Loading story…
Threat actors are abusing the special-use .arpa DNS namespace—intended for internet infrastructure and reverse-DNS lookups—to make phishing infrastructure harder for email security gateways and reputation systems to evaluate. The activity leverages reverse-DNS conventions (IPv4 in-addr.arpa and IPv6 ip6.arpa) but uses atypical forward-lookups (e.g., A/AAAA records) and non-standard hostnames under .arpa, which can slip past controls that treat .arpa traffic as benign or “internal plumbing.”
Reporting attributed the technique to observations shared by Infoblox, noting it combines legacy DNS assumptions with modern IPv6 usage to reduce detection efficacy for “basic scam-type” phishing, with concern it may be applicable to more targeted operations. Defensive guidance highlighted that legitimate in-addr.arpa names follow a strict IP-derived format ending in the suffix, so any .arpa query that is not a PTR-style reverse lookup or does not match expected naming patterns should be blocked or at least alerted on, and organizations should review DNS/email filtering logic to ensure .arpa is not implicitly trusted.
Get the infrastructure and lures behind it.
3 events from the most recent confirmed update back to the earliest known activity.
Reporting on Infoblox's findings highlighted that defenders should flag or block .arpa queries using atypical hostnames or A/AAAA lookups instead of expected PTR-style reverse lookups. The guidance emphasized that .arpa abuse is harder to assess because the namespace lacks normal registered-domain metadata such as WHOIS and domain age.
Infoblox reported that the phishing links were short-lived and used a traffic distribution system to filter targets and redirect non-targets to legitimate sites. The same activity also involved reputable infrastructure providers, dangling CNAME hijacking, and subdomain shadowing, including more than 100 hijacked CNAME instances tied to well-known organizations.
Infoblox identified a phishing campaign using IPv6 reverse-DNS names under ip6.arpa to create phishing URLs that can evade domain reputation checks and some email security gateways. The attackers controlled IPv6 address space and reverse-DNS zones, then placed non-PTR records such as A records on reverse-DNS hostnames to direct victims to phishing infrastructure.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Infoblox Threat Intel reported a **previously unreported phishing technique** that abuses the infrastructure-focused **.arpa** TLD—normally used for reverse DNS mapping—to host and deliver phishing content in ways that can bypass common enterprise controls. Threat actors obtain control of IPv6 address space via **free IPv6 tunnel services**, then exploit DNS management weaknesses at some providers to create records that should not exist for reverse-DNS zones (e.g., creating `A` records instead of expected `PTR` records). This results in long, reverse-DNS-style domains under `ip6.arpa` that resolve and can serve malicious content, while appearing “infrastructure-like” and therefore less likely to be blocked by reputation-based defenses. The observed campaigns use **malspam** impersonating major consumer brands and typically present a single image containing an embedded hyperlink, obscuring the unusual `.arpa` destination from the user. Clicking the image sends victims through a **Traffic Distribution System (TDS)** that fingerprints traffic (including device targeting such as mobile) and then redirects to fraudulent pages. Reporting emphasized that because `.arpa` is critical to Internet operations and is rarely treated as a web-hosting namespace, defenders may have blind spots in URL filtering, domain reputation, and DNS policy enforcement when attackers weaponize `ip6.arpa`-style hostnames.
Jun 29, 2026
Security researchers reported multiple **phishing evasion** techniques designed to defeat modern email and AI-assisted defenses rather than relying only on traditional lure quality. One campaign analyzed by KnowBe4 used **graymail-style content padding** and extreme whitespace insertion to manipulate NLP-based email security tools, placing benign promotional text, legitimate signatures, and trusted links far below the visible phishing lure so scanners would weigh the message as less malicious. A separate LevelBlue-tracked trend showed attackers abusing enterprise **URL rewriting** and *Safe Links*-style protections by sending phishing through compromised accounts, causing security gateways to generate trusted wrapped URLs that could then be reused in campaigns targeting **Microsoft 365** users. The activity reflects a broader shift toward exploiting the gap between what users see and what automated systems inspect. In the URL-rewriting abuse, operators tied to **Tycoon2FA** and **Sneaky2FA** built multi-layer redirect chains across several trusted vendor domains to obscure final destinations and steal credentials and MFA session cookies through adversary-in-the-middle infrastructure, enabling account takeover, internal phishing, data theft, and sometimes ransomware follow-on activity. Related research from LayerX showed a different but thematically aligned evasion method in which **font rendering and CSS** make webpages display malicious commands to users while AI assistants parsing the underlying HTML see only harmless text, underscoring that attackers are increasingly targeting AI and trust-based inspection layers as part of phishing and social-engineering operations.
Jun 29, 2026
Threat actors are increasingly hosting phishing infrastructure on legitimate cloud and decentralized platforms, including **Cloudflare Workers**, **Cloudflare Pages**, **Vercel**, **GitHub Pages**, **Netlify**, and **IPFS** gateways, to evade detection and benefit from trusted shared-domain reputation and free-tier scalability. Securelist reported that defenders blocked **224,984** unique third-level domains tied to phishing on these services between August 2025 and July 2026, and identified and neutralized more than **390,000** phishing pages. One documented campaign used a compromised website as an initial relay before directing victims to Cloudflare Workers subdomains for staging, where attackers deployed service workers and the **Ultraviolet** proxy library to transparently intercept traffic in an adversary-in-the-middle attack. The operation also used a browser-in-the-browser spoof to imitate Microsoft login prompts and steal **credentials**, **MFA codes**, and **session tokens**, underscoring how legitimate cloud infrastructure is being repurposed to support large-scale credential theft.
Aug 4, 2026