Phishing URLs using IPv4-mapped IPv6 literal notation to evade filters

Ankit Mehta@Secvyn

•updated Sep 15, 2026•2•0•3

Detects phishing emails containing URLs with IPv6-mapped IPv4 addresses (e.g., [::ffff:192.168.0.1]). Adversaries use this obfuscation technique to bypass security filters that may not correctly parse or normalize IPv6-mapped addresses within URLs.