Hackers Abuse .arpa Top-Level Domain to Host Phishing Scams

Infoblox researchers uncovered an active phishing campaign in which threat actors leverage the reserved .arpa TLD and free IPv6 tunnels to host fraudulent sites that evade traditional security checks. The actors pair this with dangling CNAME hijacks, domain shadowing, and Traffic Distribution Systems to scale attacks against organizations (including media and universities) and deliver payment‑card‑stealing phishing lures.