CampaignPublished 27 Feb 2026

Abusing .arpa: The TLD That Isn't Supposed to Host Anything

Source AlienVault OTX General

Description

Threat actors have discovered a novel method to bypass security controls by abusing the .arpa top-level domain (TLD) in conjunction with IPv6 tunnels. They are exploiting a feature in DNS record management of certain providers to add IP address records for .arpa domains, allowing them to host phishing content on domains that should not resolve to an IP address. The phishing campaigns use spam emails impersonating major brands, with hyperlinked images leading to malicious websites through traffic distribution systems. This technique weaponizes trusted infrastructure essential for network operations, making it challenging for security tools to detect suspicious domains based on reputation, registration information, or policy blocklists.

Impact

This threat poses a significant risk to organizations globally by enabling phishing attacks that are harder to detect and block due to the misuse of the .arpa TLD, a domain space traditionally trusted and exempt from typical domain reputation checks. The ability to host malicious content on .arpa domains undermines existing security controls, increasing the likelihood of successful phishing campaigns that can lead to credential theft, financial fraud, and potential network compromise. The use of IPv6 tunnels and traffic distribution systems further complicates attribution and mitigation. Organizations relying heavily on email for communication and those with less mature DNS monitoring capabilities are particularly vulnerable. The abuse of trusted infrastructure domains could erode confidence in DNS-based security mechanisms and increase the operational burden on security teams to identify and block such threats. Additionally, the campaign's evasion techniques may reduce the effectiveness of automated detection tools, requiring more advanced threat hunting and manual analysis.

Defensive guidance

Organizations should implement enhanced DNS monitoring focused on unusual record additions in the .arpa namespace, including the presence of A and AAAA records where none should exist. Security teams must update phishing detection rules to consider .arpa domains as potential attack vectors despite their traditional trust status. Deploy DNS filtering solutions capable of inspecting and blocking suspicious .arpa domain resolutions, especially those linked to IPv6 tunnels or unusual traffic patterns. Integrate threat intelligence feeds that include indicators related to this campaign and monitor for the listed suspicious domains. Employ advanced email security solutions that analyze embedded links and images for redirection to malicious infrastructure, including traffic distribution systems. Conduct regular user awareness training emphasizing the risks of phishing links, even from seemingly trusted domains. Network defenders should also consider implementing DNS response policy zones (RPZ) to block known malicious .arpa domains. Collaboration with DNS providers to restrict or audit IP record additions in .arpa zones can help prevent abuse. Finally, enhance logging and alerting on DNS queries and resolutions involving .arpa to detect anomalous activity early.

Indicators of compromise

Domains 13

actinismoleil.sbs
cablecomparison.shop
cheapperfume.shop
drumsticks.store
dulcetoj.com
fightingckmelic.makeup
golandof.com
hobsonsms.com
hyfnrsx1.com
politeche.com

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 27 Feb 2026, 10:14 UTC

MITRE ATT&CK techniques11 from threat tags

Technical details

Indicators of compromise

Domains 13

Community reviews

Related threats