Threat actors are constantly looking for new ways to evade detection, and most techniques are variations on familiar themes. The abuse of the .arpa TLD is novel in that it weaponizes infrastructure that is implicitly trusted and essential for network operations. By using IPv6 reverse DNS domains as malicious links, the threat actor has discovered a delivery mechanism that bypasses security tools. The impact is immediate and cannot be overstated: security that depends on detecting suspicious domains using things like reputation, registration information, and policy blocklists is ineffective for these domains. These domains have an implicitly clean reputation, no registration information, and aren’t usually blocked by policy.
Певицу в Турции заподозрили в оскорблении Эрдогана17:51
，详情可参考PDF资料
type ty = TVar of tvar | TCon of string | TArr of ty * ty | TTuple of ty list。新收录的资料是该领域的重要参考
conn = sqlite3.connect(DB)