A phishing email analysed by SANS Internet Storm Centre on 24 September 2026 used a single URL designed to confuse automated security controls. The defanged address was `hxxps://YKZjqa7A@gynd--[.]koncar-hr[.]com/handlers@isc.sans.edu`. Its first feature is a random string in the URL’s user-information field, before the `@`. According to the analysis, this can make each link unique, weakening exact-match blocklists and reputation checks, and may also serve as a tracking token. Tools that do not parse URLs correctly could mistake the string for part of an email address.
The hostname, `gynd--.koncar-hr.com`, adds another evasion technique. Although labels beginning or ending with a hyphen are barred by classic hostname rules, DNS and browsers can still handle this address. The author says strict validators, URL extractors and some link-rewriting or sandboxing systems may instead reject or overlook it. The parent domain resembles the legitimate Croatian industrial group Končar’s `koncar.hr`, while the path contains the recipient’s email address.
Phishing kits can use such paths to pre-fill login forms or customise branding; poorly written parsers may also treat the final `@isc.sans.edu` as identifying the host, even though browsers correctly use `gynd--.koncar-hr.com`.
The technique exploits differences between parsers rather than a software vulnerability. SANS recommends hunting for URLs containing multiple `@` symbols, hostname labels that start or end with hyphens, and paths containing the recipient’s own email address.