Phishing Schemes Abuse .arpa TLD and IPv6 Tunnels to Evade Detection

Infoblox Threat Intel details a sophisticated phishing campaign that abuses the .arpa namespace and IPv6 tunnel services to publish conventional A records under reverse DNS domains, bypassing reputation-based security controls. Attackers use malspam with hyperlinked images, a Traffic Distribution System that fingerprints users (favoring mobile/residential IPs), and hijacked/expired CNAMEs from trusted organizations; the report includes numerous IOCs and recommends monitoring the .arpa namespace and unusual DNS record additions.