Hackers hijack .arpa domain for phishing scams — hosting malicious websites and domains where no one can spot them

• Hackers are abusing .arpa domains to effectively hide phishing attacks
• Phishing emails mimic trusted brands to trick users into revealing credentials
• IPv6 address ranges give attackers control over malicious .arpa subdomains

A new type of phishing attack has been seen exploiting the .arpa domain, a part of the internet normally used for essential network functions rather than websites.

Unlike more familiar domains such as .com or .net, .arpa helps computers match IP addresses to domain names, a process called reverse DNS.

But new research from Infoblox Threat Intel claims attackers now use this space to host phishing pages while avoiding standard security checks.

Why abusing .arpa is a serious threat

“When we see attackers abusing .arpa, they’re weaponizing the very core of the internet ...