Phishing Schemes Abuse .arpa TLD and IPv6 Tunnels to Evade Detection

Cybersecurity researchers at Infoblox Threat Intel have uncovered a highly sophisticated phishing campaign that exploits the foundational plumbing of the internet to bypass enterprise security controls.

In a novel evasion tactic, threat actors are weaponizing the .arpa top-level domain (TLD) and utilizing IPv6 tunnels to host malicious phishing content.

This approach actively circumvents traditional domain reputation checks, presenting a unique and emerging challenge for network defense systems.

Unlike conventional consumer-facing TLDs such as .com or .net, the .arpa domain is exclusively reserved for internal internet infrastructure.

Its primary function is reverse DNS mapping, which translates IP addresses back into domain names. It was fundamentally never designed to host public-facing websites or web content.

However, attackers have discovered critical blind spots in the DNS record management systems of certain providers.

By leveraging free IPv6 tunnel services, threat actors gain administrative control over specific IPv6 address blocks.

Instead of creating the expected reverse DNS pointer (PTR) records, they generate standard A records for these .arpa subdomains. This creates fully qualified domain names disguised as core infrastructure addresses, which security tools inherently trust and rarely scrutinize.

The Attack Chain and Hijacked CNAMEs

According to Infoblox, the attack sequence typically begins with malspam emails impersonating major consumer brands.

These emails contain a single hyperlinked image that promises a free prize or falsely claims a subscription has been interrupted. When a victim clicks the image, they are redirected through a complex Traffic Distribution System (TDS).

The TDS fingerprints the user’s traffic, specifically targeting mobile devices operating on residential IP addresses before finally delivering the malicious payload.

Alongside the .arpa abuse, this campaign heavily relies on dangling CNAME hijacking. Threat actors have compromised abandoned subdomains belonging to reputable governments, media organizations, and universities.

By registering the expired domains that these abandoned CNAMEs still point to, attackers seamlessly hijack the digital reputation of highly trusted entities to mask their malicious traffic.​

Dr. Renée Burton, VP of Infoblox Threat Intel, noted that weaponizing the .arpa namespace effectively turns the core of the internet into a phishing delivery mechanism.

Because reverse DNS domains possess an implicitly clean reputation and lack traditional registration data, standard security tools that rely on URL structure and blocklists fail to detect them.

Organizations must begin treating core DNS infrastructure as a potential attack surface and deploy specialized filtering to monitor unusual record additions in the .arpa namespace.

Indicators of Compromise (IOCs)

Indicator	Description
<10 random letters>.5.2.1.6.3.0.0.0.7.4.0.1.0.0.2[.]ip6[.]arpa	IPv6 reverse DNS domain with DGA subdomain
<10 random letters>.1.9.5.0.9.1.0.0.0.7.4.0.1.0.0.2[.]ip6[.]arpa	IPv6 reverse DNS domain with DGA subdomain
<10 random letters>.8.1.9.5.0.9.1.0.0.0.7.4.0.1.0.0.2[.]ip6[.]arpa	IPv6 reverse DNS domain with DGA subdomain
<10 random letters>.9.a.d.0.6.3.0.0.0.7.4.0.1.0.0.2[.]ip6[.]arpa	IPv6 reverse DNS domain with DGA subdomain
<10 random letters>.d.d.e.0.6.3.0.0.0.7.4.0.1.0.0.2[.]ip6[.]arpa	IPv6 reverse DNS domain with DGA subdomain
actinismoleil[.]sbs	Malicious phishing domain
cablecomparison[.]shop	Malicious phishing domain
cheapperfume[.]shop	Malicious phishing domain
drumsticks[.]store	Malicious phishing domain
fightingckmelic[.]makeup	Malicious phishing domain
dulcetoj[.]com	TDS domain
golandof[.]com	TDS domain
politeche[.]com	TDS domain
taktwo[.]com	TDS domain
toindom[.]com	TDS domain
publicnoticessites[.]com	Domain with a subdomain acting as a hijacked CNAME
hobsonsms[.]com	Domain with a subdomain serving as a hijacked CNAME
hyfnrsx1[.]com	Domain with a subdomain acting as a hijacked CNAME

Organizations must begin treating core DNS infrastructure as a potential attack surface and deploy specialized filtering to monitor unusual record additions in the .arpa namespace.

Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.