Link: IPv4-mapped IPv6 address obfuscation | Sublime Security

Sublime Core Feed
Link: IPv4-mapped IPv6 address obfuscation
Sublime Core Feed
Login to Sublime
Medium Severity
Link: IPv4-mapped IPv6 address obfuscationLabelsCredential Phishing
Malware/Ransomware
Evasion
Content analysis
URL analysis
DescriptionDetects links containing IPv4-mapped IPv6 addresses in the format [::ffff:xxxx:xxxx], commonly used to obfuscate malicious URLs and evade detection systems.
ReferencesNo references.
Sublime Security
Created Dec 6th, 2025 • Last updated Jan 12th, 2026
Feed Source
Sublime Core Feed
Source
GitHub
type.inbound
and any(body.links,
        regex.icontains(.href_url.url, '\[::ffff:[0-9a-f]{4}:[0-9a-f]{4}\]')
)
MQL Rule Console
•Docs•Learning Labs
PlaygroundTest against your own EMLs or sample data.
SharePost about this on your socials.
Get Started. Today.Managed or self-managed. No MX changes.
Get Started
Deploy and integrate a free Sublime instance in minutes.
Get Started