IP Obfuscator — URL & IP Obfuscation Detection
Obfuscation is an anti-human-inspection tactic, not a network-evasion one. The flow log records the same resolved destination no matter how the URL was written, which is exactly why flow data is worth retaining far longer than packet capture.
Open in Red Team Toolkit — ipobfIP Obfuscator — URL & IP Obfuscation Detection
Obfuscation is an anti-human-inspection tactic, not a network-evasion one. The flow log records the same resolved destination no matter how the URL was written, which is exactly why flow data is worth retaining far longer than packet capture.
Telemetry generated
| Log source | Field / identifier | What it shows |
|---|---|---|
| Proxy Full-URL Logs | cs-uri-stem / cs-host | Full URL including scheme, host, and path. Numeric-literal hosts (decimal, hex, octal), userinfo abuse (credentials before @), and punycode xn-- prefixes are all detectable in this field. |
| DNS Query Logs | query name | Numeric-literal URLs (IP addresses in any encoding) generate NO DNS query at all. A connection to an external IP with no preceding DNS resolution in the same session is itself an anomaly worth alerting on. |
| NetFlow / IPFIX | dst_ip | Records the RESOLVED destination IP, which is unaffected by every obfuscation technique this tool produces. Flow data is the ground truth for destination regardless of how the URL was written. |
| Email Gateway | url_rewrite / time-of-click | URL rewriting with time-of-click resolution catches obfuscated links in phishing emails. The gateway resolves the final destination at click time, bypassing redirect chains and encoding tricks. |
Detection rules
# Rule 1: Userinfo abuse — credentials before @ in HTTP Host
alert http any any -> any any (
msg:"URL Obfuscation — Userinfo in HTTP Host (credential prefix)";
flow:established,to_server;
pcre:"/^[^@\r\n]+@/Hi";
classtype:policy-violation;
sid:9100001; rev:1;
)
# Rule 2: Bare IPv4 literal as HTTP Host (threshold: 5 per 300s per src)
alert http any any -> any any (
msg:"URL Obfuscation — Bare IPv4 Literal in HTTP Host";
flow:established,to_server;
pcre:"/^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(:\d+)?$/Hi";
threshold:type threshold, track by_src, count 5, seconds 300;
classtype:policy-violation;
sid:9100002; rev:1;
)
# Rule 3: Punycode xn-- host — possible homograph attack
alert http any any -> any any (
msg:"URL Obfuscation — Punycode xn-- Host (possible homograph)";
flow:established,to_server;
content:"xn--"; http_host; nocase;
classtype:policy-violation;
sid:9100003; rev:1;
)Evasion & counters
Domain fronting — benign SNI in the TLS ClientHello with the attacker's domain in the inner HTTP Host header, routing through a trusted CDN.
Compare SNI against the inner HTTP Host header where TLS inspection exists. Where it does not, treat unjustified CDN destinations (CDN edge IPs with no business relationship) as anomalous by policy and require explicit allowlisting.
Unicode homograph domains that are visually identical to legitimate domains but resolve to attacker infrastructure.
Alert on punycode xn-- hosts in proxy and email gateway logs. Compare registered domains against your brand domain set using edit-distance or confusable-character matching.
Open redirects on legitimate domains — the initial URL passes reputation checks but the redirect chain terminates at attacker infrastructure.
Follow redirect chains at the proxy and alert on chains terminating at newly registered domains (registration age < 30 days). Time-of-click URL rewriting in email gateways applies the same logic to inbound links.
Rule tuning
Preventive control
Force all egress through an inspecting proxy that resolves and categorises destinations. Block the newly-registered-domain category at the proxy — most attacker infrastructure is registered within days of use. Enable URL rewriting with time-of-click resolution on all inbound mail to catch obfuscated links that bypass initial scanning.