One URL, Three Different Tricks, (Thu, Sep 24th)
Yesterday, we received a phishing email with an interesting link. At first sight, it looks like garbage, but every piece of it has been carefully crafted to confuse basic security controls. Here is the defanged link: hxxps://YKZjqa7A@gynd--[.]koncar-hr[.]com/handlers@isc.sans.edu Let's break it down... The first trick is the old "userinfo" field. According to RFC 3986[1], everything between the scheme and an "@" inside the authority is treated as credentials ("user:password@host"). Browsers…
US