What is SMTP over IPv6 in the Context of Phishing?

Phishing attackers have advanced their tactics by utilizing SMTP over IPv6, taking advantage of both the technical utilities of the protocol and its complexities. In the realm of phishing, this combination helps cybercriminals obscure their digital footprints and evade detection mechanisms that are often attuned to IPv4.

SMTP over IPv6 is the process of transmitting email messages using the Simple Mail Transfer Protocol (SMTP) over Internet Protocol version 6 (IPv6).

Why It Matters

SMTP over IPv6 gains significance in phishing operations due to the versatility and disguise it provides for attackers. Operators encounter this term when analyzing the network layer of phishing attacks since IPv6 offers a vast address space, allowing phishers to rotate IP addresses frequently without overlapping. This makes tracking and blacklisting such addresses considerably more challenging compared to IPv4.

For network administrators and email security analysts, addressing the nuances of SMTP over IPv6 is critical. The protocol’s vastness permits attackers to conduct campaigns with a higher degree of imperceptibility, as many defenses are not yet optimized for IPv6. Misconfigured or unmonitored IPv6 capabilities in network infrastructure can be the entry points for phishing emails, bypassing traditional IPv4-focused security measures.

In Practice

Consider a scenario where a phishing email targets an enterprise, using SMTP over IPv6 to deliver a malicious payload. The email’s header appears like this:


Received: from [2001:0db8:85a3::8a2e:0370:7334] (example.email.com)

    by targetdomain.com with SMTP id ABC123 for &lt;victim@targetdomain.com&gt;;

    Mon, 23 Oct 2023 09:30:00 +0000 (UTC)

This email leverages IPv6 addressing, noted by the format [2001:0db8:85a3::8a2e:0370:7334], making it less likely for conventional filters focused on IPv4 to flag it.

An attacker might also manipulate domain name system (DNS) settings to have an IPv6 record that resolves to a convincing email sender domain:


example.email.com.   IN  AAAA    2001:0db8:85a3::8a2e:0370:7334

This tactic complicates efforts by security teams attempting to blacklist malicious IPs, since the attacker can rapidly transition to a new IPv6 address that looks legitimate.

Moreover, in a documented attack, operators might encounter lure emails that use SMTP over IPv6 to transmit seemingly urgent messages, such as:

Subject Line: Important Security Update Needed

Email Body: “Dear user, due to recent security enhancements, you must verify your credentials at the following link: Verify Now“

The IPv6 address embedded as a domain stance can pass certain security checks since defenders often focus on the traditional DNS name or IPv4 scrutinization.

Related Terms

Understanding SMTP over IPv6 often prompts further exploration into related concepts like DKIM (DomainKeys Identified Mail), which helps verify domain identity in emails, and DMARC (Domain-based Message Authentication, Reporting, and Conformance), which allows domain owners to set policies for email validation. Additionally, exploring IPv6 Security can provide insights into secure deployment strategies for this protocol.