Infoblox Reports Phishing Campaign Abusing .arpa Reverse-DNS Records
Summary
Infoblox reports a phishing campaign abusing arpa reverse-DNS records and hijacked CNAMEs. Attackers use misleading redirects and randomized subdomains; the toolkit has reportedly been used by multiple actors since 2017.
Key points
- Infoblox reports that a threat actor abused DNS-provider record controls to host phishing content on arpa reverse-DNS names, which are not intended to serve web content.
- According to Infoblox, the actor obtains IPv6 address space delegated to a reverse-DNS subdomain, then adds A records instead of the expected PTR records.
- Brand-impersonating emails conceal links in images and use redirect chains; randomized subdomains make the resulting fully qualified domain names harder to identify and block.
- The identified reverse-DNS names resolved to two IP addresses on Cloudflare's edge network, obscuring the location of the malicious content.
- Infoblox also reports hijacked CNAME records and domain-shadowing cases involving legitimate entities in education, government, media, retail, and telecommunications.
- Infoblox says CNAME abuse has been observed since September 2025, some domains have been abused for years, and the toolkit has been used by multiple threat actors since 2017.
Article Details
- Event Type
- Phishing campaign abusing .arpa reverse-DNS domains and DNS record management controls.
- Impact
- The campaign used brand-impersonating emails, hidden hyperlinks, and redirect chains to send victims to phishing content. Infoblox reports that hijacked CNAMEs were repeatedly abused in phishing attacks since September 2025, with some domains used in more than 100 email runs per day. The malicious content was hidden behind Cloudflare edge IPs.
Vendors
Industries
EducationInfoblox also discovered that the threat actor hijacked the Canonical Name (CNAME) records of known education, government, media, retail, and telecommunication entities and abused subdomains of their legitimate domainsGovernmentalso discovered that the threat actor hijacked the Canonical Name (CNAME) records of known education, government, media, retail, and telecommunication entities and abused subdomains of their legitimate domains inMediathat the threat actor hijacked the Canonical Name (CNAME) records of known education, government, media, retail, and telecommunication entities and abused subdomains of their legitimate domains in theirRetailthat the threat actor hijacked the Canonical Name (CNAME) records of known education, government, media, retail, and telecommunication entities and abused subdomains of their legitimate domains in their phishing