Squatting on the internet's infrastructure TLD via reverse-DNS loopholes

The .arpa top-level domain is reserved for critical internet infrastructure and closed to public registration, but a chain of loosely-verified free services lets anyone carve out a working sub-domain under it. The trick exploits ip6.arpa, the tree reserved for IPv6 reverse-DNS lookups: nothing in the spec forbids using those records to serve an ordinary website. Hurricane Electric’s tunnelbroker.net hands out a routed IPv6 prefix (and control of its rDNS delegation) with no meaningful identity checks — it accepts fake signup details and only requires an IPv4 tunnel endpoint that answers pings, which you can satisfy by borrowing the address of any random pingable site.

From the assigned prefix, the author derives a domain by zero-padding the hextets, splitting them into single nibbles, reversing them, and appending .ip6.arpa. DNS hosting goes to deSEC (Cloudflare rejected the .arpa name), rDNS delegation is pointed there from Tunnelbroker, and static hosting is handled by Surge, chosen specifically because it doesn’t force HTTPS. That last detail matters: many certificate authorities refuse to issue for .arpa, so TLS on these names is a real obstacle. A final CNAME to the surge.sh address makes the site resolve.

The write-up is a curiosity rather than an attack, but it’s a tidy illustration of how much of the DNS trust model rests on convention and unverified inputs. Free tunnel brokers and reverse-DNS delegation were never meant to gate against this kind of repurposing, and the result is that a supposedly locked-down infrastructure namespace can host arbitrary content with a few minutes of setup.