The Punycode Host That Imitated Nothing

One message reached one mailbox at a pharmaceutical contract development and manufacturing organization, a mid-size US pharma CDMO making small-molecule active ingredients. The sole addressee was a senior executive assistant, listed once in the To field and once in the Cc field, which is why the incident record shows that mailbox twice. What rendered was a consumer healthcare reward: a black banner carrying the MyChart patient-portal wordmark, a photograph of a first-aid kit, a headline announcing a free medical kit, a generic salutation, and two stacked red buttons. Both pointed at one host, and that host is the story.

In its ASCII form, the form a mail log or a blocklist entry actually holds, the label read xn--cqucqcubr-95a2o93b, sitting as a subdomain under an established UK marketing-services apex domain we are not naming, because the record does not establish who controlled it. The xn-- prefix is the IDNA marker: the label encodes a string containing characters outside ASCII, and it is an invitation to decode.

What Came Back When We Decoded It

Nothing came back. That is the finding.

The label decodes to twelve characters: ðcquÿcqœcubr. Three are non-ASCII: U+00F0 latin small letter eth, U+00FF latin small letter y with diaeresis, and U+0153 the latin small ligature oe. The other nine are ordinary letters in no meaningful order. The decoded string approximates neither the impersonated patient-portal brand, nor the benefits programme in the subject line, nor the recipient's employer, nor any word in any language we could check.

That inverts what our own library has taught analysts to expect. Nearly every non-ASCII domain case we publish is an imitation: a Cyrillic character standing in for a Latin one, a lowercase L wearing an uppercase I's clothes, a template rebuilt from confusable glyphs. In all of those the characters exist to look like something. Here they look like nothing, and the consequence lands on the defender, not the recipient.

One Host, Two Strings That Share No Characters

The encoded and rendered labels have no characters in common. An analyst who copies the host out of a mail header records one string; one who reads it off a browser address bar or a screenshot records a completely different one. Neither search finds the other, and neither blocklist entry covers the other, unless somebody normalizes deliberately when the indicator is written down. A label carrying an eth and an oe ligature also cannot be reliably retyped from a picture, so the fastest manual lookup fails here.

The second consequence is worth a habit. The standard response to a non-ASCII hostname is to decode it, compare it to the brand it seems to mimic, and conclude impersonation. Run that playbook here and it terminates in a null. A reviewer working a queue can read that null as reassurance, close the ticket, and never register that a healthcare-branded reward lure pointed an executive assistant at a Punycode subdomain over plain HTTP with a sixty-three character random path token. MITRE catalogues masquerading as T1036, and the delivery maps to phishing via link with impersonation and user execution. None of it depends on the label meaning anything.

See Your Risk: Calculate how many threats your SEG is missing

The Brand Never Touched Its Own Attack

The counterfeit banner is a short beat for a similar reason. The wordmark came from no system belonging to the impersonated portal vendor. It was hotlinked twice from a free public image host, and both image tags in the raw HTML were malformed: one carried a stray apostrophe inside the URL, the other was protocol-relative, and the render shows a broken-image placeholder where one failed to load. The brand's own infrastructure was never involved, and the impersonation engine in the platform record did not fire: the field came back false with no details attached.

Two details stay supporting facts. The message carried no DKIM signature entering the Microsoft ecosystem and emerged from a second organization's tenant with one that verified on that tenant's service subdomain, not the organizational domain in the From line. The HTML also carried an invisible block of unrelated harvested text and random tokens.

What Passed, And What Fired

Every control keyed to a URL, a sender or an authentication result either passed or declined to act. Our link scan of the Punycode host returned clean with no screenshot captured, which is why nothing here characterizes the destination: no capture exists, and no click was recorded. The mail filter marked the message SFV:NSPM with SCL:1 and delivered it to the inbox. SPF softfailed rather than failed, because the From domain publishes a ~all mechanism, which RFC 7208 treats as advisory. There was no DMARC record for that domain, so per RFC 7489 no policy applied. The gateway result read compauth=pass reason=115. Microsoft prepended a first-contact safety tip and rewrote the call-to-action through its time-of-click protection, and it landed anyway.

What fired was Themis, reading the message's language and structure at 80 percent confidence, with a supporting signal from how similar incidents had been resolved across the community. There was no human reporter, and arrival to mitigation took under twenty seconds.

The 2024 Verizon Data Breach Investigations Report puts phishing in fifteen percent of breaches and a human element in sixty-eight percent, and both figures include plenty of messages whose infrastructure looked unremarkable. CISA's phishing guidance and the NIST definition of phishing frame the attack around the deception delivered to a person, not a signature in the infrastructure. When a decode returns a null, the null is data about your playbook, not a verdict on the message.

Indicators of Compromise

MITRE ATT&CK Mapping

Building A Habit Around Hosts You Cannot Retype

Three changes follow. Normalize at capture: whatever writes indicators into your tooling, including your URL protection, should store both the encoded and the decoded form of any IDNA label so a later search in either form hits. Treat an unexpected non-ASCII host as an escalation trigger in its own right, whether or not decoding yields a recognizable target. And do not let a clean URL verdict on an unresolved host close a ticket a language signal opened.

The pattern is one we see constantly across the 35,000+ security professionals and 17,000+ organizations we work with: a message that survives every deterministic check and gets caught on how it reads. When the artifact refuses to mean anything, the meaning is in the message.