Strange E-Mail - scam?

Nov 02, 2025 Last reply: 8 months ago 30 Replies

IDN - internationalized domain name (IDN) decode:

$ idn2 -d "www.gov.xn--uk-o2t" | xxd

00000000: 7777 772e 676f 762e 756b e280 990a
formatting link

And e28099 is an apostrophe (or "single comma quotation mark"). I wonder whether that has been included in a copy and paste, and then encoded by Chris' "tin" newsreader? (0a is a newline).

formatting link

Remarkably unsuccessful then since it leads nowhere

Yes, I know what an IDN is, I mentioned it earlier, but please look at the source of the first message in this thread and tell me, do you see the punycode in there?

No I won't! It's ordinary text in a terminal window, hovering a mouse cursor over it does nothing as there's nothing to do.

That's what I've been trying to tell people. Thunderbird is f****ng up and fooling everyone.

It sees the mangled "smart" quotes ’ immediately following the .uk and *incorrectly* assumes this an attempt to sneak illegal characters into the URL, so "fixes" this, but in reality it is making matters worse ...

Reminding you to tax a vehicle that you previously owned or scrapped?

No, although I do see UTF-8 apostrophes (e28098 and 99) in the first occurance.

(Going into my newsfeed cache on disc to try and avoid any interference from my newsreader (emacs/gnus)).

$ grep http 1313319 | xxd

00000000: 2020 2020 2020 20e2 8098 6874 7470 733a ...https: 00000010: 2f2f 7777 772e 676f 762e 756b e280 992e //
formatting link
00000020: 0a20 2020 2020 2020 312e 2068 7474 7073 . 1. https 00000030: 3a2f 2f77 7777 2e67 6f76 2e75 6b2f 7665 ://
formatting link
00000040: 6869 636c 652d 7461 780a hicle-tax.

And here is what's going on ... mangled characters like those "smart" quotes is a common encoding issue with C&P'ed text, but in this case that error gets compounded.

Thunderbird knows that only ASCII is allowed in a domain name, but because the trailing smart quote (U+2019) immediately follows the .uk it sees that as an attempt to smuggle anillegal domain, and tries to punyencode the TLD uk’ resulting in xn--uk-o2t when you hover, it then shows the "fixed" URL

formatting link
in reality thunderbird has made a bad thing worse.

Treat it as a scam.

xn-- is the Punycode identifier, xn--uk-o2t is the Punycode for 'uk' (0x75, 0x6B in UTF-8) followed by U+2019 RIGHT SINGLE QUOTATION MARK.

ie Thunderbird has decided the closing quote mark is part of the URL and generated a Punycode-encoded version including the quote.

Theo

Indeed, if you go to CyberChef:

formatting link
You can see that:

www.gov.xn--uk-o2t

is a way of representing:

formatting link

Join the Discussion

Have something to add? Share your thoughts — no account required.

Didn't find your answer?

Ask the community — no account required