Attackers abuse .arpa and IPv6 reverse DNS to evade phishing detection

Photo by protect.computer (custom explainer graphic) on protect.computer

What happened

Infoblox says threat actors are running phishing campaigns that abuse the .arpa infrastructure namespace (especially ip6.arpa) to push malicious links that can slip past defenses built around normal domain reputation checks.

Instead of using a standard phishing domain like example-login[.]com, attackers send links that look like reverse-DNS infrastructure strings (long labels ending in ip6.arpa) and then resolve those names to attacker infrastructure through permissive DNS configurations.

The campaign appears to combine this trick with:

1. IPv6 allocation/tunnel workflows to gain control over reverse DNS space,
2. short-lived links that expire in days,
3. traffic distribution systems (TDS) that redirect only selected victims,
4. and, in related activity, dangling CNAME hijacks and subdomain shadowing.

Why this technique is different

The .arpa domain is not a normal website namespace. It is reserved for internet infrastructure (IANA/IAB governance), including reverse mapping:

• in-addr.arpa for IPv4 reverse DNS,
• ip6.arpa for IPv6 reverse DNS.

Because many tools treat this namespace as inherently operational and trusted, threat actors can get an evasion advantage over controls that rely heavily on:

• domain age and registration signals,
• WHOIS-based risk scoring,
• known-malicious domain blocklists,
• and “suspicious TLD” heuristics.

In short: this is less about “new malware,” and more about abusing trust assumptions in core internet plumbing.

How the attack chain works (simplified)

1. Attacker gets control over a relevant IPv6 reverse namespace.
2. They generate unusual, long reverse-style hostnames (often with random prefixes).
3. They configure DNS behavior so those hostnames resolve toward phishing infrastructure.
4. Phishing email hides the link behind an image/button.
5. Click triggers redirects through TDS filtering.
6. Qualified victims land on credential/payment-harvest pages.
7. Non-qualified traffic gets benign pages or errors, complicating analysis.

How to check if you’re affected

Potentially affected environments

• Organizations relying on email/DNS controls that trust .arpa traffic by default.
• Security stacks that prioritize reputation/registration signals over behavior-based detection.
• Teams without correlation between email telemetry, DNS logs, and web proxy redirect chains.

Fast verification steps (SOC/IT)

1. Hunt email links for reverse-DNS patterns

   • Search for URLs/anchors ending in .ip6.arpa or unusual reverse-style labels.
   • Inspect image-only phishing emails where the visible lure and destination hostname do not match.

2. Review DNS query behavior

   • Alert on atypical A/AAAA query usage against ip6.arpa names when PTR-style reverse behavior is expected.
   • Flag high-entropy/randomized subdomain labels under reverse-DNS patterns.

3. Trace click-to-destination chains

   • Correlate email click events with DNS + web proxy redirects.
   • Identify short-lived domains and TDS hops that selectively redirect based on device/IP profile.

4. Validate controls and policies

   • Confirm secure email gateway rules do not blindly trust .arpa-ended links.
   • Add conditional quarantine/sandboxing for long reverse-DNS strings embedded in email hyperlinks.

5. Respond as potential credential compromise

   • If a user clicked and submitted data, reset credentials, revoke sessions, and monitor payment/account abuse indicators.

Immediate defensive actions

• Add detections for suspicious .ip6.arpa link patterns in inbound mail.
• Correlate DNS + URL redirection telemetry in one triage workflow.
• Prioritize behavior-based phishing detection over domain reputation alone.
• Tighten DNS and email policy exceptions for “infrastructure” namespaces.

Why this matters for defenders

Attackers are increasingly shifting from “obviously bad domains” to abuse of trusted systems. This campaign is a reminder that defenders should model phishing risk as a multi-stage behavior problem, not just a bad-domain lookup problem.

If your controls still assume infrastructure-like namespaces are always benign, this is a gap worth closing now.

Sources

• https://www.infoblox.com/blog/threat-intelligence/abusing-arpa-the-tld-that-isnt-supposed-to-host-anything/ (primary research source)
• https://www.iana.org/domains/arpa (primary governance/namespace source)
• https://www.rfc-editor.org/rfc/rfc3172 (management guidelines for .arpa)
• https://www.csoonline.com/article/4142631/hacker-abusing-arpa-domain-to-evade-phishing-detection-says-infoblox.html
• https://www.bleepingcomputer.com/news/security/hackers-abuse-arpa-dns-and-ipv6-to-evade-phishing-defenses/

Bottom line

The .arpa + IPv6 reverse-DNS phishing pattern is a practical bypass for reputation-heavy defenses. Teams should immediately add detections for reverse-style phishing links and validate that infrastructure namespaces are not receiving implicit trust in email and DNS policy paths.