalate, not the email itself. P2, within 72 hours: - Review URL extraction and rewriting logic against the WHATWG URL standard. Where a URL cannot be parsed, the correct behaviour is to block or quarantine it, not to pass it through. Fail-closed is the control change this technique demands. - Confirm the email gateway does not treat the userinfo field as an email address, and that it does not split the URL on the last "@" when determining the destination host. - Add the parser-confusion pattern to detonation queues so that future variants are detonated rather than skipped. P3, within 7 days: - Review whether typosquat monitoring would catch the `koncar.hr` to `koncar-hr.com` substitution pattern, which converts a ccTLD into a hyphenated gTLD. - Reinforce user reporting for pre-filled login forms, since a form that already contains the recipient's address is a signal the link was personalised. ## 5\. Indicators of compromise Single-sourced from the SANS ISC diary; verify before enforcement. | type | value | confidence | source | | ------ | --------------------------------------------------------------------------- | ---------- | -------- | | domain | gynd--\[.\]koncar-hr\[.\]com | high | SANS ISC | | domain | koncar-hr\[.\]com | high | SANS ISC | | url | hxxps://YKZjqa7A@gynd--\[.\]koncar-hr\[.\]com/handlers@isc\[.\]sans\[.\]edu | high | SANS ISC | ```iocs domain gynd--[.]koncar-hr[.]com domain koncar-hr[.]com url hxxps://YKZjqa7A@gynd--[.]koncar-hr[.]com/handlers@isc[.]sans[.]edu ``` Behavioural indicators, since the source gives no file hashes, IP addresses or payload artefacts: | behaviour | where to observe | confidence | | ------------------------------------------------------------ | ---------------------------------- | ---------- | | URL authority containing more than one "@" | email gateway, web proxy, DNS logs | high | | Hostname label starting or ending with a hyphen | web proxy, DNS logs | high | | Path containing the recipient's own email address | email gateway, web proxy | high | | Random-looking userinfo token unique per message | email gateway | medium | | Wildcard DNS resolving arbitrary subdomains under the parent | DNS logs, passive DNS | medium | ## 6\. Detection No file-level artefacts are present in the source, so no YARA rule is emitted. The behavioural pattern is detectable in proxy and email logs. ```yaml title: URL With Parser-Confusion Constructs In Phishing Link id: 8f2c1a44-7b3e-4d51-9a6f-0c5e2d9b7a10 status: experimental description: Detects URLs carrying more than one at-sign, a hostname label beginning or ending with a hyphen, or a path embedding an email address. These constructs make URL parsers disagree about the true destination host. author: Adverse Trace date: 2026/09/24 references: - https://isc.sans.edu/diary/rss/33366 logsource: category: proxy detection: selection_multiple_at: cs-uri|re: '://[^/]*@[^/]*@' selection_hyphen_end_label: cs-uri|re: '://[^/]*[a-z0-9]-[.-]' selection_hyphen_start_label: cs-uri|re: '://[^/]*[.-]-[a-z0-9]' selection_email_in_path: cs-uri|re: '://[^/]*/[^?]*@[^?]*\.[a-z]{2,}' condition: 1 of selection_* falsepositives: - Legitimate URLs with a hyphen at a label edge are uncommon but exist; tune against your own traffic before alerting. level: medium ``` Field names must be mapped to the local schema. Many proxies log the host in `cs-host` and the path in `cs-uri` without the scheme, in which case the regexes above need to be rewritten against the concatenated field or against `cs-host` alone for the hyphen-label selections. ## 7\. Sources - Xavier Mertens, SANS Internet Storm Center, "One URL, Three Different Tricks", https://isc.sans.edu/diary/rss/33366, 2026-09-24 - RFC 3986, Uniform Resource Identifier (URI): Generic Syntax, https://www.rfc-editor.org/info/rfc3986/ - RFC 952, DoD Internet Host Table Specification, https://www.rfc-editor.org/info/rfc952/ - WHATWG URL Standard, https://url.spec.whatwg.org ## 8\. Adverse Trace position There is no CVSS score and no CISA KEV entry for this item because no vulnerability is involved; the technique abuses differences between URL parsers, and we will not assign it a severity that implies a patchable flaw. The client impact is a mail-security control gap: any gateway, link rewriter or sandbox that fails open on an unparseable URL, or that resolves the destination by splitting on the last "@", will hand the user an unscanned link to an attacker-controlled host. This assessment rests on a single source, one handler's observation of one email, and we have not confirmed the landing-page content, any credential capture, or any actor; clients should treat the indicators in §5 as single-sourced and verify before enforcement. We will monitor for further reporting on the `koncar-hr[.]com` lookalike and on the parser-confusion pattern, and we will add the URL-construct hunt to client detection content where the local proxy schema supports it. --- [Read the original source →](https://isc.sans.edu/diary/rss/33366?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*