Vendor
Hurricane Electric
- First Reported
- Feb 26, 2026
- Latest Reported
- Mar 25, 2026
Reported Context (4)
- First, they obtain a free IPv6 /48 prefix from a tunnel provider like Hurricane Electric. This gives them administrative control over the corresponding ip6.arpa reverse DNS zone — a zone that, by RFC design, should only Researchers Find Two Phishing Infrastructure Campaigns Abusing IPv6 Reverse-DNS Zones
- These records were created through Cloudflare and Hurricane Electric, but other DNS providers also allow the configuration. Infoblox Reports Phishing Campaign Abusing .arpa Reverse-DNS Records
- By leveraging reputable providers like Cloudflare and Hurricane Electric, using short-lived randomized ip6.arpa hostnames and TDS redirects, attackers can bypass domain reputation checks and email security filters, Phishing Campaign Abuses IPv6 Reverse DNS to Evade Defenses
- Threat actors leveraged free IPv6 tunnels to obtain /64 ranges and used providers such as Cloudflare and Hurricane Electric (and others) to configure name servers and A records for reverse DNS names. Threat Actors Abuse IPv6 Reverse DNS to Host Phishing Links Under .arpa
MITRE ATT&CK (5)
Vendors (2)
Tools (2)
Industries (5)
Countries (1)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.