ABUSING .ARPA: THE TLD THAT ISN'T SUPPOSED TO HOST ANYTHING

Summary from the TLDR InfoSec newsletter

The Infoblox Threat Intel team detected a novel phishing campaign that abuses the .arpa domain using IPv6 reverse domains to bypass firewalls and other detections. The .arpa TLD is a special TLD that is primarily used to map IP addresses to domains and is unlikely to be blocked. The attackers were able to find DNS registrars that allowed them to create A records for these domains and used them in phishing campaigns that advertised free prizes.