One phishing URL carries three separate evasions
Serguey Asael Shinder1 min readThe SANS Internet Storm Center has taken apart a single phishing URL that carries three separate evasions, none of which is about the payload: https://isc.sans.edu/diary/rss/33366.
The hostname begins with a hyphen - a form such as gynd--.koncar-hr.com. Under the classic rules in RFC 952 and RFC 1123 a label may not start or end with a hyphen. DNS resolves it anyway and browsers visit it happily. Strict validators, regex-based URL extractors and some link-rewriting or sandboxing products treat it as malformed and skip it - and a URL that is never extracted is never scanned.
The random subdomain points at wildcard DNS, so each victim receives a hostname no blocklist has ever seen.
And the parent domain is a lookalike: the legitimate Croatian industrial group at koncar.hr becomes a hyphenated .com that reads the same at a glance.
What it means
The interesting attack surface here is the URL parser, not the browser. Security tooling and browsers disagree about what a valid hostname is, and the attacker is standing precisely in that gap: strict enough to be rejected by the scanner, lenient enough to be resolved by the victim. Any control that operates by extracting URLs from a message inherits the strictness of its regex as a security property, which is not how anyone designs it deliberately.
Wildcard DNS finishes the job that leniency starts. Reputation systems need a repeated identifier to accumulate evidence against; a hostname minted per victim never repeats. Combining an unparseable host with a unique one means the first defence never sees the URL and the second has nothing to remember.
⚠️ Reported from the diary entry. We have not examined the campaign ourselves, and the RFC behaviour described is the long-standing hostname rule rather than a new finding.