Researchers Find Two Phishing Infrastructure Campaigns Abusing IPv6 Reverse-DNS Zones

Mar 25, 2026 · Original article ↗

Summary

A scan of 127,906 IPv6 prefixes found two active ip6.arpa zones using wildcard A records, a technique that can evade reputation-based defenses. Another 382 zones had Cloudflare nameservers but no active A records; phishing delivery from the second campaign was not seen.

Key points

The investigation found two active ip6.arpa zones with wildcard A records, which let arbitrary subdomains resolve to attacker-controlled infrastructure.
Researchers tested 127,906 IPv6 prefixes, identifying 384 zones with Cloudflare nameservers and confirming wildcard A records on two.
One active zone matched a campaign previously documented by Infoblox; the other resolved directly to a server hosted by IONOS in Frankfurt.
The second zone remained active during the investigation, but researchers did not observe a phishing email, redirect chain, or linked landing page.
The other 382 zones had Cloudflare nameservers but no active wildcard A records, which the researchers describe as staged infrastructure.
Recommended defenses include monitoring for A or AAAA responses from .arpa zones, inspecting links in email, and alerting on unusual .arpa zone delegation.

Article Details

Attack Vectors: Phishing emails embed URLs using randomized subdomains under delegated ip6.arpa zones with wildcard A records, causing the URLs to resolve to attacker-associated servers.
The report says this technique can evade reputation-based email gateways and URL scanners because ip6.arpa is treated as reverse-DNS infrastructure.
The article identifies image-only clickable content as a common evasion tactic for this campaign.
Defensive Notes: Alert on or block A and AAAA record responses from .arpa zones; the article states that ip6.arpa zones should return PTR records.
Monitor delegated .arpa zones using commercial CDN nameservers and watch for wildcard A-record activation.
Extract and inspect hyperlinks in email content, including links hidden in image tags; use regex rules to identify randomized subdomains prepended to ip6.arpa strings.
Flag messages whose only clickable content is an image, and consider mail relayed through free IPv6 tunnel-provider netblocks as a risk signal.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`0[.]d[.]7[.]2[.]7[.]0[.]1[.]b[.]e[.]0[.]a[.]2[.]ip6[.]arpa`	Active malicious ip6.arpa zone resolving to the reported origin server.
DOMAIN	`1[.]9[.]5[.]0[.]9[.]1[.]0[.]0[.]7[.]4[.]0[.]1[.]0[.]0[.]2[.]ip6[.]arpa`	Listed as a staged ip6.arpa zone associated with the observed infrastructure.
DOMAIN	`5[.]2[.]1[.]6[.]3[.]0[.]0[.]7[.]4[.]0[.]1[.]0[.]0[.]2[.]ip6[.]arpa`	Listed as a staged ip6.arpa zone associated with the observed infrastructure.
DOMAIN	`8[.]1[.]9[.]5[.]0[.]9[.]1[.]0[.]0[.]7[.]4[.]0[.]1[.]0[.]0[.]2[.]ip6[.]arpa`	Listed as a staged ip6.arpa zone associated with the observed infrastructure.
DOMAIN	`9[.]a[.]d[.]0[.]6[.]3[.]0[.]0[.]7[.]4[.]0[.]1[.]0[.]0[.]2[.]ip6[.]arpa`	Listed as a staged ip6.arpa zone associated with the observed infrastructure.
DOMAIN	`d[.]d[.]e[.]0[.]6[.]3[.]0[.]0[.]7[.]4[.]0[.]1[.]0[.]0[.]2[.]ip6[.]arpa`	Listed as an active malicious ip6.arpa zone with a wildcard DNS record; the article's IOC table uses this spelling.
DOMAIN	`xqjerorqxs[.]d[.]d[.]e[.]0[.]6[.]3[.]0[.]0[.]0[.]7[.]4[.]0[.]1[.]0[.]0[.]2[.]ip6[.]arpa`	Example of a randomized phishing URL hostname under the malicious wildcard zone.
HOSTNAME	`mail[.]t-w[.]dev`	Reported as live mail infrastructure associated with Campaign B.
HOSTNAME	`webmail[.]t-w[.]dev`	Reported as live webmail infrastructure associated with Campaign B.
IPV4	`85[.]215[.]34[.]119`	Reported origin server IP resolving from the active malicious wildcard zone.
IPV6	`2a0e:b107:27d0:2::2`	Listed as an active IPv6 indicator associated with the reported malicious infrastructure.