Threat Actors Abuse IPv6 Reverse DNS to Host Phishing Links Under .arpa

Feb 26, 2026 · Original article ↗

Summary

Researchers describe phishing campaigns that place malicious content behind IPv6 reverse-DNS names under .arpa, using A records, redirects and hijacked CNAMEs to evade reputation-based defenses.

Key points

Actors use delegated IPv6 address space and control of corresponding ip6[.]arpa zones to create reverse-DNS names with A records instead of expected PTR records.
Phishing emails use image-based lures with hidden links to reverse-DNS names; the links can resolve through reputable DNS providers such as Cloudflare and Hurricane Electric.
Traffic distribution systems fingerprint and filter visitors before redirecting some to phishing pages; mobile devices and residential IP addresses increased the researchers’ likelihood of reaching a malicious page.
The campaigns also use dangling CNAME hijacking and domain shadowing; researchers observed more than 100 instances of hijacked CNAMEs.
Examples of abused parent domains include publicnoticessites[.]com, hobsonsms[.]com and hyfnrsx1[.]com.
Phishing links usually remain active for only a few days. Researchers reported no queries to these kinds of domains in customer traffic, but observed queries in global passive DNS.

Article Details

Attack Vectors: Phishing emails impersonate major brands and use a single linked image to conceal a malicious URL.
The hidden link uses an IPv6 reverse-DNS FQDN under ip6.arpa that resolves through an A record to phishing content.
The campaigns use traffic distribution systems and multi-stage redirects to fingerprint and filter victims, including checks involving device type and residential IP address.
Threat actors acquire IPv6 address space and configure corresponding ip6.arpa zones with A records instead of the expected PTR records.
The campaigns also use hijacked dangling CNAMEs and shadow subdomains to route victims through domains associated with legitimate organizations.
Phishing lures include free-gift or survey offers, interrupted subscriptions, and cloud-storage quota warnings.
Defensive Notes: Reputation-based detection, registration-information checks, and policy blocklists may be ineffective for the abused ip6.arpa links.
The article advises careful consideration before blocking indicators associated with legitimate services and namespaces.
Phishing links are usually active for only a few days, which can complicate investigation and reproduction.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`actinismoleil[.]sbs`	Malicious phishing landing domain observed in the campaigns.
DOMAIN	`cablecomparison[.]shop`	Malicious phishing landing domain observed in the campaigns.
DOMAIN	`cheapperfume[.]shop`	Short-lived malicious phishing domain observed in the campaigns.
DOMAIN	`d[.]d[.]e[.]0[.]6[.]3[.]0[.]0[.]0[.]7[.]4[.]0[.]1[.]0[.]0[.]2[.]ip6[.]arpa`	IPv6 reverse-DNS phishing link observed in the campaigns; the article reports that this type of FQDN resolves to phishing content.
DOMAIN	`drumsticks[.]store`	Short-lived malicious phishing domain observed in the campaigns.
DOMAIN	`dulcetoj[.]com`	Traffic distribution system domain used in the phishing redirect infrastructure.
DOMAIN	`fightingckmelic[.]makeup`	Malicious phishing domain listed among indicators observed in the campaigns.
DOMAIN	`golandof[.]com`	Traffic distribution system domain used in the phishing redirect infrastructure.
DOMAIN	`hobsonsms[.]com`	Expired domain whose subdomain was set up by the threat actor to hijack CNAMEs used by universities in phishing.
DOMAIN	`hyfnrsx1[.]com`	Expired domain with hijacked CNAME subdomains observed in phishing emails.
DOMAIN	`politeche[.]com`	Traffic distribution system domain observed in the campaigns.
DOMAIN	`publicnoticessites[.]com`	Expired domain purchased by the threat actor; control of it enabled hijacking CNAMEs used in phishing emails.
DOMAIN	`taktwo[.]com`	Traffic distribution system domain listed among campaign indicators.
DOMAIN	`toindom[.]com`	Traffic distribution system domain observed in the campaigns.