5[.]2[.]1[.]6[.]3[.]0[.]0[.]0[.]7[.]4[.]0[.]1[.]0[.]0[.]2[.]ip6[.]arpa

Posts referencing this indicator

• Abusing .arpa: The TLD That Isn’t Supposed to Host Anything

  Base IPv6 reverse DNS domain abused to host phishing content via DGA subdomains.

  2026-05-13