CyberHappenings logo
☰
Home Browse Watchlists Experimental About

Track cybersecurity events as they unfold. Sourced timelines. Filter, sort, and browse. Fast, privacy‑respecting. No invasive ads, no tracking.

Threat Actors Abuse .arpa DNS and IPv6 for Phishing Campaigns

First reported
Last updated
1 unique sources, 1 articles

Summary

Hide ▲

Threat actors are exploiting the .arpa domain and IPv6 reverse DNS to evade phishing defenses. They abuse reverse DNS zones to host phishing sites, leveraging reputable DNS providers like Cloudflare and Hurricane Electric. The campaign uses short-lived phishing links and other techniques such as hijacking dangling CNAME records and subdomain shadowing. The attackers reserve IPv6 address space, configure additional DNS records, and use reverse DNS hostnames to redirect victims to phishing sites. The lack of WHOIS data and domain age information in the .arpa domain makes detection harder. Infoblox observed over 100 instances of hijacked CNAMEs from well-known organizations, including government agencies, universities, and retailers.

Timeline

  1. 08.03.2026 16:12 1 articles · 23h ago

    Threat Actors Abuse .arpa DNS and IPv6 for Phishing Campaigns

    Threat actors are exploiting the .arpa domain and IPv6 reverse DNS to evade phishing defenses. They abuse reverse DNS zones to host phishing sites, leveraging reputable DNS providers like Cloudflare and Hurricane Electric. The campaign uses short-lived phishing links and other techniques such as hijacking dangling CNAME records and subdomain shadowing. The attackers reserve IPv6 address space, configure additional DNS records, and use reverse DNS hostnames to redirect victims to phishing sites. The lack of WHOIS data and domain age information in the .arpa domain makes detection harder. Infoblox observed over 100 instances of hijacked CNAMEs from well-known organizations, including government agencies, universities, and retailers.

    Show sources
    Open in new tab

Information Snippets