Dissect suspicious phishing URLs and decode QR codes safely in your browser. Detect IDN homograph punycode attacks, unmask hex/octal/dword IP bypasses, decode nested redirection parameters, and defang indicators with zero network requests.
Uniform Resource Locators (URLs) are the primary delivery vector for modern credential harvesting portals, malware download stagers, and command-and-control (C2) beaconing. Because automated threat detection systems rely heavily on static regular expressions and reputation blocklists, threat actors employ sophisticated syntactic evasion techniques to disguise malicious destinations.
The Internationalized Domain Name (IDN) standard enables internet users worldwide to register domains in non-Latin scripts (such as Cyrillic, Greek, Hebrew, and Chinese). However, this creates a critical security vulnerability known as an IDN Homograph Attack:
Example Spoof: Visual domain: apple.com vs. Malicious spoof: аpple.com (where the first letter 'а' is Cyrillic Small Letter A, Unicode U+0430).
To human eyes and standard web renderers, both look identical. However, DNS resolvers cannot route Unicode characters directly. DNS translates international domains into Punycode using the xn-- prefix. The Cyrillic domain resolves to xn--pple-43d.com, immediately breaking the illusion and exposing the fraud.
Security filters often look for standard dotted-decimal IPv4 regexes like ^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$. However, operating system network stacks support multiple numeric representations:
| Notation Format | Example URL Pattern | Standard IPv4 Equivalent | How It Works |
|---|---|---|---|
| Dword (32-Bit Decimal) | http://2130706433/ |
127.0.0.1 |
Converts all 4 octets into a single 32-bit unsigned integer: (A × 256³) + (B × 256²) + (C × 256) + D. |
| Hexadecimal (Dotted) | http://0x7F.0x00.0x00.0x01/ |
127.0.0.1 |
Each individual octet is written with a 0x hex prefix. |
| Hexadecimal (Single Integer) | http://0x7F000001/ |
127.0.0.1 |
The entire 32-bit dword address is represented as an 8-character hex value. |
| Octal (Base-8) | http://0177.0000.0000.0001/ |
127.0.0.1 |
Leading zeroes cause network sockets to parse numbers in octal base. |
Quishing (QR Phishing) bypasses traditional perimeter defenses because email security gateways cannot easily parse images or render nested redirect targets. Attackers send PDF notices prompting users to "Scan to verify MFA credentials." When scanned with an unmanaged personal smartphone, corporate conditional access controls and DNS firewalls are completely bypassed.
http with hxxp and . with [.]) so that chat programs, ticketing systems (Jira, ServiceNow), and email clients do not automatically convert the text into clickable hyperlinks. This prevents accidental execution by analysts and avoids triggering spam filters.