The Invisible Trap: How Hackers Weaponize the Internet’s Root Infrastructure (.arpa) to Bypass Security

The report explains a phishing campaign that hijacks .arpa reverse-DNS domains (often obtained via free IPv6 tunnels) and abandoned subdomains to host convincing spoofed brand pages; attackers hide malicious links inside images and use Traffic Distribution Systems to serve scams selectively (targeting likely victims while showing benign pages to researchers), making these campaigns hard to detect and block without affecting critical infrastructure.