One URL, Three Different Tricks
10 hours ago
- The URL uses the userinfo field (e.g., 'YKZjqa7A@') to create unique links that bypass exact-match blocklists and serve as per-victim tracking tokens.
- The hostname starts with a hyphen (e.g., 'gynd--.koncar-hr.com'), which is invalid per RFC rules but accepted by browsers, causing strict validators to skip it.
- The victim's email is appended in the path, allowing phishing pages to pre-fill forms and confusing parsers that split on the last '@' as a host.
- Attackers exploit differences between parser implementations rather than a software vulnerability.