Phishing Campaign Abuses IPv6 Reverse DNS to Evade Defenses
Summary
Infoblox reports phishing campaigns abusing ip6[.]arpa reverse-DNS records, trusted DNS providers and short-lived TDS redirects to evade domain-reputation checks; it also observed more than 100 hijacked CNAMEs.
Key points
- Infoblox reports that attackers reserve IPv6 address space and create A records on ip6[.]arpa reverse-DNS hostnames that point to phishing infrastructure.
- The attackers reportedly use DNS providers such as Cloudflare and Hurricane Electric to benefit from their reputations and obscure backend infrastructure.
- Phishing emails use image links to reverse-DNS hostnames; some resolve to Cloudflare IP addresses.
- A traffic distribution system (TDS) assesses visitors and sends eligible targets to phishing pages while redirecting others to legitimate sites.
- Infoblox says the links remain active for only a few days, which researchers believe makes analysis more difficult.
- Infoblox observed more than 100 instances of hijacked CNAME records involving well-known organizations, as well as subdomain shadowing.
- The special-use domain lacks typical registration details such as WHOIS data and domain age, complicating detection by email gateways and security tools.
Article Details
- Event Type
- Phishing campaign abusing IPv6 reverse DNS records and DNS configurations to evade domain-reputation checks and email security filters.
- Impact
- The campaign used short-lived ip6.arpa links, DNS-provider infrastructure, and traffic distribution systems to route eligible visitors to phishing sites. Infoblox reported more than 100 instances involving hijacked CNAME records associated with government agencies, universities, telecommunications companies, media organizations, and retailers.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| HOSTNAME | d[.]d[.]e[.]0[.]6[.]3[.]0[.]0[.]0[.]7[.]4[.]0[.]1[.]0[.]0[.]2[.]ip6[.]arpa | Example reverse-DNS hostname used in phishing email image links in the reported campaign. |
MITRE ATT&CK
Vendors
CloudflareBy leveraging reputable providers like Cloudflare and Hurricane Electric, using short-lived randomized ip6.arpa hostnames and TDS redirects, attackers can bypass domain reputation checks and email security filters,Hurricane ElectricBy leveraging reputable providers like Cloudflare and Hurricane Electric, using short-lived randomized ip6.arpa hostnames and TDS redirects, attackers can bypass domain reputation checks and email security filters,
Tools
Industries
Government“We found over 100 instances where the threat actor used hijacked CNAMEs of well-known government agencies, universities, telecommunication companies, media organizations, and retailers,” explained Infoblox.Media“We found over 100 instances where the threat actor used hijacked CNAMEs of well-known government agencies, universities, telecommunication companies, media organizations, and retailers,” explained Infoblox.